כל מה שמתוכנן

A clinician opens the product to find out what they are doing next, not to look at a chart. This is that screen: the patient in the chair now, the ones already seen, the ones still to come, and against each the work planned for today - from which the chart, the plan and the consent are one click away rather than the place a day starts. It is the doctor's half of what the front desk sees on the day board, filtered to them and ordered by the clock rather than by the room.

מתוך דרישה: P15, P14

אבן דרך M7

The handful of facts that change what a clinician may safely do: an allergy to penicillin, latex or an anaesthetic, a patient on anticoagulants, one who needs antibiotic cover before the appointment, a bisphosphonate history, a pregnancy, an implanted device. They belong in a band that is always on the screen while that patient is open, never behind a tab somebody might not open, and they are recorded with who said so and when - a nurse's note from four years ago and the patient's own answer on their intake form are different weights of evidence.

מתוך דרישה: P8, P15

אבן דרך M3

The act a clinician performs twenty times a day, and the moment four things fall out of one gesture: the planned work marked done and the chart updated with it, the note written from what was recorded rather than typed from memory, the next visit booked while the patient is still in the chair, and the treatment made billable so it reaches the desk before the patient does. Charting what happened and recording that it happened are the same event here, which is the only arrangement where the note and the mouth cannot disagree.

מתוך דרישה: P8, P14, P15

אבן דרך M4

Thirty-two teeth drawn from their real crown dimensions, each with its five surfaces individually chartable. Existing work, planned work, completed work, and a watch item all read differently without relying on colour alone, so the chart survives a greyscale print and a colour-blind reader. A finding a machine proposed is drawn as a proposal until a clinician accepts it, and it is never quietly overwritten.

מתוך דרישה: P8, X2, X1 · מה מגבה את זה: web/packages/odontogram, 117 tests

אבן דרך M3

A mark replaces your own earlier mark on the same surfaces, because that is a correction rather than a second lesion. A mark that only partly overlaps an earlier one narrows it instead of dropping it, so re-charting an occlusal cannot silently un-chart the mesial it was recorded with. An imported or machine-proposed mark is never touched by either. Undo is the whole chart stepping back, not an inverse operation that can drift.

מתוך דרישה: P8 · מה מגבה את זה: web/packages/odontogram/src/charting.ts

אבן דרך M3

A chart with 160 tabbable surfaces is correct and unusable: reaching the next control means pressing Tab 160 times. So the chart is a single tab stop with focus roving inside it. Left and Right walk the arch, Up and Down cross to the tooth that occludes with this one, Enter descends into the surfaces, Escape comes back up, and typing two digits jumps to that tooth. Every move announces the tooth’s whole state, not its number, so you can chart without looking up.

מתוך דרישה: X1, X2 · מה מגבה את זה: web/packages/odontogram/src/navigation.ts

אבן דרך M3

Two skins over one chart: the clinical one, dense and coded, and the patient one, which shows what is wrong and what is proposed without the notation. Because both come from the same resolved chart, the two cannot disagree - a patient is shown the plan the clinician is working from.

מתוך דרישה: P8, P17

אבן דרך M3

A chart that prints badly gets photographed instead, and then a phone holds clinical data. Printing is designed for: the patterns that distinguish states are shapes rather than colours, so a greyscale page still says which tooth is planned and which is done, and a tabular equivalent carries the same findings for anyone who cannot read the drawing.

מתוך דרישה: X2, E3

אבן דרך M3

You chart the mouth; the plan is already there, in shekels, VAT included, split into phases you can reorder. There is no transcription step between finding and plan, which is where the incumbents lose an afternoon a week and where a mistyped tooth number becomes a treatment on the wrong side of the mouth.

מתוך דרישה: P8

אבן דרך M4

The consultation tool the plan is for: phase one, phase two, phase three, each one redrawing the chart as it would look when that phase is done. It is the same chart and the same plan, so nothing shown to a patient was assembled separately for them.

מתוך דרישה: P8, X2

אבן דרך M4

Six sites per tooth, entered fast, and the comparison across exams is the point rather than a report: staging and grading derived from what was measured, and the change since last time visible without arithmetic.

מתוך דרישה: P8

אבן דרך M8

Upload, a viewer that surrounds the image in neutral mid-grey rather than in the theme, and a link from the image to the tooth and the procedure it belongs to. Diagnostic images are never theme-adjusted, because a dark-mode filter over a radiograph changes what a clinician sees.

