Architecture · Psychiatry.Ink

The zero-knowledge patient vault

Patient name and date of birth are encrypted in your browser before anything is stored — AES-256, with a content key that is itself wrapped by a second key whose private half never leaves your device. Our server stores ciphertext; we could not read it even if we wanted to.

One gate for every AI call

There is exactly one code path through which text can reach an AI model. It de-identifies the text on the server, then re-checks the result; if identifying patterns remain, the call is blocked instead of sent. No feature can bypass the gate — an automated audit fails our build if one tries.

Advisory intelligence, clinician truth

Diagnostic criteria support and clinical extraction never write to the chart on their own. Every suggestion is a draft with evidence attached; only your explicit acceptance — your attestation — turns it into clinical documentation.

Zone 1

Your device

The editor, the case file and all clinical work happen here.
Patient identifiers are encrypted here; the private key stays in this browser.
Scanned documents are stored encrypted and are never parsed or uploaded for reading.
Deterministic engines — diagnostic criteria and Noevia — run entirely on-device.

Zone 2

Our server

Stores encrypted snapshots and wrapped keys — ciphertext plus technical metadata.
Runs the de-identification gate in front of every AI call.
Handles accounts, credits and sync. It holds no key that could open your vault.

Zone 3

AI providers

Receive de-identified clinical text only, and only when you trigger an AI action.
Return drafts that wait for your review — nothing enters the record automatically.
EU-resident model routing is available for practices that require it.

The full encryption story — with diagrams and concrete examples — is on the Security page. How the encryption works

Medication intelligence

Mira

Medication Intelligence and Research Assistant

The name comes from her central purpose: bringing medication knowledge, research evidence and clinical decision support together in one structured intelligence system.

Mira is Psychiatry.Ink’s psychopharmacology knowledge and medication-governance layer. She combines established pharmacological knowledge, our structured medication database and selected external evidence sources to support clinically relevant information on indications, dosing, interactions, adverse effects, monitoring requirements and treatment strategies.

Audits the database: Compares monographs against structured claims and flags missing sections, inconsistent numbers and contradictions.
Watches the evidence: Monitors publications and regulatory sources — PubMed, Europe PMC and the FDA (openFDA) — for changes that affect the knowledge base.
Verifies independently: Every proposal passes a second, independent verification: citation support, numeric plausibility checks, country-specific rules.
Never publishes alone: Anything risk-relevant goes to clinician review. Mira drafts; people decide what ships.

Rather than functioning as a static drug database, Mira continuously organises, compares and contextualises medication knowledge. She identifies missing or conflicting information and assists in preparing evidence-based updates — while consequential clinical claims remain dependent on verifiable sources and professional validation.

Mira works exclusively on the medication knowledge base. She has no access to patient cases, case files or any patient identifier — that separation is enforced at the database level.

StatusIn operation — releases are clinician-approved

Deterministic clinical inference

Noevia

Networked Ontology for Evidence, Variability, Inference and Adaptation

The name is inspired by the Greek concept of noesis — the process of understanding, reasoning and forming meaning from knowledge.

Noevia is Psychiatry.Ink’s patient-specific intelligence layer: she transforms fragmented longitudinal clinical information into a structured, evolving representation of the individual patient — connecting symptoms, psychopathology, diagnoses, medication exposure, treatment response, risk, contextual factors and change over time.

Runs where the data is: Pure, deterministic code on the client. The patient evidence graph lives in encrypted device storage, inside the same zero-knowledge envelope as the vault.
The server ships rules, not data: Noevia downloads versioned, signed content packages — ontology, mapping rules, scoring rules. Patient data never travels the other way in readable form.
Every number shows its work: Every score is decomposable, recomputable offline and version-stamped — you can always ask why.
AI stays a candidate: Language models may propose candidates through the same guarded gate, but a candidate only becomes truth through deterministic rules or your acceptance.

Noevia identifies relevant patterns, contradictions and uncertainties — helping clinicians understand not only what has been documented, but how the available evidence fits together across the course of illness. She supports clinical reasoning; she does not replace it. Every conclusion remains traceable to the underlying documentation and subject to professional review.

StatusActive — advisory; the full clinical scope runs and every reading awaits your judgement

Clinical metadata extraction

CMEA

Clinical Metadata Extraction Agent

The name is simply what he does — extraction, not interpretation: he reads the documentation and hands structured facts to the systems that reason.

CMEA is Psychiatry.Ink’s structuring layer between documentation and intelligence: when chart sections change, he reads them once — de-identified, in a single batched pass — and turns them into flat, provenance-tagged clinical facts (medication, symptoms, lab values, dates) that downstream features reuse instead of re-reading the chart.

Computes once, reuses many: One extraction per change instead of every feature calling a model over the same text — fewer calls, lower cost, one consistent reading.
De-identified before extraction: The pass runs through the same guarded gateway as every AI call — identifiers are removed server-side before any model sees the text.
Deterministic first: Rule-based extraction runs first; a language model is consulted only where the rules fall short, and its output stays marked as a suggestion.
Provenance on every fact: Each extracted fact keeps the section and date it came from — every downstream use can be traced back to the original documentation.

CMEA asserts nothing clinically: he never makes a diagnosis, never writes to the record, and his facts remain candidates that features present with their source. He exists so that Butterfly, Noevia and the documentation tools can work from one verified extraction of the chart rather than each re-deriving their own.

StatusActive — deterministic extraction on every save; model enrichment through the guarded gateway

Mira curates the shared medication knowledge. Noevia reasons across the whole clinical picture of the individual patient — symptoms, course, treatment and context — drawing on Mira’s foundation wherever medication is involved. CMEA feeds them both: it distils the documentation into provenance-tagged facts once, so every downstream feature works from the same verified extraction.

See the encryption in detail

The Security page walks through the vault and the AI gate step by step — with diagrams and concrete examples.

How the encryption works Questions? Read the FAQ

An architecture that treats patient trust as a design constraint

Three commitments the code enforces