Healthcare that speaks
your language.

01 · Identity & onboarding

Signing up is the patient's first clinical interaction — Medicup treats it like one.

Account activation runs on a one-time six-digit code and a single-use link sent from Medicup's own domain — never a third-party auth screen, and never a link that exposes internal project details. A password account cannot use the product until its mailbox is proven; a Google or device-vouched sign-in is treated as verified from the first session.

Once activated, a short setup flow captures exactly what the platform's AI and compliance logic need to operate correctly: the account's role — chosen from a catalog of 42 clinical professions drawn directly from FHIR, HL7, DICOM, HIPAA and GDPR terminology — the organization it belongs to, whether that organization's pharmacy is internal, external, or both, the country that determines which law applies, and a default language pre-selected from the device locale and confirmed by the user.

Every consent — to treatment, to data processing, to AI assistance, to research use — is captured as a timestamped, individually revocable event, not a single checkbox buried in a wall of legal text.

• 6-digit code + branded magic link, own domain, no third-party exposure
• 42 standards-derived professions, each pre-mapped to the correct access role
• Country and pharmacy model captured once, used everywhere downstream
• Consent recorded per purpose, per moment, individually revocable

02 · Roles & access control

The access a person holds in the software is the access their real role should have — nothing more.

Medicup's permission system is built from a catalog of sixty roles taken directly from the standards that define healthcare identity: FHIR's PractitionerRole vocabulary, the HL7 clinical-profession taxonomy, DICOM's imaging-service roles, HIPAA's administrative officer roles, and GDPR's data-protection roles. A superadmin console grants any of these per organization, with every grant and revocation permanently audited.

The rule that keeps this honest is HIPAA's 'minimum necessary' principle, enforced mechanically rather than by policy document. Compliance and IT roles hold zero clinical-data permissions. An ordinary doctor cannot browse the full patient roster of their organization — only search for the specific patient in front of them, an action that is itself logged. Full-roster visibility is reserved for oversight-tier roles only. A pharmacist can dispense a prescription but can never sign one; only a licensed prescriber can do that, and only after their own credential has been verified.

This alignment is not a one-time design decision — it is continuously verified. A suite of automated tests runs on every code change and fails the build outright if any future change would let a technical or compliance role acquire clinical-data access, or let a non-prescribing profession gain prescribing rights.

• 60 standards-based roles, grantable per organization, fully audited
• Compliance and IT roles carry zero PHI access by construction
• Full patient-roster access is oversight-only; other clinicians get targeted, audited search
• Alignment enforced by automated tests — a regression fails the build, not a chart review

03 · AI health intelligence

A medical AI layer that answers at 3 a.m., knows its limits, and hands off when it should.

Medicup AI is a retrieval-grounded medical advisor: its answers are checked against a curated knowledge base and passed through a safety critique before they reach the user, with emergency language triggering an explicit escalation path rather than a generic disclaimer. It replies in whichever language the user is writing in, drawn from a shared twenty-four-language set that spans the entire product.

Beyond conversation, the same AI layer powers five distinct clinical tools: photographing a meal returns calorie and macronutrient estimates cross-checked by a second, independent model; a fingertip held to the phone's camera produces a heart-rate and heart-rate-variability reading through real signal processing, not a guess; a structured symptom checker offers decision support with an explicit differential; overnight, the platform forecasts trends across a person's collected vitals and pushes an alert before a problem becomes urgent; and a photograph of a handwritten prescription is converted into a structured medication list.

Every one of these capabilities is degrade-safe by design: if a specific model is temporarily unavailable, the feature reports itself as warming up rather than failing outright, and the product never silently returns a wrong answer in place of no answer.

• Grounded advisor with safety critique and emergency escalation, in 24 languages
• Meal photo → calories & macros, cross-checked by a second model
• Camera-based heart rate & HRV — no extra hardware
• Nightly vitals forecasting with push alerts before problems escalate

04 · Prescriptions & pharmacy

From a doctor's spoken words to a labeled package on the pharmacy counter — one validated, auditable chain.

A prescriber can dictate an order by voice, in any of the platform's supported languages, using speech recognition that runs directly on the device — nothing is sent to a third-party transcription service. The AI structures the dictation into discrete clinical fields without inventing or altering a single value the clinician did not say, and suggests the exact medication from the organization's own stocked formulary first, falling back to the U.S. National Library of Medicine's public drug dictionary only when nothing in stock matches.

Before a draft can be created, it is checked against one of twenty-four country-specific regulatory profiles — validity windows, permitted refill counts, and controlled-substance handling rules calibrated to each jurisdiction's actual law. A violation blocks the draft outright, with the exact regulation cited, rather than surfacing as a downstream dispensing error.

