Changelog | temetro docs

All notable changes to temetro are posted here, newest first. For where the project is headed, see the roadmap.

July 19, 2026 — Hardware barcode scanning in the pharmacy

Add stock with a USB barcode scanner

The pharmacy Add item dialog is now built for a USB barcode scanner connected to the computer. With the dialog open, scan a medication's barcode and temetro fills in the Barcode/NDC field — and, for a GS1 DataMatrix, the expiry and lot too — without clicking into any field first. You can still type or paste a code and press Enter. This replaces the camera scanner in this dialog; the camera is still used to scan a patient's wallet code when importing.

Care team panels match the rest of Settings

The Care team section in Settings now shows each card as a distinct panel on a subtle tray, matching the Preferences and AI settings.

Smaller fixes

The Activity feed now shows a pointer cursor when you hover an entry.

In the patient wallet app

Fixed a crash on launch that could stop the app from opening.

July 18, 2026 — Show/Add on the record, and barcode scanning

The record dialog separates viewing from adding

Opening a patient record to edit now starts on a read-only Show view of everything on file, with a separate Add tab for entering new data and its Add buttons. Saving from the Add tab still offers to send the update to the patient's wallet when they have one linked.

Scan medication barcodes when adding stock

The pharmacy Add item dialog can now scan a medication barcode with the camera. Scanning a GS1 DataMatrix fills in the expiry and lot automatically, and the code is saved on the item in a new Barcode/NDC field.

Scan a patient's wallet code to import

Import from a patient app gains a Scan button that reads the QR or barcode shown in the patient's wallet app to fill in their wallet number, instead of typing it.

Separated settings panels now match the design system

The spaced-apart settings panels now render as proper distinct cards on a subtle tray, matching the component library exactly rather than a gap added to the joined-card style.

In the patient wallet app

New appointment reminders: turn them on in Settings to get a local reminder before each upcoming appointment.
The Share your record screen now offers a QR code or a 2D barcode, so a clinic can scan the wallet number whichever way suits their scanner. Longer text (e.g. Somali) no longer stretches the home cards unevenly, and the phone-number sheet stays above the keyboard.

July 17, 2026 — Settings panels sit apart

Grouped settings no longer stack flush

In Settings, sections that show more than one card — the AI availability toggles and the patient and account notification lists — had their cards pressed together with no gap, so a group read as one solid block. Those cards now sit apart with a small gap, making each toggle easier to read as its own row. Lists that are meant to be one continuous table, like the care team and records, stay joined as before.

July 15, 2026 — Prescriptions reach the wallet, and patients can open their documents

Prescriptions now actually appear in the patient's app

A prescription sent with Sync to wallet never showed up in the app's Prescriptions section, even after the patient approved it. Prescriptions live in their own table on the clinic side, and they weren't being included in the record the patient approved — so the approval applied a copy identical to what was already on the phone. Prescriptions now travel with the record, keeping the prescriber, status and dates. See Pushing updates to a wallet.

Patients can open their documents, and save their own

Tapping a document in the wallet app only ever showed its name and size, because the file itself stayed on the clinic. Documents now download and open on tap — images inline, PDFs and other files in the phone's own viewer — and are kept encrypted on the device, so the second time works offline.
Patients can also photograph their own paperwork from the home screen (or pick an image from their library) and keep it with their record. These stay on the phone and are never sent to a clinic. A chip on each row shows whether a file came from the clinic or the patient.

No more false "this clinic's key changed" warnings

The app warned that a clinic's signing key had changed even for a clinic just added. Keys were pinned against the clinic's name, so two clinics sharing a name — including any clinic that hadn't set one — collided, and the second always tripped the warning. Pins are now held against the clinic's stable id, and resetting a wallet clears them.

Creating a wallet is four short pages, not one long one

The "Create your wallet" screen asked for everything at once and scrolled. It's now one question per page — name, then date of birth, then a PIN — with progress dots and a back arrow. The date of birth pickers are full-width instead of three cramped dropdowns.
The intro carousel now reappears when a wallet is reset, as it was meant to, and finishing it no longer leaves you on the last slide until you restart the app.

