Everything a founder needs before a renewal call, an escalation or a price conversation — health, money, contract clock and whatever is currently wrong, in that order.
What is currently wrong
Ranked by what costs us money or a customer, not by severity label
—
Who we talk to
The hospital's own administrators
These are the hospital's own staff — the people who signed the contract and who read the audit log we write into. No clinician, and certainly no patient, appears anywhere on this screen: under ADR #3 the control plane holds counts, versions, durations and rupees, and nothing that identifies a person receiving care.
✦Account briefDraft — awaiting approval
Drafting from this tenant's operational record…
Drafted from this tenant's own metering, ticket and infrastructure records · counts, versions and rupees only · no draft, note or record content was read to write this
What HQ can see about this hospital — and what it cannot
The isolation claim, stated on the screen that would leak it first
Versions — schema revision, AI worker version, build
Durations and percentages — p95, approve-as-is rate, edit distance
Rupees — subscription, token cost, contribution
The hospital's own administrators, who chose to be our contacts
Not obtainable from this screen at all
Any patient's name, ABHA number, MRN or phone
Any diagnosis, lab value, medication or note content
The text of a single AI draft, even a badly drifting one
The identities behind an incident's subject count
Reaching any of the right-hand list requires a break-glass grant with a written reason, an expiry, and a mirrored entry in this hospital's own audit log — see Access Log. That is the whole architecture of ADR #2 plus ADR #3, expressed as the difference between two lists.
Contract & plan
What they signed, what they pay for it, and whether the hospital has outgrown the tier it is on. A hospital past its plan's ceiling is a pricing conversation, not a support ticket.
How the monthly figure is built
Base tier plus contracted add-ons — the number in the fleet table is the sum of these
—
Capacity against the plan's ceiling
Tier ranges are the ones published on Plans & Pricing: Clinic up to 15 beds or OPD-only, Hospital 20–80 beds, Hospital Plus 60+ beds or multi-branch. Bed count is operational configuration — how many beds exist, not who is in them.
Plan-change history
Every tier and price move, with who asked for it
Effective
Change
MRR before
MRR after
Reason
Renewal mechanics
So a renewal is never a surprise on either side
Modules & entitlements
A workspace loads only where role permission and subscription entitlement both allow it (auth-and-access-design.md §2). This screen owns the second gate.
—
Every module, its state and what entitles it
Toggling a flag takes effect at each user's next login — the same function guards the API, so what a user sees and what they can call can never disagree
State
Module
Entitled by
Billed on this contract
Verdict
Flag
The State column is first on purpose. On a 390px phone the last column is the one that falls off the edge, and "is this module on" is the decisive value here — so it leads and the table scrolls inside its own container.
Not yet available at any price
Release-gated, not plan-gated — no tier unlocks these, so the switch refuses
Keeping these visible-but-locked rather than hidden is deliberate: the owner asks for Insurance & TPA on every call, and "R2" is a truthful answer that a blank space is not. The toggle is guarded in script as well as marked locked, so a devtools poke does not turn on a module whose API routes do not exist yet.
AI for this tenant
Which workers run here, on which version, and how good they are at this hospital — not the fleet average. Classifications per ADR #7 (CDSCO SaMD framework).
✦ Every percentage below is computed inside this hospital's own database, by scoring each AI draft against the version its clinician finally approved. What crosses into the control plane is one number per worker per day. HQ can therefore tell that a worker got worse here, and cannot read a single draft to find out why — that needs a break-glass grant with a reason, an expiry and an entry in this hospital's own audit log.
AI workers at this hospital
Version, entitlement and measured quality here — the switch is tenant-scoped and it will ask you why
ADR #7 classification
State
AI worker
Tier (ADR #7)
Version here
Approved as-is
Avg edits
Entitlement
Control
The RED rows are not a roadmap teaser. The toggle carries disabled and the handler refuses the change, so there is no path through this UI that turns on a Class C medical device. Each states the specific licence it waits on, because "coming later" is not an answer a hospital's compliance officer can act on.
This hospital against the fleet
The dark tick is the fleet figure; the bar is this hospital
Human control, evidenced
Enforced product-wide
ADR #7's mandatory controls for AMBER and RED are not per-tenant settings that a support engineer could relax for a demanding customer: a human stays decisive, every claim cites the records it came from, and the AI action and its human approver are permanently linked in the hospital's hash-chained log. There is no per-tenant switch on this page for any of the three, which is the point.
Usage & cost
Billing cycle 01–31 Jul 2026 · recorded actuals for this tenant only. Cost is shown against this hospital's own subscription, because the fleet average cannot tell you whether this price is right.
Token and speech cost by AI worker
Output tokens are priced about 5× input, so one verbose worker is a silent margin leak
—
Cost
Worker
Units
Input tok
Output tok
₹/unit
Share of this tenant's AI bill
Units are counts of work done, never the work itself: notes, bill drafts, generated replies, lab summaries, discharge summaries, speech minutes. The ₹/unit column is this tenant's own rate, so it drifts slightly from the fleet average as its mix of long and short work changes.
Unit economics that a price can be set from
What one unit of the product actually costs to deliver here
Other variable cost
The bill that arrives whether or not anyone uses the AI
A dedicated Postgres database costs ₹1,530/month whatever the plan. That is the standing bill for ADR #2's isolation-by-construction, it does not scale down, and it is the single reason a very small tenant is hard to make profitable. The alternative — putting small tenants on a shared schema — would trade away the isolation guarantee we sell on.
