For clinics, groups and organisations
Your own instance. Your servers, your data, your upgrade schedule.
A full ERP, CRM and EHR in one database, on infrastructure you choose — plus custom development that turns your own way of working into part of the product, and leaves you owning it. Built on open-source Odoo Community, so there is no licence fee and no charge per user, ever.
What you are actually buying
An EHR is one of ten areas. The ERP and the CRM are the other nine — and then there is the part that is not a product at all
A record system keeps the clinical record. It does not run the rota, pay the practitioners, chase the referrer, raise the invoice, or report on any of it. So a clinic buys a record system, then buys four more things, then pays somebody to keep the five in agreement. This is one system, on one database, and it arrives as all three.
ERP
The business that runs the care
Odoo 19 Community underneath, with no licence fee and no per-user charge.
- Rota, rooms and resources
- Orders, invoicing, payments and accounting
- Practitioner pay on four formulas, with contract version timelines
- Payout runs that write real supplier bills
- HR, time off, expenses, procurement and inventory
- Governance, training and workforce designations
CRM
Everything before somebody is a patient
The half of the funnel a record system has no model for.
- Referrer and partner register
- Enquiry capture with a clock on it
- Website, content, campaigns and newsletters
- Events, courses and certificates
- Attribution from first click to admitted patient
- Booking funnel analytics — views, starts, drop-offs
EHR
The clinical record, in full
Encrypted per document and per field, with the keys held separately.
- Episodes from admission to discharge
- Versioned treatment plans with nested goals
- Template-driven notes with typed answers
- Scored instruments charted over the episode
- E-signature bound to the record it belongs to
- Seven compliance packs, installed per market
+
Custom development — the thing on your paper, built into the product and owned by you
Every clinic has a way of working that no product has a page for. A triage rule nobody else uses. A report the board asks for in a shape no vendor ships. A funding stream with its own arithmetic. On a fixed product, that is a feature request. Here it is a module.
You get the source. The module sits in your repository, on your server, under your upgrade schedule. If we stopped trading tomorrow, it would still run.
- You describe it the way you actually do it — on paper, in a meeting, in the spreadsheet you have been using instead.
- We build it as a module on the platform, against the same models the rest of the product uses. It is not a bolt-on beside your data; it is part of it.
- It ships with your instance, and it is in the inventory with everything else — tested, versioned, and visible under Apps like any other module.
- You own it. Keep it private, or hand it to the next supplier. Neither needs our permission.
How unusual that is, stated carefully. Our own feature comparison puts this platform against seventeen others — ten in the United States, seven in Europe. On the row custom development on the product, owned by the clinic, exactly one of those seventeen also has it: OpenEMR, which is self-hosted open source. The same is true of full source access. For the other sixteen, the product is the product: you file a request and you wait your turn behind everyone else who filed one.
That is the whole claim, and it is the shape of the claim we are willing to make. We are not telling you our competitors are bad software — several are very good at the part they do. We are telling you what happens the first time you need something they have not decided to build.
Source:docs/marketing/08-COMBINED-FEATURE-MATRIX.md §6, rows O5 and
O10, across the eighteen-platform table. Marks are read conservatively: a partial or
higher-tier-only implementation counts in a competitor's favour.
Why an organisation does this
Four arguments, each one a mechanism and its consequence
The mechanism is what the system actually does. The consequence is the part you can check against your own week. No percentage appears on this page — we have none that are sourced, and §Work out your own case gives you the arithmetic instead.
Efficiency — the work that stops existing
Most clinics run four systems: a booking tool, a clinical record, an accounting package and a marketing list. The cost is not the four subscriptions. It is the people who carry data between them, and the disagreements when they miss something.
- One database carries the clinical record, the schedule and the invoice — the invoice and the booking are the same data, so nobody reconciles them
- Reports are built from the data you already enter — the reporting round stops being an assembly job from four exports
- Payout runs produce real supplier bills in the accounts — no spreadsheet handed to the bank, and no re-keying of it
- Roles are configuration — adding reception, supervision, quality or a case worker is a permission, not a project
- A new brand or a second site is a configuration choice, not a new project
Revenue — money that is already yours
None of this is new business. It is revenue your current process loses on the way through.