Signing a prescription requires a fresh second authentication factor, producing a script that is immediately available as a scannable QR label. A pharmacist scans it, dispenses against tracked lot numbers with expiry-aware stock rotation, and records the counseling given — all of it audited, and each institution's declared pharmacy model (in-house, external partners, or both) shaping exactly how that dispense workflow routes. Every signed prescription is also available as a standards-compliant FHIR document, ready for direct submission to an insurer.

• On-device voice dictation in any language, AI-structured without inventing values
• 24 country regulatory profiles validated before a draft can exist
• Two-factor-gated signing, QR-labeled, lot-tracked dispensing
• Every prescription exports as an insurance-ready FHIR document

05 · The health record

The record belongs to the patient — they carry it, and they decide who else sees it.

Every patient's clinical history — records, laboratory results, imaging metadata, encounters, allergies, and the AI's own clinical notes — lives in a single encrypted timeline that spans every organization the patient has ever interacted with on the platform, rather than fragmenting across each clinic's separate system.

That record travels with the patient as a cryptographically signed identity QR code, verifiable even without a network connection. A clinician scans it to open exactly the right chart, register a returning patient, or begin a prescription — no manual lookup, no risk of opening the wrong record.

Sharing that record with a new provider is a decision the patient makes on their own phone: an access request is approved there, gated behind two-factor authentication, and can be revoked at any moment — with every access to the shared data logged. The same ownership extends to formal data rights: a complete FHIR export is one tap away, and a GDPR erasure request removes the clinical data itself while preserving only the legal record that consent was once given and later withdrawn.

• One encrypted timeline across every organization, not per-clinic silos
• Signed, offline-verifiable identity QR for instant, correct chart access
• Sharing approved on the patient's own phone, two-factor gated, revocable
• One-tap FHIR export; GDPR erasure that keeps only the consent trail

06 · Continuous monitoring

Care doesn't stop at the appointment — the record keeps filling itself in between.

Where traditional care only observes a patient's vitals during a scheduled visit, Medicup gathers them continuously from three independent sources: the phone's own camera for pulse measurement, standard Bluetooth medical devices such as blood-pressure cuffs, pulse oximeters and glucose meters, and — through Android's Health Connect — essentially any smartwatch on the market, regardless of manufacturer.

When the platform detects a genuine anomaly in that stream, it responds with a graduated, deliberately conservative escalation: first a private in-app nudge to the patient, then, only if that goes unanswered, a message to a designated family contact, and only as a last resort a route to confirmed local emergency services. At no point does the system place an automatic call on the patient's behalf.

A related, gentler capability recognizes the heart-rate signature of a panic attack and responds immediately with a private, guided breathing exercise inside the app — never an alert to family or emergency services for what is, medically, a different and non-life-threatening event.

• Three vitals sources: camera, Bluetooth medical devices, any smartwatch
• Graduated escalation — nudge, then family, then confirmed emergency, never automatic
• Panic-attack detection answered with private guided breathing
• Nightly forecasting surfaces trends before they become emergencies

07 · Support & reach

Every conversation is a tracked case, in the user's own language, on the channel they already use.

Support is AI-first: a dedicated model answers product questions directly, escalating to a human agent with a one-line summary of the issue already attached — so the person picking it up never has to ask the user to repeat themselves. A deterministic language guard checks every reply against the language the user actually wrote in and silently regenerates any reply that drifts, so a conversation in Persian stays in Persian from the first message to the last.

Every case a user opens is visible to them by status — open, waiting, active with an agent, or closed — with a full, readable transcript, on both web and the Android app. Support staff work from a dedicated desk, separate from general administration, gated by the same role-based access control as the rest of the platform.

The identical engine answers on WhatsApp: inbound messages are bridged into the same support pipeline, and a human agent's reply is automatically translated into whichever language the user's own messages are in before it is sent back.

• AI-first support with a deterministic language-consistency guard
• Visible ticket status and full transcripts, on web and Android
• A dedicated support desk, separately role-gated from general admin
• The same engine on WhatsApp, with automatic reply translation

08 · Security & infrastructure

Defense in depth is the starting posture, not an upgrade path.

No application server is ever directly reachable from the internet — every request passes through a hardened edge with strict transport security, and the servers that run the platform's AI models sit on a private network mesh, never exposed publicly. Both the web and Android clients cryptographically attest that they are genuine before the backend will fully trust their requests.

Personal health information is encrypted at the field level while at rest, every sensitive read or write is recorded in an append-only audit trail, and sessions can be revoked across every device a user is signed into with a single action. Regionally scoped administrators can only grant access within their own jurisdiction, never beyond it.

Disaster recovery is rehearsed, not theoretical: encrypted backups run nightly to off-site storage with point-in-time recovery, and the restore procedure has actually been executed and verified — not merely documented.

• No exposed origin servers; private mesh networking for AI infrastructure
• Cryptographic app attestation on web and Android before requests are trusted
• Field-level encryption for PHI; append-only audit trail on every sensitive action
• Nightly encrypted off-site backups with a tested, verified restore procedure

09 · Side by side

What changes, concretely.