מתוך דרישה: P7

אבן דרך M9

What was charted, what was done and what was planned already say most of what a note says. So the note starts from them rather than from an empty box, and remains free text you own - the derivation is a draft, never a claim about what happened.

מתוך דרישה: P8, P14

אבן דרך M4

A consent form is a version, rendered immutably and hashed, so what was signed can be reproduced exactly years later. The signature carries its evidence - when, on what device, in which language - and the consent is bound to the encounter, the procedures and the teeth it covers rather than filed loose in a folder.

מתוך דרישה: P6

אבן דרך M5

A day board that reflects the day rather than the booking - arrived, seated, in treatment, ready to pay - so the question "where is everybody" is answered by looking rather than by asking. Bookings are made against real availability, including the chair and the equipment, not against a doctor’s name alone.

מתוך דרישה: P9

אבן דרך M7

The screen a secretary works in with the phone against their ear: the week rather than the day, every chair beside each other, and the gaps drawn as plainly as the appointments so "what have I got on Thursday" is answered by looking. Moving an appointment is dragging it, and the reason it moved is kept, because a patient who has been moved twice is a fact the clinic should know before they ask. Availability is the real thing - the chair, the equipment and the clinician together - so the book cannot offer a slot the clinic cannot staff.

מתוך דרישה: P9, P14

אבן דרך M7

A new patient is fifteen minutes of the front desk's day, most of it typing what the patient already knows. So the form goes out with the appointment and comes back filled in: identity and contact, who pays, the medical history and the medications, the allergies, and the consents that are not clinical. What arrives is a record to check rather than a page to type, and what the clinic could not collect in advance is what the desk asks for - not everything, every time.

מתוך דרישה: P14, P12, P10

אבן דרך M7

Paper a clinic is asked for constantly and produces by hand: a certificate of attendance, a sick note, a referral to a specialist with the images attached, a confirmation of treatment for supplementary insurance. Each is generated from what is already recorded rather than retyped, is stored against the patient as a document with its date, and can be reproduced exactly, because the copy the patient lost is the one they will ask for.

מתוך דרישה: P14

בהיקף, טרם תוזמן

The front desk’s own worklist: unconfirmed appointments, recalls that came due, patients who asked to be phoned. It is a queue rather than a report because the work is finite and somebody has to finish it before going home.

מתוך דרישה: P9, P14

אבן דרך M7

A patient can belong to more than one household, because a child of separated parents does, and the person who pays is recorded rather than assumed. Every field that says who somebody is holds ciphertext in the database; a front desk finds a patient by identity number, phone or email through a blind index, and deliberately not by name or date of birth, because an index over those is a list of who your patients are.

מתוך דרישה: S2, S3, P12 · מה מגבה את זה: internal/core/patients, exercised by `clinic patients`

אבן דרך M2

Israeli names in Hebrew, Arabic, Russian and English, plausible ages, households and treatment histories, so a clinic can learn the product on data that behaves like theirs. Not one of them can be contacted by accident: the phone numbers sit under a country code that does not exist, the addresses are on a domain guaranteed never to resolve, their identity numbers fail the teudat zehut check digit on purpose, and the flag marking them synthetic cannot be turned off by any code path.

מתוך דרישה: P13 · מה מגבה את זה: internal/seed, exercised by `clinic sow`

אבן דרך M2

A reminder carries a secure link into our system where the patient confirms, reschedules or asks a question. The message body itself says nothing clinical, because a message body is read on a lock screen by whoever is holding the phone.

מתוך דרישה: P10, S2

אבן דרך M12

A secretary needs to know whether to walk into the room now, and today she finds out by walking into the room. So a message carries its urgency, and urgency is defined by what it does to the doctor’s screen: interrupt now, hold until this patient is finished, or wait for a moment. It goes both ways, the sender can see it was seen - otherwise she walks in anyway - and a message can carry the patient or appointment it is about, so answering does not begin with "which one".

מתוך דרישה: P21, P9

אבן דרך M7

One search across patients, appointments, plans and documents, where selecting a result takes you to the record rather than to a list about the record. Best-effort by design: a receptionist searching for half a surname under time pressure needs the likely answer first, not an exact-match failure.

מתוך דרישה: P12

אבן דרך M7

A quote is the plan priced at a moment, stored as its own document so what a patient was told can be reproduced later. It is not a second copy of the plan that drifts from it.

