Clinical safety — how Clineso enforces it
Understand the clinical safety boundaries around Clineso workflows, human review, patient information, prescribing, and fulfilment.
This article explains the DB-enforced safety mechanisms that operate regardless of UI — relevant for practice owners, clinical leads, and any CQC/compliance review.
The core guarantee: prescribing is clinician-only
No one except a Clinician or Locum can issue a prescription. This is enforced at the database level with a SECURITY DEFINER RPC — not just in the UI. A manager, receptionist, or nurse cannot issue a prescription even with direct API access.
Role helpers enforced: is_clinician() · can_write_clinical().
Drug-interaction safety check
Every time a clinician opens a prescription case, the platform runs a point-of-care check covering:
| Type | How it works |
|---|---|
| Drug–allergy | Checks prescribed drug against the patient's recorded allergy list |
| Drug–condition | Checks for contraindicated conditions on the patient's problem list |
| Drug–drug | Checks for interactions between the new drug and all current medications |
Result levels:
- 🟢 Clear — no flags found. Safe to proceed.
- 🟡 Warn — flag detected but clinical judgement can override. Clinician must document reason.
- 🔴 Block — hard block. The interaction check records the override reason if the clinician proceeds.
All interaction check results are written to the audit log.
Immutable clinical records
Once a clinical note is signed, it cannot be edited or deleted. This is enforced by a database trigger. If a correction is needed, the clinician adds an addendum — the original remains unchanged.
Same applies to:
- Prescriptions (append-only)
- CD register entries (append-only ledger, UPDATE/DELETE blocked)
- Audit log (append-only)
- Consent records (version + IP + wording snapshot, immutable)
Tenant isolation
Every piece of patient data is tenant-scoped. RLS (Row Level Security) policies on every PHI table prevent any cross-clinic data access — not just at the app layer, but in the database itself.
The platform admin runs a regular audit_*_posture() RLS regression to verify no policy has drifted.
Data residency
All data is stored in Supabase West Europe (London) — UK/EEA residency. No patient data is sent outside the EEA without explicit consent and DPA registration.
What this means for CQC / ICO
- Prescribing authority is technically enforced, not policy-only.
- Full audit trail of every clinical decision, role grant, and data access.
- Append-only records satisfy the requirement for tamper-evident clinical documentation.
- Patient consent captured with IP address + timestamp + wording version.
- GDPR export and erasure available on request (patient or clinic).
For a full technical audit, see the BACKEND_ARCHITECTURE_AUDIT_2026-06-02.md in the project docs.