Clinical operations AI · Hong Kong

Treat patients, not messages.

Your nurse spends the morning replying to messages. You spend the evening on paperwork. We build the systems that give those hours back.

What we build Talk to us

24/7: Someone always replies
30s: Before the patient gives up waiting
Seconds: To find a consent signed three years ago

The waiting room is full. So is the phone.

Your receptionist is answering the same question for the fortieth time today, while three patients wait at the desk.

01What we build

Two systems

For the two jobs that eat the most time and carry the most risk.

A clinic receptionist holding a phone at a tidy front desk

01What we build

Appointments and enquiries

Your staff stop spending the day inside the phone.

No thirty unread messages waiting on Monday morning
No two patients booked into the same slot
Medical questions reach you — the system never answers them

Build: 13 weeks
First reply: Under 30s

One request, end to endInterface illustration

A single appointment request as it moves between groups. Dashed blocks are the language model. Solid black blocks are deterministic logic — and only those create the appointment.

Patient-facing group · Internal clinical groupCS-2481

Patient-facing group

Reception10:41

Mr Chan wants to see Dr Lee Tuesday afternoon, follow-up, 9123 4567

Language modelClassify and extract

Type: Appointment request
Date: Tue 25 Aug
Time: Afternoon
Doctor: Dr Lee
Reason: Follow-up
Phone: 9123 4567

Deterministic logic

Availability check

Tuesday afternoon falls outside Dr Lee's registered consulting hours. The model is not consulted in this determination, and would have no authority if it were.

No appointment created

Agent → Internal clinical group

Dr Lee — a follow-up request for Tuesday 25 August, afternoon. That slot is outside your registered consulting hours. Can it be arranged?

Internal clinical group

Dr Lee11:20

Can't do Tuesday, I've got a meeting. Thursday after 3:30 works.

Language modelRead the reply as a position

Tuesday: Unavailable
Thursday: From 15:30

Where a reply cannot be resolved, the agent asks again. Asking again is not counted as an error.

Deterministic logic

Create appointment

Thursday 27 August 15:45 falls inside the hours the doctor has just given, and is not occupied by another appointment.

Appointment created

Agent → Both groups

Booked — Mr Chan with Dr Lee, Thursday 27 August, 15:45, follow-up.

The model read the request and understood the doctor's reply. It did not decide the appointment.

The hard part, stated plainly

The official messaging business platform cannot join a group that already exists — it caps group members, and the group must have been created by the business account itself. That is documented by the platform vendor and you can verify it. So a deployment that leaves your staff's habits untouched has to run through a paired-device connector, which sits outside the platform's terms of service and is a single point of failure. We tell you this up front rather than discovering it with you later, and we mitigate it three ways: a dedicated practice number so a restriction costs you a channel and never anyone's personal messages; the full record held in storage you control, so losing the channel does not lose the records; and a rehearsed manual fallback.

What it does

Classifies each message as general enquiry, appointment request, medical question, or requiring no reply
Extracts date, time, doctor, reason and notes field by field, and asks again rather than guessing
Threads related messages into one case readable end to end across every group
Routes medical questions to the doctor and relays only the doctor's own answer
Answers factual enquiries from a knowledge base you maintain, or hands over
Captures images, PDFs, voice notes and stickers, retrievable from the dashboard
Sends scheduled next-day appointment notifications, and re-sends if anything changes
Read-only calendar subscription — no appointment can be created from a subscribed device

Performance

Item	Standard
Appointment logic — occupied slots, consulting hours, doctor's explicit agreement	100%
Message classification	≥ 95%
Field extraction, counted field by field	≥ 98%
First response, with no message exceeding 90 seconds	95% ≤ 30s
Unsupported factual answers	0
AI-generated clinical content	0
Content leaking out of the internal clinical group	0
Agent replying after a human took over the case	0
Attachment capture and retrieval	≥ 99%
Duplicate reply, appointment or case from a replayed message	0
Write to the schedule without the administrator password	0
A case read end to end across every group	≤ 30s

A patient signing on a tablet with a stylus at a consultation desk

02What we build

Consent and records

A complaint arrives three years later. You can still produce the consent.

The exact wording the patient signed, printed on the page
Any past document found in seconds, not in a filing cabinet
A signed record cannot be edited, and cannot be deleted

Build: 18 weeks
Signs unaided: 90%

Signing, in four screensInterface illustration

Explanation and signing are two separate modes, because a doctor needs to draw on the document while explaining, and none of that drawing may end up in the patient's file.

/0.1Explanation mode

Treatment consent

UndoClear allStart signing

Free annotation over the document. Held in the tablet's memory only — never written to disk, never transmitted.

/0.2Clear confirmation

Treatment consent

Annotation will be cleared

Everything drawn during the explanation will be removed and cannot be recovered.

BackClear and sign

The annotation is cleared and unloaded within 300 milliseconds. After this point only the signature field accepts input.

/0.3Patient signature

Treatment consent

Sign here

Signed at27 Aug 2026 · 15:52

System generated · cannot be edited

ClearConfirm signature

Stroke path only — no pen pressure, no speed, no raw biometric data is kept. Once confirmed, the signature is sealed into the document.

/0.4Doctor countersign

Not signed on the day

Mr ChanTreatment consent15:52
Ms WongRecording consent11:20
Mr LamTreatment consentEscalated

Signature date27 / 08 / 2026

Sign

The doctor signs with the patient, in the same consultation. If a document is not countersigned there and then, it is flagged immediately — this queue should be empty.

