Genesys+ connects every clinic already running Genesys EMR into one exchange. Offline-first sync, a single patient identity across facilities, FHIR at the border, and consent the patient grants from WhatsApp in under a minute.
Each layer runs on the .NET stack Genesys facilities already operate. Nothing here asks a clinic to change how it works when the network is down.
A background worker beside each facility's EMR. Events batch locally and push when a link appears.
Deterministic matching on hashed NIN, verified phone and demographics. One human, one identifier.
Every resource crossing a facility boundary is HL7 FHIR R4, authenticated at the border.
Scoped, time-boxed grants the patient issues from WhatsApp. No grant, no record.
One immutable line per access: who, what, where, when, and the consent proof behind it.
Lose power or lose the link and the clinic runs as it always did. Events queue locally and push exactly once when the connection returns.
A doctor requests records from another facility. The patient gets a message, taps approve, and the record opens for that clinician, for that visit. Every grant is signed, timestamped and written to an immutable log.
Nothing is fetched and then hidden. Until the patient answers, there is nothing on the clinician's screen to hide.
Who is asking, which two facilities, which resource types, and for how long. A request that cannot name them cannot be sent.
Same weight as approve, in the same place, every time. Care proceeds without the record.
A request nobody answers opens nothing. There is no timeout that approves on the patient's behalf.
Withdrawing closes the record mid-session. No phone call, no letter, no finding the right person.
A first-time patient tells Jenny which facility they are going to. She verifies the NIN, takes the details the front desk would have written on a card, and opens the file in that hospital's Genesys EMR before the patient arrives.
Attached to the existing identifier. No second file is created and the history stays in one piece.
No record anywhere on the exchange. An identifier is issued and the registration written to the record.
A shared phone, a transposed date, a common name. Held for a person. Nothing merges automatically and nothing duplicates automatically.
Pre-registration replaces the re-keying. It never replaces seeing the patient: the desk still confirms identity in person, against identification.
A patient in Lagos can ask Genesys+ for their own history the same way they message a friend. Jenny verifies them with a code, assembles the record from every facility that holds a piece of it, and sends back a password-protected document on a link that expires.
Under the NDPA a patient can request the data held about them. That right existed before Genesys+ and is not created by it. What changes is that it stops being a written application and a wait, and every disclosure is logged against every contributing facility.
A 6-digit code checked against the number on the index, valid for 5 minutes.
15 minutes. Nobody at the hospital can extend it or reissue it on the patient's behalf.
Jenny books the consult, joins the clinician to the patient's full cross-facility record, and holds the schedule afterwards. Appointments arrive as a calendar invite. Medication arrives as a message at the hour it is due, in the patient's language, with the days remaining in the course.
The consult is not finished until the schedule is set. The value of a remote consultation is that the patient leaves it with every dose already in their phone.
Moving it in the thread moves the clinic booking and the whole reminder series together.
Reminders stop with a final message rather than trailing off and leaving a patient guessing.
A “taken” reply records that a button was pressed. It is a useful signal about engagement and a poor one about ingestion, and it is never charted as administration.
At the centre of the network. Every clinic, every record, every consent, one assistant standing in the middle of it.
She speaks to patients on WhatsApp and to clinicians in the record, and she is the same assistant in both places, working from the same verified data.
Jenny never diagnoses, never prescribes, and never answers from outside the record. Where she is unsure, she says so and routes to a human clinician.
English, Yorùbá, Hausa, Igbo, Nigerian Pidgin and French, at parity rather than as a translation layer bolted on afterwards.
A brief names the source encounter for each statement, and the clinician can open it. A line without a source is not a line she writes.
A summary assembled from three of four facilities is a summary with a hole in it, and it says so rather than reading as complete.
Jenny is one assistant over many models. A Semantic Kernel service in C# routes each task to the cheapest model that can do it safely. Triage runs on a small open model in-country. Long histories go to a high-context model, and swapping any of them changes nothing about how Jenny behaves.
A pre-processing stage removes names, identifiers and phone numbers before the request body is assembled, not before it is sent. It is not promptable and cannot be configured off.
Retrieval is scoped to one patient identifier before the search executes, so another patient's history is never in the set being read from. That is a structural property rather than a probability.
Agent output is decision support. It is drawn from the record, cites the source encounter, and is never the final clinical judgement.
Not four records side by side. One history, in date order, with the source facility named on every entry, and the live grant and its expiry in the header the whole time it is open.
Ciprofloxacin ordered here overlaps ferrous sulphate dispensed at Kaaf Specialist on 02 Jun. Absorption reduced. Separate doses by two hours.
Both sides of this collision live at different facilities. A single-facility EMR sees neither.
Illustrative interface. Not live client data.
NDPA obligations are built into the pipeline rather than bolted onto it, and the controls are the kind that can be demonstrated in a room rather than described in a brochure.
Clinical data is unreachable without a live grant. A bug in an interface cannot widen access, because the widening is not the interface's to do.
The audit log rejects edits and deletions outright. Every read carries the grant that authorised it, exportable for a regulator.
No role at any facility, including ours, can release a cross-facility record without a patient grant. The control does not exist to be found.
Lose power or the link and the clinic runs as it always did. Events queue locally and push exactly once when the connection returns.
If you already run Genesys EMR, joining is a sync agent and a consent policy. Jenny comes with it. We will walk your team through both.