Four design decisions, and what each one costs.
Every architectural choice has a price. These are ours, and the price we pay for each.
Four design decisions, and what each one costs us
One record, resolved not merged
We match identity across organisations. Nobody’s record is copied or renumbered because their organisation changed. What it costs us: keeping those matches right is permanent engineering work, not a one-off move.
Configuration, not code
How the platform behaves in each country is read from a dated, controlled record. What it costs us: a country can’t go live until a named person has signed off its required settings, which is slower than shipping a default.
Fail safe, never borrow
An unconfigured value resolves to nothing not to a neighbour’s. The cost: more visible gaps. The alternative is a silent wrong answer.
State the ceiling in the product
Where a capability has a limit, the API and the interface say so. The cost: our own marketing is harder to write. The benefit is that it survives technical due diligence.
Three layers: what a thing is, where it comes from, and what the system will do
A framing borrowed from the ontology literature. We didn’t design to it — it just describes what we built, so here it is in those terms. Open a layer to see what sits in it.
1 Semantic — what a thing is
Before anything else the platform has to agree what a person, an organisation and a condition are. commvita uses published models instead of inventing its own: openEHR archetypes for structured clinical content, FHIR R4 as the canonical shape incoming data is translated into, SNOMED CT and dm+d for what was recorded, OMOP for research. Jurisdictional variance is modelled too — the regulator, the identifier scheme, the professional register, the legal deadlines — as dated, source-cited entries with a named signatory.
What it costs us: we can’t take a shortcut when a standard is awkward. A field that doesn’t map stays unmapped and visible.
2 Kinetic — where it comes from
A model that isn’t wired to real data is a diagram. Feeds arrive through monitored connectors, get translated to the canonical shape, and land against a person resolved by identity matching that carries a score on the match. The GP record is requested from the practice’s own system. Admissions and discharges arrive as event feeds. Where a record holds a reference and nobody can be matched to it, the screen says so instead of showing the key.
What it costs us: decision 01 above — keeping those matches right never stops being work.
3 Dynamic — what the system will and won’t do
Access is two separate things: what your role lets you do, and which organisations you can reach. A group grants reach only, never a role. Enforcement sits on the server, so a clinician outside the organisation a person is registered with gets a refusal with a reason, not a hidden menu. Approvals run as gates with a named authoriser, an SLA and an escalation. And where a jurisdiction has no value for something, the capability that depends on it switches off and says why.
What it costs us: decisions 02 and 03 above — the visible gaps, and the slower path to go-live.
Change a rule once and it changes behaviour everywhere the first layer says that concept appears, across every source the second has wired. One change in one place, instead of the same change repeated on every screen that touches it.
Some of the wiring above runs end to end today and some is a representative surface over seeded data. Each explainer says which, and so does the screen.
What that adds up to
The fourth aim is the one most platforms make worse.
A platform you can leave is a platform you can trust to stay.