Three layers, each able to run without the one above it
A wristband keeps evaluating rules when the gateway is unreachable. The gateway keeps holding approvals when the orchestrator is unreachable. Nothing about the design assumes the network is there.
Sensor fabric
Firmware, signal processing and on-device inference: the part that lives on the body.
On the bodyEdge gateway
Fusion across devices, deterministic rule evaluation, and the queue where approvals wait.
In the roomOrchestrator
Durable workflows, the rule library, fleet management and the signed decision ledger.
In the cloudRule builder
Clinical leads and safety officers write rules here, then test them against recorded signal.
Build a ruleMobile app
The approval surface. Designed for a phone at arm's length, answered one-handed in four seconds.
See the appTechnology
What each layer is actually built on, and why those choices were made.
Read the stackEvery layer, end to end
Firmware
MICROCONTROLLER CLASSReal-time scheduling with a verified boot chain, so a device that cannot prove what it is running cannot influence a rule.
Edge
GATEWAYStreaming ingestion, deterministic rule evaluation, and an approval queue that survives a power cut.
Orchestration
SERVERDurable workflows survive restarts and partial failures. A run resumes rather than replays.
Explanation
MODEL LAYERTurns scores and signal features into the sentence at the top of an approval card, constrained to evidence present in the proposal.
Applications
WEB AND MOBILEOperations console, rule builder, fleet view and ledger. The approval surface is designed for a phone at arm's length, one-handed.
Identity
CROSS-CUTTINGWorkload identity everywhere, human identity at the gate, and a migration path for long-lived signatures.
Bounded evaluation
Rules compile to a directed acyclic graph. Evaluation is side-effect free, time-bounded and replayable against recorded signal.
Offline approvals count
Answers given during an outage are signed locally and reconciled when the link returns, never dropped, never replayed twice.
Time you can defend
Devices are time-disciplined against the gateway, so a fused event carries an ordering that stands up in an incident review.
Designed for DDIL conditions: degraded, disconnected, intermittent and limited bandwidth.
Deployment modelsStart with one ward, one shift, or one squad
A pilot runs four to sixteen weeks depending on deployment model. You bring the population and the responders. We bring devices, gateways and the first set of rules, and we measure override rate and time-to-answer from day one.