- Cancellation policy with tiered penalties, applied automatically — late cancellations and no-shows currently written off because nobody chased them
- “Not yet booked” — sessions bought but unscheduled, shown as a list. The single most overlooked number in a clinic
- Recalls — repeat episodes that currently depend on somebody remembering
- Enquiry capture with a clock on it — enquiries that die in a shared inbox over a weekend
- Attribution from first click to admitted patient — which channel produces patients, not clicks, so spend moves to what works
- Four figures that always agree — sessions bought, going to earn, earned, not yet booked
Performance — knowing, fairly
The platform answers a question most reporting products do not: is the record true? — not only how are we doing?
- Alignment reports — where the record and what happened disagree. An empty report is the good outcome
- Six fairness rules enforced by the system — rates hidden below a minimum sample; what a person controls separated from what they do not; every figure one click from the sessions behind it; no league table on a person’s own page
- Outcome measurement at admission and discharge — evidence that treatment works, in a form you can put in front of a payer, a regulator or a board
- Occupancy and capacity — whether the constraint is rooms, hours or demand, which is a different decision each time
- A professional sees only themselves — enforced by permission, never by a pre-set filter
Satisfaction — what the patient notices
- Booking against real availability — they book, and it is booked. No call-back, no telephone tag
- Their own portal — their documents, their plan, their goals, their progress
- Monitoring between sessions — care continues instead of pausing for three weeks
- Secure messaging with their clinician — a question answered without an appointment
- One record — they are not asked the same question by three different people
What is in the instance
Ten areas. Every one of them ships, and is tested.
This is not a roadmap. The module-by-module inventory is generated from the code itself, so the figures below are counted rather than claimed.
- Clinical record
- Episodes from admission to discharge · versioned treatment plans with nested goals and a review history · template-driven session notes with typed answers · scored instruments charted over the episode · goals and between-session monitoring · group session notes filed per attendee · intake questionnaires · recalls · ICD-10-CM coding
- Documents
- Encryption per document and per field · keys held separately · disposal by destroying the key · an access log no administrator can edit · retention configurable per document type · a client document portal
- Scheduling
- Availability rules and exceptions · rooms and resources · clinician calendars · team and room views · online booking against real availability · time zones
- Sessions and money
- Session credits and packages · tiered cancellation policy · memberships · offline payment · orders and invoicing · practitioner pay with four formulas and contract version timelines · payout runs that write real supplier bills
- CRM and acquisition
- Referrer and partner register · enquiry capture with a clock on it · website and content · campaigns and newsletters · events, courses and certificates · attribution from first click to admitted patient
- Reporting
- Alignment reports · performance reports under six fairness rules · occupancy and capacity · finance dashboards · team dashboards · care reports · a daily health digest
- Governance
- Risk assessments · activity review · workforce designations, sanctions and access termination · training records · contingency plans · a compliance health check that reports only what is wrong
- Communication
- Secure chat inside the record · metered chat consultation · video sessions · push, email and SMS notification
- E-signature
- Consent and agreements signed and bound to the record they belong to, with the signed copy kept where you can produce it years later
- Compliance packs
- GDPR/EU · UK · US (HIPAA) · Germany · Norway · Finland · Switzerland — installed per market as needed, not carried by everybody
Who uses it
Eight kinds of person, and a ninth you define
A role is configuration. Supervision, a county case worker, an external partner — each is added and permitted, not built.
Role, module access, and a record rule enforced in the data layer rather than on the screen — so the rule holds through an export and through a report, which is where most products leak.
Getting ahead
Four moves your competitors cannot easily make
Not because they are worse at running a clinic. Because their licence, their vendor or their data model will not let them.
Open the system wide
without a budget conversation
Give reception, supervision, quality, a referrer or a county case worker their own access. There is no per-user licence, so the question is whether they should have it — not what it costs.
Prove outcomes
to a payer, in their language
Scored instruments at admission, during treatment and at discharge, charted, tied to the episode and the plan that produced them. When a commissioner, an insurer or a board asks what your treatment achieves, you answer from the record.
