Governance
The guarantees are fixed.
The routing is configurable.
Fourteen rules this platform is built to obey, and the record it leaves behind.
Tamper-evidence
Don't take our word for it. Break it.
“You can trust the log” is exactly what an untrustworthy log would say. So alter a record and watch what happens to every one that follows.
| entry | action | prev | hash |
|---|---|---|---|
| 0x41 | visit posted · rate $34.00/hr | 00000000 | e2af90e0 |
| 0x42 | 6 caregivers ruled eligible | e2af90e0 | d9f14bd0 |
| 0x43 | ranked · continuity, distance, reliability | d9f14bd0 | 83d176b0 |
| 0x44 | match confirmed · rate unchanged | 83d176b0 | 33ce6fd5 |
| 0x45 | decision record sealed | 33ce6fd5 | 59a249f7 |
Illustrates the designed structure with a simplified hash. The Merkle-chained trail is on the roadmap; at launch the log is append-only.
The charter
Fourteen rules.
None are configurable by an institution. That is what makes them guarantees rather than defaults.
Pay
Clinicians and caregivers
- 01
Pay is never a tiebreaker.
Conflicts resolve on credential fit, continuity, distance, workload, and reliability.
- 02
Your rate is yours, and it does not move after posting.
- 03
A late cancellation still pays.
A fixed rule in the policy engine, not a judgement call.
- 04
Declining work costs you nothing.
- 05
Ask why you were not matched. Get the logged answer.
The reasoning is written at the moment of the decision, and produced on request.
Safety
Caregivers on a visit
- 06
End an unsafe visit in one tap. The scheduled pay stands.
- 07
See a family's incident history before you accept.
- 08
Incidents follow the family, not the caregiver who reported them.
- 09
Arrival and departure are recorded at both ends.
So a family can confirm the visit, and a caregiver has proof of it.
Data
Institutions and patient records
- 10
Nothing is permitted until it is explicitly allowed.
- 11
A human approves every movement of money and every release of PHI.
Hard-blocked. No institution can switch it off. Who approves is theirs to set.
- 12
No executed agreement, no patient data. Ever.
- 13
Emergency access is named, justified, time-boxed, and alarmed.
- 14
Two isolation layers must fail, not one.
Row-level security at the database, tenant validation in the application.
Rule 01, shown
The cheapest caregiver is not the answer.
Because the engine deciding this has no access to the number.
Shown for institutional matching, where the system resolves the shift. In home care the family selects — see below.
The engine reads
- ✓credential fitverified for this service type
- ✓continuityprior visits with this family
- ✓distancetravel time to the address
- ✓workloadhours already booked this week
- ✓reliabilitycompleted visits, on time
The engine cannot read
caregiver rate
Not exposed to the ranking function. There is no cheaper-wins path, because there is no path from price to placement at all.
A platform that ranks on price will eventually discover it can pay less. The only durable fix is to withhold the number.
Resolved
- 01c-02913 prior visits with this family$34.00
- 02c-04172.1mi · no prior relationship$29.50lowest · not selected
- 03c-03386.4mi · no prior relationship$31.00
Who decides
Matching works differently on each side.
An institution posting a shift wants the system to resolve it. A family choosing who enters their home wants to choose. Those are different problems and they get different mechanisms.
The system matches.
A shift is posted, eligible clinicians are identified, and the system resolves it on credential fit, continuity with the unit, distance, workload, and reliability. Pay is not an input and cannot be made one.
Because the platform makes the decision, it owes an explanation for it — which is what the decision record is.
The family chooses.
The platform shows which caregivers are eligible, verified, and available, with filters the family applies themselves — distance, service type, prior visits, identity verification. The selection is theirs.
We do not score caregivers to decide on a family's behalf. A platform that ranks workers by quality is directing their work, and that is a line we hold on purpose.
This is why identity verification stays optional and appears as a family-applied filter rather than a ranking boost. The same distinction governs what the matching engine is permitted to do on each side of the platform.
Rule 05, shown
Recourse is a file, not a phone call.
Researchers have documented the same failure across gig nursing platforms: workers with no way to contest a decision made about them.
The reasoning here was written down before anyone asked for it.
$ OlliDoc.it audit --match=4471 --requested-by=caregiver
The trail
Using a record and proving one are different jobs.
Most platforms in this category offer one of these three. An audit needs all of them.
Use it
Live dashboard
Tenant-scoped and read-only. Every access to a record in ninety days. Every emergency entry this month. Every denial.
Prove it
Verification
A signed digest and a proof that a given entry is unaltered. What you hand an auditor who asks whether the record could have changed.
Keep it
Export
Into your own tooling. The export is itself written to the trail.
Status
Most platforms wrote their governance after they got sued.
We wrote ours first. Which means being exact about what runs today and what does not — a governance page that blurs the two is the thing this page exists to argue against.
At launch
- Append-only decision log
- Default-deny access control, strict tenant isolation
- Rate fixed at posting, with history
- GPS arrival and departure, with a flagged-for-review state
- Encryption in transit and at rest
Designed, not yet built
- Merkle-chained trail and cryptographic verification
- Real-time credential verification against national and state sources
- Per-tenant envelope encryption
- Compliance dashboard and institutional export
- Emergency access and the data-agreement gate
Architecture
Designed by Netminder42.
The access model, the audit trail, the human-approval gates, and the constraints the matching engine operates under.