Track 20 years of cleft care in one place.

• 15–20 +

  years of care per patient

  From prenatal diagnosis to adulthood. Paper files get lost between departments, and spreadsheets fragment across laptops and coordinators.

• 5–7

  specialties, in parallel

  Plastic surgery, orthodontics, ENT, speech therapy, nutrition and psychology. Each has its own schedule, and none has a shared view.

• 30 +

  time-critical interventions

  Miss the alveolar bone graft window and the outcome is permanently worse. Nothing in a spreadsheet tells you a window is closing.

• Lifetime patient record

  Demographics, parents, family history, consanguinity and comorbidities. Prenatal cases are registered before birth and converted when the baby arrives.

• Treatment matrix

  Specialty against age band, with procedures auto-suggested for the patient's current age and filtered to your specialty.

• Age windows and alerts

  Per-procedure tolerance measured in months. Anything outside its window is flagged automatically and escalated to a coordinator.

• Anatomical diagrams

  Kernahan-Stark and Tessier classification marked directly on the diagram. The diagnosis code is derived, not typed.

• Dynamic forms

  A JSON-schema form engine. Administrators build forms that match your existing paper, with no code and no release.

• Medical image library

  Albums per procedure, SHA-256 hashed on upload, envelope-encrypted at rest, and served only through short-lived signed URLs.

• Scan intake

  Photograph a completed paper form and the fields come back filled in for review. Optional, off by default, and you choose the provider.

• Specialty exams

  Orthodontics, pediatric dentistry, speech evaluation and ENT each get their own structured form set and their own history view.

• Scheduling and coordination

  Worklists, a month calendar, recall reminders, and escalation when a patient stops showing up, the most common way cleft cases are lost.

• Reports and export

  Demographics, diagnosis mix, and on-time completion rates, exported to Excel for research, funders and ministry reporting.

• Access control

  TOTP two-factor, role-based permissions, department-scoped rows, and a tiered session lock so a shared workstation is not a shared login.

• Full audit trail

  Every read and write of patient data is logged with actor, entity and diff. Retention is a config value, not a hard-coded assumption.

• Hospital server

  On-premises, behind your own firewall. Nothing leaves the building, and clinical work does not stop when the internet does.

• Your own cloud

  Any VPS, any provider, any country. The whole stack is containerized, so a new environment comes up in an afternoon.

• Single-clinic install

  One machine, local PostgreSQL, and no dependency on the internet beyond your own network. Built for small programs and outreach sites.

You pick the country your data lives in. That is what makes local health-data rules such as GDPR, HIPAA and their equivalents something you can actually satisfy.

• Data residency is your decision

  Your deployment sits in the country you chose, on hardware or a cloud account you own. No cross-border transfer you did not ask for.

• Encrypted medical images

  Per-file AES-256 envelope encryption. The master key never lives in the object store, and images are served only through short-lived signed URLs.

• Complete audit trail

  Every read and write of patient data is recorded with actor, entity and a diff of what changed. The retention period is yours to set.

• Least privilege by default

  TOTP two-factor, role-based access, and row-level scoping by department, so a clinician sees the patients they are responsible for.

• No hard deletes

  Patient records are soft-deleted and recoverable. A mis-click by a tired coordinator at 2am is not a permanent loss.

• No lock-in on your records

  The database runs on your server, so a complete dump is always within reach, and reports export to Excel. Leaving is never a data loss event.

These are controls, not certifications. CleftCare gives you what you need to meet GDPR, HIPAA or your national health-data law. Meeting them still depends on how your deployment is configured and operated, and the documentation covers what that requires.