Galen
A patient-owned health record — the patient grants and revokes role-scoped access to clinicians and caregivers, and a photo of a paper chart is turned into a structured draft note by Claude vision for a human to review.
- Patient-held code
- the chart won't open without it
- Draft until reviewed
- AI-extracted notes are never automatic
- Schedules only
- agencies never see the clinical record
The problem
A patient juggling several caregivers and clinicians usually has their chart locked inside one clinic's system, with everyone else working from memory, texts, or a paper folder that travels badly. Galen, part of the Docuity suite, makes the patient the one who owns the record and decides who can see it.
What it does
Every chart belongs to a patient, not a clinic. A caregiver or doctor gets in only with the patient's own access code, kept separate from their login, and the patient can grant full write access, access limited to logging a caregiver's own visits, or read-only viewing — not just one all-or-nothing key — and cut off any of them at any time.
A photo of a paper chart or a monitor becomes a structured draft note in seconds, using Claude's image reading, but it stays a draft, out of the real timeline, until a person reviews and publishes it. Longer stretches of notes also get an AI-written daily recap and trend view, clearly marked as AI-authored, so a caregiver catching up doesn't have to read everything from the start.
Caregivers check in and out of a visit and can't leave without a short handoff note for whoever's next, and anyone can raise an alert that stays pinned above the timeline until someone marks it handled. A home-care agency can staff its schedule around a patient without ever seeing the clinical record itself. When it's time to hand the chart to an outside doctor or hospital, it exports as a proper clinical PDF report or as spreadsheets of medications and vitals — not a screenshot of an app.
Key features
Only the patient's code opens the chart
Knowing who a patient is isn't enough to see their record — a caregiver or clinician needs the access code the patient controls, kept separate from any login.
Exactly the right level of access, per person
Grant one caregiver full write access, another just enough to log their own visits, and a family member read-only — not one all-or-nothing key for anyone let in.
A photo becomes a draft note, never live until reviewed
A snapshot of a paper chart turns into a structured note in seconds, saving retyping, but it stays out of the real record until a person checks and publishes it.
AI recaps so you're not starting from zero
A stretch of notes gets an AI-written daily summary and trend view, clearly marked as AI-authored, so catching up on a patient takes minutes instead of reading every entry.
No visit ends without a handoff note
A caregiver checking out of a shift has to leave a short note for whoever's next, so continuity of care doesn't depend on a phone call.
Agencies staff the schedule, never the chart
A home-care agency can plan who's covering which shift without ever seeing a word of the clinical record — each caregiver still needs the patient's own approval to read notes.
Where it stands
One Docuity account currently holds one Galen role at a time — patient or caregiver, not both. Like the rest of the suite, no HIPAA-certification, SOC 2, or Business-Associate-Agreement claim; anything sent to Claude for Galen's AI features is not used to train models.
Under the hood — for the technically-minded
How it's built
The code is deliberately split into pure logic — who's allowed to do what, how an access code works, how a note is structured — and the parts that touch the outside world: the database, the AI calls, the credential ceremonies. Keeping them apart means the rules about access and safety can be tested on their own, without a database in the loop.
Login is handled by Docuity ID like the rest of the suite, but a chart's access code is a second, separate gate scoped to just that one patient — so being signed in proves who someone is, and the code proves this specific patient actually let them in. The two checks are deliberately never merged into one.
AI does two different jobs, kept apart on purpose: a faster pass turns an uploaded photo into a structured draft, and a stronger pass is held in reserve for the more involved work — daily recaps and multi-note trend reports — so the everyday case stays quick without under-powering the deeper synthesis.
The hard problems
Access that's granular, not all-or-nothing
A patient isn't limited to switching one person's access on or off — they can hand out full read-write, visit-logging-only, or read-only, and change or revoke any of it later. The permission check is one shared choke point every route goes through, so a narrower grant is actually enforced everywhere, not just hidden in the menu.
AI that can draft but can't publish
The photo-to-note pipeline is intentionally one-way: it can create a draft and retry a malformed response, but nothing it produces reaches the real timeline without a person reviewing and explicitly publishing it. The model never has write access to the record itself.
Scheduling access that's genuinely narrower than clinical access
A care agency's staff can be given just enough access to plan shifts against a patient's chart — not a role that happens to hide clinical data in the interface, but a separate permission that structurally can't reach notes, vitals or alerts at all.
Built with
- Remix
- Prisma
- Postgres
- Anthropic Claude
- Passkeys
Building something in this space?
Work with us →