CareVault runs the whole clinic — scheduling, charting, laboratory, pharmacy, inpatient and billing — on one record, with tenant isolation enforced by the database rather than by a WHERE clause somebody has to remember.
Free tier for a single provider, forever. 14-day trial on paid plans. No card until you invite a second person.
Slot recovery, not just reminders
Risk-scored bookings, an escalating reminder ladder, and a waitlist that fills the gap the moment a slot lapses.
Charts that close the same day
Ambient scribe drafts from the consultation. The clinician edits and signs. Nothing files itself.
Decision support where the decision is
Interaction and allergy checks fire at the moment of prescribing, not in a report the next morning.
Isolation the database enforces
Postgres row-level security on every table. A query without tenant context returns nothing at all.
Outcomes, not module counts
Every other feature in this product exists to move one of them. CareVault instruments all four out of the box and shows you the trend without anyone building a report.
Every booking is scored on the patterns that actually predict a miss — lead time, prior misses, distance, deprivation, weather-adjacent seasonality. High-risk slots get an extra confirmation step and are offered to the waitlist the moment they lapse.
Eligibility is verified at booking rather than at the desk. Claims are scrubbed against payer-specific rules, and the ones the model flags as likely to be denied are held for a human before they go out.
Ambient scribe drafts the note from the consultation, pre-populated with the problem list, active medications and today's vitals. The clinician edits and signs. Nothing is filed without a signature.
Coding suggestions come from the note itself with the supporting text quoted, so the coder can see why. Scrubbing runs the payer's own edits. The denial model ranks the queue so the riskiest claim is reviewed first.
Baseline ranges are drawn from published outpatient benchmarks and vary widely by specialty, payer mix and geography. They describe the problem, not a result we promise. CareVault reports your actual figures from your own data — that is the number worth arguing about.
The trouble with the $59 hospital script
It demos beautifully. The problems show up in the failure modes — and in this category, the failure mode is somebody else's patient record on your screen.
Most bundled hospital scripts put every clinic in one schema and filter by a clinic_id column in application code. One missing WHERE clause in one report is a multi-tenant breach. CareVault enforces isolation in Postgres row-level security, so a query that forgets its tenant returns nothing rather than everyone.
A log table that the application can UPDATE is not evidence. When a patient asks who read their record — and in most jurisdictions they are entitled to ask — you need a trail that can be shown to be complete. Ours is hash-chained and append-only at the database level.
Pharmacy that cannot see the allergy list. Billing that cannot see what was actually done in the room. Every disconnected module is a place where a human retypes something, and every retype is a chance to type it wrong.
A one-time licence fee buys you a snapshot of someone's 2019 codebase. Payer rules change quarterly, drug interaction data changes constantly, and a system that is not maintained is a system that is slowly becoming unsafe.
Protected health information on a $6/month shared host, with database backups sitting in a world-readable folder, is the most common breach in this category. Not a sophisticated attack — a directory listing.
There is no such thing as HIPAA-certified software, and vendors who say otherwise are telling you what they think you want to hear rather than what they have. Compliance is a property of how you operate, and the vendor's job is to make it achievable and prove what they did.
One record, six jobs
Not six products with an integration story. One schema, one audit trail, one place a patient's allergy list lives — which is why the pharmacy screen can see it.
An empty chair costs the same as a full one. The scheduler's job is to make sure there are fewer of them.
A chart that helps at the point of the decision, not a form that has to be completed afterwards.
Getting paid is a workflow, not an afterthought. Most of the money is lost before the claim is ever sent.
Stock that reconciles and results that reach the ordering clinician.
The patient portal is the cheapest member of staff you will ever hire.
Every AI feature is off by default, metered per call, and produces a draft a human signs.
Security & compliance
A system holding protected health information should be able to describe its controls precisely enough that someone competent can check them. Here are ours.
