How every request resolves its tenant, binds the correct data plane, and returns only permitted, decrypted, audited PHI.

1. 1An SPA request reaches nginx, which maps the request origin/subdomain to the tenant header
2. 2OrgContextMiddleware resolves the tenant from subdomain, header and JWT and cross-validates them, returning a fail-closed 403 on mismatch
3. 3It binds the tenant id, member role and permissions, the tenant data-plane database alias, and the PostgreSQL RLS session GUCs
4. 4The DRF viewset gates the caller through the Redis-cached RBAC permission catalogue and phi_guard field-group checks
5. 5The routed queryset executes under the bound alias with RLS, and encrypted PHI columns are decrypted with the per-tenant DEK
6. 6The permissioned serializer drops out-of-scope fields and PHIAuditMiddleware records a fail-closed audit entry before the response returns

How a clinical encounter becomes a signed, EHR-ready SOAP note through provider-abstracted transcription and AI generation.

1. 1A clinician opens an encounter in the Clinical Workspace and captures the consultation audio
2. 2The STT factory selects Deepgram or ElevenLabs for the tenant and returns a transcript
3. 3The transcript is sent to the OpenAI-backed SOAP generator to draft a structured clinical note
4. 4The clinician reviews, edits and digitally signs the note; a second provider can co-sign
5. 5Signing finalises the record as immutable, and the encounter can be pushed to the connected EHR over FHIR R4

How a third-party client exchanges a scoped API key for a short-lived service-JWT and consumes clinical AI on a separate compute plane.

1. 1A developer creates a scoped, reveal-once API key (sk_test or sk_live) in the Developer Console
2. 2The client exchanges the key at the control plane for a short-lived service-JWT (Contract-alpha, HS256, under 300s)
3. 3The client calls a compute-plane capability under /api/service/v1 — soap.generate, report.analyze, lab.analyze, drug.interaction or transcription — with the JWT
4. 4The service API verifies the token audience and scope, meters the call, and returns the analysis synchronously in the same response

How patients enrol, book and pay across the web portal and a voice channel gated by server-side identity verification.

1. 1A patient activates their account with an enrolment code in the Patient Portal, or calls the Twilio phone line
2. 2On the voice channel, an ElevenLabs agent verifies the caller by date of birth before any PHI tool is allowed to run
3. 3The patient books or confirms an appointment through the shared booking service, which enforces availability and double-booking guards
4. 4Invoices are paid inline through Stripe Connect and reconciled against the patient account balance by webhook