Launch a second brand
as configuration, not a project
A new service line, a new site or a whole second brand is a configuration choice. Same database, same reporting, separate public face — and one set of numbers at the end of the month.
Change vendor
including changing us
The foundation is open source and the database is yours. You can take it, host it elsewhere, or have somebody else maintain it — and we know that when we quote you.
That software makes you compliant. That anything is unhackable. That our staff could never read your documents under any circumstance. Those are all false, and a supplier who says them to you is telling you something about their other claims.
Work out your own case
We will not hand you a return figure, because we would be inventing it
Here is the arithmetic instead. Every input is a number you already have or can get in an afternoon.
| Line | What to measure | The calculation |
|---|---|---|
| A · Reconciliation time | Hours a month your team spends moving data between systems, reconciling them, or assembling reports | hours × loaded hourly cost × 12 |
| B · Late cancellations and no-shows | How many a month, and what you recover today | (sessions × average value) − what you recover |
| C · Prepaid and unscheduled | Sessions bought but never booked, over the last year | count × average value |
| D · Lost enquiries | Enquiries received against enquiries converted — the gap nobody followed up | gap × conversion rate × average episode value |
| E · Licence fees | What you pay now, per user per month, across all four systems | current annual spend |
| F · The cost | Implementation, and the annual fee | the calculator |
A + B + C + D + E against F, over three years. If that does not clear your hurdle, do not buy it — and tell us which line was weakest, because that is more useful to us than a signature.
Two honest cautions. Line A rarely goes to zero; it goes down. Line D depends on your follow-up actually happening once the system shows you the gap — the platform surfaces it, your team closes it.
Two ways to have it
Run it yourself, or let us run it
Both are your own instance and your own database. The difference is who holds the servers — and you can move between them later, because that is a database and a file store moving, not a rebuild.
| Self-hosted | Hosted by us | |
|---|---|---|
| Where it runs | Your datacentre or your cloud account | Our infrastructure |
| Who holds the data | You | We do, as your processor, under contract |
| Who patches the servers | You, or us under a management agreement | Us |
| Upgrade timing | Entirely yours | Agreed window |
| Isolated-network option | Yes — the full isolated architecture | Partly; the internal zone is ours, not your LAN |
| Suits | An IT function, a security policy that requires it, or a legal duty that makes it simpler | Wanting the capability without running servers |
| Cost shape | Lower recurring; you carry the infrastructure | Higher recurring; nothing to run |
Where your data sits
One database, and an isolated option where the duty is heavier
The standard deployment is a straightforward one: application, database and file store behind TLS, with roles and record rules doing the access work.
Where the duty is heavier we offer an architecture in which the clinical record has no route from the internet at all. An internet-facing gateway serves patients and referrers and holds an identifier and a password and nothing else; it reaches the internal system only through a fixed list of named operations from one address; the encryption keys sit on a third host in a separate trust domain.
What that buys, precisely: somebody who takes the entire internet-facing tier holds a set of opaque identifiers and password hashes with nothing to join them to.
Security, and one honest limit
- Encryption per document and per field — you choose what
- Key custody off the application host, with an unwrap quota and a log that host cannot rewrite
- Access log on every read and write. Being an administrator grants nothing by itself
- Break-glass — time-boxed, needs a written reason, raises an alert
- Automatic logoff after inactivity, enforced on the server
- Disposal by destroying the key
- HIPAA, GDPR and UK packs — the obligation is yours; what we carry is your copy of it
The honest limit: no key-custody design defends against an attacker resident in the application process waiting for legitimate reads. A legitimate open unwraps a key into the process. What the design buys is rate-limited access with a witness — not prevention.
Getting live
Eight phases, and the two things that decide how long
Duration depends on two things only: how much configuration your clinical model needs, and how much data has to move. A straightforward deployment runs in weeks; one replacing an established clinical record system runs longer, and we will not quote it before seeing that system.
Price it on the modules you actually switch on
Four questions and a list of modules. A one-off build figure and an annual support figure, itemised, with nothing hidden behind “contact us”.