מתוך דרישה: P14

בהיקף, טרם תוזמן

Takings against treatments, what is unpaid, what was written off, and what did not get charged at all. The last one is the point: the money a clinic loses is mostly work that was done and never billed.

מתוך דרישה: P14

בהיקף, טרם תוזמן

Every charge, payment, discount and write-off is two entries, which is why the totals can be trusted and why a correction is an entry rather than an edit. The arithmetic is property-tested, because rounding and allocation are where every incumbent has known bugs.

מתוך דרישה: P14, E3

אבן דרך M10

VAT is computed and recorded per line, with allocation numbers where they are required, so an invoice is a document the clinic’s accountant recognises rather than a printout of a total.

מתוך דרישה: P14

אבן דרך M10

A plan paid over months is the ordinary case in Israeli private practice. The ledger models the schedule, what has been paid, what is due and what is late, and the arithmetic is tested the same way the rest of the ledger is.

מתוך דרישה: P14

אבן דרך M10

The moment a treatment becomes money: what is owed by the person in front of you, against which treatment, collected by whichever means this country actually uses - cash, card, Bit, transfer - split across a household where somebody else is paying, and receipted before they walk out. It is one gesture from the day board rather than a trip to an accounts screen, because the alternative is what every clinic already does, which is to say "settle it next time".

מתוך דרישה: P14, P9

אבן דרך M10

A receipt is issued for the amount received at the moment it is received, a tax invoice for what was charged, and each runs in its own consecutive series with no gaps - a gap is what an audit asks about. Nothing issued is ever edited: a correction is a further document that refers to the first, which is both the legal rule and the only version a patient can be handed twice. The copy a patient takes to their health fund is formatted for that purpose, because claiming it back is what they need it for.

מתוך דרישה: P14, R1

אבן דרך M10

One list the quote, the plan and the ledger all price from, so the same crown does not cost three things in three places. It is versioned rather than edited, because a plan quoted in March was quoted at March prices and reproducing that is the whole point of keeping the document. A clinic can hold more than one - a private list and a fund-negotiated list - and which applied is recorded on the charge rather than inferred later.

מתוך דרישה: P14

אבן דרך M10

Associates in private practice are usually paid on what they produced, or on what was collected against it, and the two numbers are not the same - work done in March and paid for in June belongs to different months depending on which question is being asked. Both are computed here, per clinician, per period, from the ledger rather than from a spreadsheet somebody maintains beside the product. A clinic that cannot run its payroll from the software is a clinic whose real numbers live somewhere else.

מתוך דרישה: P14

אבן דרך M10

The ledger has an external interface from the start, because a clinic that already has an accounting system is not going to abandon it. Claims submission and card payments are deliberately not in the first version: both are large, both are country-specific, and neither decides whether the product is good.

מתוך דרישה: D5

בהיקף, טרם תוזמן

Each clinic gets its own public site, in its own branding, in the languages it chooses, with self-booking against real availability, appointment acknowledgement and an ask-a-question form. It reads clinical data through a narrow public projection, so a mistake on the public site cannot reach a patient record even if the mistake is ours.

מתוך דרישה: P16, S3

אבן דרך M11

A patient signs in and sees their own appointments, plan, consents and documents - the same product, routed by identity rather than a separate portal that drifts from the clinic’s data.

מתוך דרישה: P17, P15

אבן דרך M11

The bill and the means to pay it in the same place, because a balance shown with nothing to do about it is a screen that causes a phone call rather than removing one. It settles against the same ledger the front desk collects into, issues the same receipt, and handles the instalment case that is ordinary here: pay the one that is due rather than the whole plan.

מתוך דרישה: P10, P16, P14

אבן דרך M11

Confirm, move against the availability the front desk sees, or cancel with a reason - and a cancellation that arrives at eight in the morning is a slot the clinic can still fill, which is the entire economics of this feature. A booking that only lets a patient *ask* to move is a message somebody has to read and a call back, which is the phone call it was supposed to replace.

מתוך דרישה: P10, P16

אבן דרך M11

What the clinic needs before it can treat somebody, asked for when the appointment is made and completed on the patient's own sofa: history, medications, allergies, who pays. It arrives as a record the front desk checks rather than types, and what changed since last time is shown as a change rather than as a fresh form nobody reads. Distinct from consent, which is signed in the chair, for a specific procedure, on specific teeth.