What CareVault does not claim
There is no such thing as HIPAA-certified software. HIPAA has no certification scheme, and a vendor implying otherwise is making a representation the FTC treats as deceptive. CareVault signs a Business Associate Agreement, implements the safeguards described below, and gives you the evidence an auditor will ask for. Compliance remains a property of how your organisation operates — our job is to make it achievable and to prove what we did.
Every table carrying tenant data has a row-level security policy bound to a transaction-local session variable. The application connects as a role that cannot bypass it and owns none of the tables.
A query that opens without tenant context returns zero rows — the designed failure mode. CI fails the build if a table ships without a policy.
Each audit entry carries the hash of the one before it, so removing or altering a record breaks the chain from that point forward and the verifier says exactly where.
UPDATE and DELETE on the audit table are revoked at the database level, not merely avoided in code. Chain verification runs as a scheduled job and on demand.
National identifiers, contact details and other direct identifiers are encrypted per field with a tenant-derived key, alongside a keyed blind index so staff can still search on them.
AES-256-GCM with authenticated additional data binding the ciphertext to its tenant and column. A row copied to another tenant fails to decrypt rather than decrypting into the wrong chart.
Every server action and route handler proves the caller holds a live membership in the tenant before it touches data, then checks the specific permission.
CVE-2025-29927 showed that a crafted request can skip Next.js middleware entirely. Ours rewrites URLs and makes no security decision, so skipping it achieves nothing.
Opaque server-side sessions, not self-contained tokens. When a clinic terminates a member of staff, access ends within seconds rather than when a JWT happens to expire.
Only the SHA-256 of the session token is stored. A password change or forced sign-out invalidates every existing session at once.
You choose your region at sign-up: United States, European Union, India or the Gulf. Database, object storage and error telemetry all follow it.
Region is fixed at sign-up because changing it is a migration, not a setting. EU error traces routed to a US observability account is a residency breach that survives every other control.
BAA and DPA available on request — including Standard Contractual Clauses for transfers out of the EEA, and advance notice before a subprocessor changes.
FHIR R4 interoperability
Coded at capture with the terminologies the receiving system expects, exposed over a standards-compliant API, and exportable in bulk without anyone writing a query.
Patient, Practitioner, Organization, Location, Encounter, Condition, AllergyIntolerance, MedicationRequest, Observation, DiagnosticReport, ServiceRequest, Immunization, Coverage and DocumentReference.
RESTful search with the standard parameters, `$everything` for a full patient record, and transaction bundles for writes. Growth and Enterprise plans include write access; Professional is read-only.
EHR-launch and standalone-launch flows so a third-party clinical app can open in context with scoped, time-limited access — and appear in the audit trail as itself, not as the clinician.
Asynchronous group-level export in NDJSON for population health, research extracts and payer reporting, without anyone writing a database query.
LOINC on laboratory tests, SNOMED CT on problems, RxNorm on medications, ICD-10 and CPT on billing. Coded once at capture, so the export is not a text-matching exercise.
ABDM in India, Malaffi and NABIDH in the UAE, NPHIES in Saudi Arabia. These are licensing-bound integrations, so scope is confirmed per facility rather than assumed.
FHIR conformance is published as a machine-readable CapabilityStatement at the API root, so you can check exactly which resources and search parameters are supported rather than taking this page’s word for it. Regional programme integrations depend on facility licensing and are scoped per site.
Pricing
Because a clinic that grows its patient list is doing the thing you wanted it to do, and charging for it is a strange way to say congratulations.
For a single-handed practice that has outgrown a paper diary.
$0/ month
1 provider · up to 500 patients
Fill the diary, get paid at the desk, stop chasing confirmations.
$59/ month
First provider included
Where revenue cycle stops being somebody's evening job.
$129/ month
First provider included
Multi-site operations, denial prediction, and inventory that reconciles.
$229/ month
First provider included
For hospital groups with a procurement process and an auditor.