Fixed in the app

Confirming a PIN showed no spinner and looked frozen while the wallet was being secured.
The keyboard stayed on screen after the PIN step, over the home page.
Editing your phone number in Settings put the keyboard over the field you were typing into.

Fixed for clinics

Settings sections inset their content twice and drew a border around an inner box. Sections now use one surface with a single, consistent padding.
Windows: building from source produced a backend container that exited immediately with a misleading "no such file or directory". Self-hosters on Windows are unaffected if they pull the published images.

July 15, 2026 — Reliable wallet push, framed settings & a multilingual wallet app

"Send to wallet" now works from every dialog

Pushing an update to a patient's wallet used to only work from the patient record sheet. The same step in the appointment, invoice, prescription, patient-edit, and scribe dialogs could close without sending if you saved before the wallet link finished resolving. It now waits for that check and always sends a non-empty change summary. See Wallet updates.

Every settings section is now composed from the same CardFrame primitives (header, description, and a proper framed panel body), so rows sit in a single consistent surface instead of a card nested inside a frame.

Patient wallet app: French, Arabic & Somali, redesign, and a phone number

The patient companion app now ships in English, French, Arabic, and Somali, with a language switcher in Settings (Arabic is fully right-to-left). The onboarding and wallet-creation screens were redesigned (including a real date-of-birth picker), you can save a phone number that stays on your device, and the app now supports iPad and is prepared for the App Store and Google Play.

Self-hosting: Docker images build on Apple Silicon / ARM64

docker compose up --build no longer fails on ARM64 hosts — the frontend production build switched from Turbopack to Webpack, which builds on every architecture.

July 13, 2026 — Filter row, AI Automatic/Off modes, framed settings & wallet documents

The Patients filter has its own row

The status filter moved out of the toolbar and onto a dedicated Filter row just above the table, so the top of the page stays a clean title, search, and Add patient button.

On a patient's record, the name and the ⋯ menu now sit together on one row, and Edit lives inside that menu alongside the other actions.

Two new AI modes: Automatic and Off

Settings → AI now offers Automatic (use a cloud API key when you've added one, otherwise fall back to your local Ollama model) and Off (turn the assistant off entirely), in addition to the existing API-key and Local modes. New installs default to Automatic, so you'll see a "connect an AI model" prompt above the chat until a provider is set up — a banner that previously never appeared.
The chat is also more robust: if a result comes back in a format the app doesn't recognize, you now see a small placeholder instead of the card silently disappearing.

Settings has a fresh look

Every settings section is now presented in a consistent framed card for a cleaner, more organized page.

Patient wallet app

Documents now come through. When a clinic pushes an update, any files on your record arrive as documents you can see — the Documents tile counts them and the Documents screen lists them.
Updates that can't be verified no longer vanish silently — you get a notice instead.
The app now uses i18next for its text, laying the groundwork for additional languages.

July 13, 2026 — Cleaner Patients page, tidier dialogs & wallet home sheets

The Patients page reads more cleanly

The patient list is now a proper bordered table, and the top of the page keeps a single Add patient button — the "Import from a patient app" action moved into a ⋯ menu so the toolbar isn't crowded.

Fewer buttons on a patient's record

Opening a patient no longer shows a wall of buttons: you get Edit plus a ⋯ More menu with Download summary, Record visit, Transfer, Push to wallet, and Delete.

A better New Invoice dialog

The Back-date and Due date checkboxes are now crisp, properly-shaped controls.

Patient wallet app

On the home screen, Share record opens a sheet with a QR code a clinic can scan, My wallet opens a sheet to quickly copy your wallet number and fingerprint, and a Scan shortcut replaces the duplicate notifications button.

July 12, 2026 — Date pickers, working profile fields, patient filters & app polish

A real date picker for prescriptions

The Start date and End date in the New Prescription dialog now open a proper calendar picker instead of the raw browser date box — consistent with the rest of the app.

Specialty and professional links now save

On Settings → Profile, the Specialty selector and Professional links were previously decorative — they now save with the rest of your profile.