Contribution after variable cost
July 2026 · recorded actuals, not a projection
—
This tenant's share of the fleet
Reconciles against the fleet figures on Usage Metering
Line
This tenant
7 paying tenants
Its share
Fleet denominators are the recorded July figures: ₹2,31,000 MRR, ₹18,480 LLM + speech across the 7 paying tenants (8.0% of MRR), ₹1,92,670 contribution. A tenant whose cost share badly exceeds its revenue share is a tier problem, not a usage problem.
Infrastructure
This hospital has its own PostgreSQL database (ADR #2). Every figure below belongs to that database and to no other tenant.
The database
One hospital, one database — explainable in a sentence, which is the point
—
Schema & migration state
—
Backup, restore and recovery
Per-tenant backup is a benefit of ADR #2, not a chore of it — one hospital's restore never touches another's data
—
Storage and growth
What the database will cost in a year if nothing changes
API latency attributed to this tenant
The routes that matter to the people using it, with the fleet figure alongside
last 24h
p95 here
Endpoint
Req 24h
Fleet p95
Verdict
The AI inference route sits outside the platform p95 on purpose — folding a provider-bound 1.4s call into it would let a real regression on /opd/queue hide inside someone else's model latency, and that is the route a receptionist hits every twelve seconds with a queue of patients watching.
Billing history
Invoices, payments, dunning state and credits for this hospital. GST-compliant, and reconciled against the contract on Contract & Plan.
Invoices
Base is the contracted subscription; GST at 18% is shown separately so the MRR figure everywhere else stays comparable
—
Status
Invoice
Period
Base
GST 18%
Total
Settled
—
Dunning & credits
—
Non-payment: what suspension does and does not do
Policy
OffModule flags — staff sessions land on a "contact your owner" page
UntouchedEvery patient record, bill, prescription and audit entry stays exactly where it is
AvailableFull data export, on request, including while suspended
ContinuesNightly backup and 30-day point-in-time recovery keep running
ReversiblePayment clears → flags back on at next login, no re-implementation
A hospital that cannot pay us is still a hospital with patients in it. Withholding their records to force a payment would be a DPDP violation and an indecency, so the product cannot do it — suspension is a permission change, never a data action.
Support & incidents
What this hospital has raised, how fast we answered, and which platform incidents reached them. The headline number is minutes to first reply, not tickets closed — a backlog with a fast first reply keeps customers.
Tickets raised by this hospital
Sorted by SLA headroom, not by age
—
SLA
Ticket
Raised by
Issue
Sev
Age
1st reply
Class
Owner
"Raised by" is a role at the hospital — Owner, Billing clerk, Doctor — and the issue text is the operational complaint. A ticket that quoted a patient's record would put the control plane in breach of the isolation we sell, so tickets are written about the software, not about the patient it was used on.
Platform incidents that reached this hospital
Including the ones where they were one of twelve — they are told either way
Severity
Incident
What happened
Detected
Reach
State
—
Compliance status
NABH digital maturity is computed from this hospital's live configuration (ADR #8) rather than tracked in a spreadsheet, so their tier rises as the product ships and we can say so honestly.
NABH Digital Health maturity
—
ABDM & software certification
M1 / M2 / M3
ABDM certification is a compliance process, not an architecture change — the internal model is already FHIR R4 (ADR #6), so M1–M3 are sandbox testing and external gates. The ABDM Digital Health Incentive Scheme can subsidise the hospital's side of it.
DPDP obligations for this hospital
Digital Personal Data Protection Act 2023 · Rules 2025 — HOS is processor, the hospital is fiduciary, and the split matters
—
Status
Obligation
How it is met here
Whose duty
This hospital's own audit chain
Hash-chained and append-only, inside their database — not ours
—
The chain head is a hash and a block count — enough for HQ to verify the chain is intact and to prove nothing was removed, and not enough to read a single entry. Verification is a property of the hash, so it does not require access to the contents. That is the same reason a break-glass grant can be written into this chain by us and still be unforgeable by us.
Access log
Every break-glass grant into this hospital's database: who, when, the written reason, the expiry and what was actually touched. There is no other route to this tenant's data, and no way to make one from this screen.
⚠ Break-glass is exceptional, not routine. A grant needs a written reason, a linked support ticket and an expiry; it is hash-chained into the control-plane log and mirrored into this hospital's own audit log, where the owner reads it. Nothing here can be edited or removed afterwards, including by the founder.
Grants into this tenant
Last 90 days · newest first
—
Status
Grant
Ticket
Granted to
Written reason
Window
What was accessed
Owner visibility
—
Control-plane chain for this tenant
Every grant, revocation and module change we made here
Chain intact
Why this is the screen that proves it
1Exceptional. There is no browse button. The only entry point is a request that a human has to justify in writing.
2Reason-captured. The confirm button stays disabled until the reason is long enough to mean something, and the text is part of the hashed payload — so it cannot be edited later to look better.
3Time-boxed. A grant with no visible expiry is not time-boxed, it is just a grant. Every row carries its window, and grants close when the work closes rather than idling until they lapse.
4Owner-visible. Each grant is mirrored into this hospital's own audit log at grant time, not at review time. The owner can read what we did without asking us.
"We cannot read your patients' data behind your back" is a sales weapon, and it is true because the architecture enforces it rather than because we promise it. This table is where a hospital's owner, or their auditor, checks that claim — which is exactly why it has to live on the tenant's own screen and not only in a fleet-wide log they cannot see.