Printed on every page

Document: Treatment consent
Wording version: Version 2.1
Signed: 27 Aug 2026 · 15:52
Tamper seal: Any later change is detectable

The hard part, stated plainly

Two design choices here look like restrictions and are actually the point. First, there is no delete function for a signed document — not permission-gated, absent. Revoking a document means voiding it: a new version marked void, with the original, its signature, its hash and its audit trail intact. A consent record that can be edited has no value in the dispute it exists for. Second, we do not retain pen pressure, stroke speed or any other raw biometric from the signature. That data is sensitive personal data with limited evidential value, so keeping it adds more risk than it buys. The evidence that carries weight is not the biometric but the seal on the document: if a single character of it changes afterwards, that is detectable.

What it does

Generates documents from templates that freeze on first use, with the version number printed on every page
Separates an explanation mode for annotating during consultation from a signing mode
Seals the signature into the document so that any later change to it can be detected (SHA-256)
Holds signed documents in write-once storage with no delete function anywhere in the system
Expects doctor and patient to sign in the same consultation, and flags immediately anything left uncountersigned
Gates consultation recording behind the patient's written consent, sealed together with that consent
Accepts scans and phone photos of paper originals, with OCR-assisted matching and mandatory human review
Mirrors a read-only patient index — identifiers only, never diagnosis, medication or billing

Performance

Item	Standard
Template version frozen on first use, printed on every page	100%
Annotation written to disk or transmitted over the network	0
Annotation cleared on entering signing mode	≤ 300ms
Untrained patient completes a signature with no staff assistance	≥ 90%
Average time for that patient to complete it	≤ 90s
Steps from opening the document to signing it	≤ 4
Text contrast, to WCAG 2.1 AA	≥ 4.5:1
Raw biometric signature data retained	0
Audit log entries that can be edited or deleted	0
Delete function for a signed document	0
Recording started without prior written consent	0
Migration reconciliation — source records equal loaded plus failed plus pending	100%

A practice eventually has to explain its systems to someone — a regulator, a professional body, an insurer, a patient's lawyer. You are the data user and we are the data processor, and we build on the assumption that day arrives.

Principle	How the system is built
Purpose and means of collection	Only the fields the workflow cannot run without. A patient index mirrors identifiers alone and never touches diagnosis, medication or billing. Recording cannot begin before that patient's written consent exists in the system.
Accuracy and retention	The index reconciles against your master record on a schedule, and discrepancies raise a notification rather than passing silently. Signed documents and sealed recordings are immutable — corrections are new versions, never overwrites.
Use of personal data	Used only for the purpose scoped. Not for marketing, not transferred to a third party, and not used to train any model. That last point is in the contract, not just the sales conversation.
Security	AES-256 at rest and TLS 1.3 or above in transit. Roles are separated, write authority expires with the session, and the document and recording stores are write-once. Every view, download, print and playback is logged.
Openness of policies	We build the template format and the mechanism. The wording of every consent, notice and privacy statement is settled by you or your lawyers — we do not write, translate or review it, and no part of our fee is attributable to producing it.
Access and correction	Retrieval of everything held on one patient, in a form that answers a data access request. Correction of a sealed item is handled as a new version so the original stays intact and the change stays visible.

A doctor and an engineer working together at a bright table

02How we work

Four steps

We sit in your clinic for a day

Watching a real day, not presenting slides.

We say what it does and what it costs

In writing, at a fixed price, before any work starts.

You try it before it counts

On your own real cases, not a demo we picked. If it does not fit, we change it.

You can still reach us afterwards

Training, documentation, and one person who answers the phone.

Patients ask in Cantonese. So does the system.

Records stay in storage you control, under the PDPO, and are never used to train anyone's model.

03Why us

Four reasons

A practising doctor is on the team

Seran practises in Hong Kong. He says plainly when an idea would not survive a real clinic day.

A fixed price, agreed first

What you get and what it costs are settled before we start. No surprises later.

Clinical decisions stay yours

The AI reads and sorts. Anything that affects a patient is decided by fixed logic, or by you.

We only do medical

Not retail, not logistics. Other sectors belong to other companies in our group.

A doctor and patient in conversation in a bright Hong Kong consultation room

04About

Who is building this

HARVIS builds AI systems for medical practices in Hong Kong, and nothing else. We pair people who ship systems with a practising doctor — because the failure mode of clinical AI is almost never the model, it is a team that has never sat in the room where the work happens.

Adam Au

Co-founder

Builds and delivers enterprise AI systems, and holds the engineering core. Leads diagnosis, scope and solution design.

Dr. Seran Hui

Co-founder

Medical doctor, HKU Faculty of Medicine 2017, trained in radiology. Brings the clinical operating reality — what a busy practice can actually adopt, and where an automated system would be unsafe or unwelcome.

05Contact

Tell us where your day goes

We have not put a general enquiry line on this site, because there are two of us and neither of us wants your first message answered by a form. Speak to whichever of us is closer to your question — or simply reply to whoever sent you this link.

Seran

Dr. Seran Hui · Co-founder

Clinical questions — whether this fits how your practice actually works, and where an automated system would be unsafe or unwelcome.

Adam

Adam Au · Co-founder

The build — what the system will do, how long it takes, and what it costs.