מתוך דרישה: P10, P14, P6

אבן דרך M11

What a patient sends arrives where clinical questions belong - against their record, in a queue somebody owns - rather than in an inbox nobody is accountable for. It is the same conversation the reminder link opens into, so a patient never has to say who they are, and the clinic can see what was asked and what was answered months later.

מתוך דרישה: P16, P21

אבן דרך M12

Availability comes from the same schedule the front desk works in, including the chair and the equipment, and the confirmation link is tokenised so nothing about a booking is reachable by guessing a url.

מתוך דרישה: P16, P10

אבן דרך M11

The screen the person who owns the clinic opens first, and it opens on the business rather than on its settings: what was collected yesterday against what was produced, this month running against last, how much of next week is actually booked, who owes us and for how long, and what each clinician produced. Not five reports - one screen, in the order the questions get asked, with the exceptions that need somebody today at the bottom of it. A clinic owner who cannot learn from the product whether the clinic made money is a clinic owner keeping the real numbers somewhere else.

מתוך דרישה: P15, P14

אבן דרך M10

The three questions a patient is entitled to ask, as a workflow the clinic can actually run: the access log for one patient in a form a person can read, an export of everything held about them, and an erasure request weighed against the retention the health regulations require - because a dental record cannot simply be deleted on request and the clinic needs to be able to say why, in writing, within the period the law allows. The clock starts when the request arrives and is visible, since missing it is the failure.

מתוך דרישה: P14, S5, R1

בהיקף, טרם תוזמן

Permissions are on actions and data classes, never on screens, so hiding a button is not a security model. A role may only carry permissions its author holds, nobody can escalate themselves, every deviation from a role records why and when it lapses, and no change can leave the clinic with nobody able to administer it.

מתוך דרישה: S4, P11 · מה מגבה את זה: internal/core/permissions and internal/core/authz

אבן דרך M1

A manager asking why a hygienist can see something gets the derivation: the role that grants it, the exception that added it, the revocation that took it away, the plan that caps it. The same shape as the settings chain, for the same reason - an answer you cannot audit is not an answer.

מתוך דרישה: S4, P11 · מה מגבה את זה: internal/core/authz, the effective-permission explainer

אבן דרך M1

The clinic key is a signed document that binds an installation to its clinic and its server, expires, ties itself to the device on first use, and can be revoked. A forged one cannot point a clinic at somebody else’s server. On top of it, an ordinary personal sign-in under current NIST guidance: fifteen characters, screened against known-breached lists and against this clinic’s own words, no forced rotation, and a wrong guess costs a delay rather than locking out a receptionist somebody could lock out on purpose.

מתוך דרישה: D3, S1 · מה מגבה את זה: internal/core/enrolment, identity, password, session

אבן דרך M1

A setting resolves through the chain - product default, country, clinic, location, role, person - and the effective value carries its provenance, so "why is it like this" has an answer rather than a search. A clinic works on day one without configuring anything, which is what makes the depth safe to have.

מתוך דרישה: X5, P3 · מה מגבה את זה: internal/core/settings, exercised by `clinic settings`

אבן דרך M0

Branding reaches the places a patient sees - the site, the documents, the reminders - rather than only the login screen, and it is configuration rather than a build.

מתוך דרישה: P5

בהיקף, טרם תוזמן

Per-person hours per location, with holidays, reserve duty and the day somebody leaves early. The schedule is only honest if the hours behind it are.

מתוך דרישה: P14, P9

בהיקף, טרם תוזמן

Duplicate patients happen at every front desk, so merging them is a first-class operation with a reversible record rather than a support ticket. Deletion goes to trash before it goes anywhere, and the actions a person can undo are the ones they can undo without asking us.

מתוך דרישה: P14

בהיקף, טרם תוזמן

Self-service export of every record and every setting, versioned so what you export from one release imports into a later one. The cost of leaving is what keeps clinics on software they dislike, and it will not be what keeps them on ours.

מתוך דרישה: S7

בהיקף, טרם תוזמן

Two separate things, and conflating them is the standard mistake. The interface is translated, completely, with the plural rules Hebrew and Russian actually use rather than the two forms English gets away with. What a user types - a name, an address, a note - is stored and shown in the language and direction it was written in, resolved per field, never translated by us.