Custom
10 providers included, then volume pricing
Prices are in USD and exclude local sales tax or VAT. Additional provider seats are prorated to the day. AI credits beyond the included allowance are $9 per 1,000, and every workspace can set a hard cap that stops AI features rather than billing overage.
Design partners
CareVault is onboarding its first cohort. When we publish a customer result it will be a named clinic, a measured figure, and a reference call you can book — not a stock photograph with a sentence under it.
3–15 providers across 2+ locations, currently on a legacy on-premise EMR.
Dermatology, ophthalmology or orthopaedics, with meaningful claim volume.
An OPD running pharmacy and laboratory in-house, with inpatient beds attached.
Design partner terms: migration from your current system at our cost, direct access to the engineers building the module you care about, and pricing fixed for three years.
Apply as a design partnerNo customer quotes, logos or outcome figures appear anywhere on this site because we do not yet have any we could substantiate.
Questions we actually get asked
If your question is not here, ask it directly — you will get an answer from someone who works on the product.
No software is, and any vendor telling you otherwise is selling you a phrase rather than a control. HIPAA has no certification scheme. What we can tell you is specific: we sign a BAA, we encrypt PHI at rest and in transit, sensitive identifiers are encrypted at the field level with searchable blind indexes, access is role-based and logged to a hash-chained append-only audit trail, and tenant isolation is enforced by Postgres row-level security rather than by application code. Compliance is then a property of how your practice operates on top of that, which is why we also give you the reports an auditor will ask for.
In the region you choose at sign-up: United States, European Union, India, or the Gulf. The choice is fixed at that point because moving it later is a migration project rather than a settings change. Backups, object storage and error telemetry all follow the tenant's region — routing EU error traces to a US observability account is a residency breach that survives every other control, so we pin it explicitly.
Yes, and without asking us. Every tenant can export patients, encounters, orders, results and financials as FHIR R4 bundles or as CSV, on demand and via API. Enterprise tenants can stream the audit log into their own SIEM. Lock-in through export friction is a business model we would rather not have.
You export first, and we then follow the retention policy that applies to you. Deletion is not a DELETE statement: statutory medical-record retention runs from roughly 6 to 30 years depending on jurisdiction and patient age, so records move through a documented disposition lifecycle — retain, pseudonymise, crypto-shred — rather than vanishing on request. We will tell you exactly which floor applies to your jurisdiction.
The scripts are usually a competent CRUD application over a single shared database with tenant filtering in PHP. The difference shows up in the failure modes: a forgotten WHERE clause there leaks another clinic's patients, an editable audit table cannot answer a subject access request, and nobody ships a patch when a payer changes its edits. You are also buying maintenance — drug interaction data, payer rules and regulatory requirements all move, and a frozen codebase becomes unsafe rather than merely dated.
Only if you turn them on, and each one is a separate switch. When enabled, the relevant text goes to Anthropic under a BAA with zero data retention, which means it is not retained for training or for abuse monitoring. Anthropic is named in our public subprocessor register with direct PHI access, because pretending otherwise would be the dishonest option. Every call is metered and attributed, so you can see exactly what was sent and by whom.
A single-provider practice is usually seeing patients in the system the same week. A multi-site group with an existing EMR to migrate is typically four to eight weeks, most of which is data mapping and staff training rather than configuration. We import from CSV, from FHIR, and from the handful of legacy systems we have written parsers for.
Each plan includes a monthly credit allowance, and one credit is roughly one AI action of typical size. Top-ups are $9 per 1,000 credits. You can set a hard cap so the features stop rather than bill, which is the setting most practices choose in their first month. Unused credits do not roll over — we would rather price them low than pretend to bank them.
For Enterprise tenants with a genuine regulatory requirement, yes — a dedicated database shard in the region of your choice, and in a small number of cases a single-tenant deployment. It costs more and updates land more slowly, and we will say so during the sales process rather than after.
Import a patient list, put tomorrow's schedule in, and see whether the difference is real. It takes about twenty minutes and costs nothing.
No card required. Export everything on the way out if it is not for you.