מתוך דרישה: X4 · מה מגבה את זה: web/packages/i18n and internal/core/textdir

אבן דרך M0

A specialization pack contributes what makes a discipline different: its chart surfaces, code systems, forms, note templates, appointment types, recall rules and terminology. A country pack does the same on a different axis. A pack is data and cannot bypass permissions, the audit log, or the ledger’s arithmetic - which is what stops "configurable" from meaning "unpredictable".

מתוך דרישה: P1, P4

בהיקף, טרם תוזמן

Each clinic gets its own database, so a query that reaches across clinics cannot be written - there is no shared table to write it against. That is a stronger statement than a filter somebody has to remember, and it is the reason the answer to "could another clinic see this" is no rather than "not currently".

מתוך דרישה: S3 · מה מגבה את זה: internal/core/tenancy, on both Postgres and SQLite

אבן דרך M0

Every repository goes through one encryption layer, and each field declares what class of data it holds on the type itself - so a field added without saying is refused rather than stored in the clear. Each clinic has its own keys, and a key copied out of one clinic’s row is inert in another’s. The demonstration is part of the test suite: write a patient, dump the database file, and find no name in it.

מתוך דרישה: S2, S1 · מה מגבה את זה: internal/core/crypto, keys, classify

אבן דרך M0

The question a practice actually gets asked is who looked, not who changed. So reads are first-class entries, and the log is hash-chained: an edited entry, a deleted one or a reordered pair all fail verification. Our own emergency access is purpose-bound, time-limited, and written into the clinic’s own log where the clinic can see it.

מתוך דרישה: S5, S6 · מה מגבה את זה: internal/core/events, verified by `clinic audit`

אבן דרך M0

A trace attribute can be a number, a boolean, a duration or a name from a fixed list, and there is no way to put free text in one. That is what makes it safe to keep and to look at: it can tell us a screen is slow or a flow is abandoned, and it cannot tell us anything about a patient.

מתוך דרישה: S5, E4 · מה מגבה את זה: internal/core/events, the trace half

אבן דרך M0

The managed beta runs on one and a self-hosted clinic could run on the other, so every repository test runs against both engines - not a compatibility layer with a hopeful comment, but the same suite executed twice.

מתוך דרישה: S8, D1 · מה מגבה את זה: 919 Go tests, run on Postgres and SQLite

אבן דרך M0

A separate identity domain from every clinic, with mandatory two-factor, so an operator is never a row in a clinic’s user table. Clinical access from our side is break-glass rather than a feature: purpose-bound, time-limited, and recorded in the clinic’s own audit log. The provisioning underneath it works today; the screens are not built.

מתוך דרישה: P20, S6 · מה מגבה את זה: internal/core/operator and cmd/clinic

אבן דרך M6

A comment attaches to the part of the product it is about rather than to a mailbox, and it carries the build it was written against - a comment about a three-week-old build may already be answered, and without the commit nobody can tell. From there it has a lifecycle you can watch: received, being looked at, the decision and its reasoning, what was actually done, resolved, or declined with a reason we show rather than file. You can see every comment you left and where each one stands, which is the half that makes anybody write a second one. It is always reachable and never a pop-up, and the form asks that no patient details go into it, since a comment box is the one place in this system not built for clinical data.

מתוך דרישה: P22, E4

בהיקף, טרם תוזמן

A demo clinic is an ordinary clinic - same isolation, same keys, same code path - reached with credentials we issue you. Nothing about the product is world-reachable without them, which is why this site shows the product rather than being it.

מתוך דרישה: P19 · מה מגבה את זה: exercised by `clinic create`

אבן דרך M6

An entitlement is a ceiling: it caps what any permission in the clinic can reach, so a feature outside the plan is unreachable rather than merely unlisted. It is deliberately a different mechanism from build state and from permissions, because the three answer different questions and a single "unavailable" flag would blur all of them.

מתוך דרישה: P2

בהיקף, טרם תוזמן

A database per clinic means an upgrade is a fan-out, so it reports progress, says which clinics were skipped and why, and rolls back for real. Every migration is written for both engines and a test refuses one where the two disagree about the schema.

מתוך דרישה: E4, S8 · מה מגבה את זה: internal/core/tenancy/migrations, both dialects

אבן דרך M0

The beta runs on free infrastructure, which makes a rehearsed rebuild part of setting it up rather than a later task. Before a real clinic is on it: backups, a documented restore, and a restore performed from scratch to prove the documentation is true.

מתוך דרישה: D2, S1

אבן דרך M13