Filter and search patients faster

The Patients page has a status filter (active, inpatient, discharged), and search now also matches a patient's conditions and allergies, not just name and file number.

Switch language from anywhere

A language shortcut now sits in the sidebar user menu next to Theme, so you can switch the interface language (including Arabic, right-to-left) without opening Settings.

Clearer notices

The "update available" message now uses a warning style and stays in the corner correctly in right-to-left languages, and the "connect an AI provider" hint above the chat box is clearer and shows during a conversation too — not only on a fresh chat.

Record history shows every change

A patient's Record history now always renders in full; a layout quirk that could crowd or clip the list is fixed.

Patient wallet app

The app home screen adds quick actions (share record, wallet, notifications) and a recent activity feed, the settings screen gains an About section (version, docs, blog) and a privacy note, and the bottom sheets got a design polish.

Behind the scenes

Fixed blog.temetro.com (it was returning an error due to a networking misconfiguration) and tidied internal developer docs.

July 10, 2026 — Cleaner stepper & record history, faster landing page

A centered "Sync to wallet" stepper

The two-step "Sync to wallet" stepper in the create/edit dialogs now sits centered, with its numbered markers lined up neatly beside their labels — a small polish to the flow that pushes a change to a patient's wallet.

Record history reads as a timeline

The Record history on a patient's sheet is now a proper timeline: for each change you see who made it, an icon for what kind of record it was, what happened, and when — much easier to scan than the old flat list.

A faster marketing site

The 3D globe on the Temetro Network section of the website now loads only when you scroll to it, so the homepage opens noticeably quicker.

Clearer docs

Rewrote the busiest guides — the chat, settings, and a few others — to be shorter and easier to skim, with more lists and fewer walls of text.

July 9, 2026 — Send-to-wallet in dialogs, safer dates, wallet-app polish

Push a change to the wallet without leaving the dialog

When you add or edit something for a wallet-linked patient — an invoice, an appointment, a prescription, a demographics edit, or an AI note — the dialog now shows a two-step "Sync to wallet" stepper. After you save, it offers to send the change to the patient's wallet so they can approve it on their phone. No more hopping to the Patients page to push an update. Patients without a wallet see no change — the dialog just closes as before.

Dates can't accidentally land in the past

New appointment and new invoice date pickers now disable past dates by default. For a genuinely older invoice, tick Back-date on the invoice dialog to unlock earlier dates.

Settings

Removed the inactive Features section (the old "patient-owned storage" / "require signed records" toggles), which was outdated and did nothing.

Patient wallet app

Link your wallet in the Patient Portal no longer asks you to type your name and file number — it identifies you by your wallet number and just confirms the link (the clinic pairs your wallet number to your file first).
Pull to refresh on any screen — home, records, invoices, notifications, and settings.
The PIN / passphrase unlock and setup screens now show a spinner while they work.
A refreshed sign-up screen and cleaner bottom sheets throughout.

July 9, 2026 — Wallet-linked Patient Portal, phone-ready QR, RTL & sync fixes

Link your wallet to a clinic

The Patient Portal gains a "Link my wallet" option: it shows a QR you scan with the Temetro wallet app to connect your phone to your file at the clinic. Once linked, you can book appointments and view and download your results right from the app — and everything syncs back to the clinic's web app.
Under the hood the wallet app now talks to the clinic through the Temetro Network relay instead of a direct connection, so the portal works from any phone without the clinic exposing its server to the internet.

The Patient Portal QR now works from a phone

The QR in Settings → Signing → Patient Portal previously encoded a localhost address that a phone couldn't reach ("server cannot be accessed"). It now encodes a relay-based pairing code, so scanning it in the wallet app connects reliably.

Appointments & invoices in the wallet

When a clinic pushes a record to your wallet, your appointments and invoices now travel with it and appear in the app (with a new Invoices section showing paid / unpaid status).

Clinic location — full address

"Use my current location" now fills the address, city, and country (via reverse geocoding), not just the map coordinates.

Arabic (RTL) layout

In Arabic, the sidebar's collapse arrow and notification bell now sit above the nav icons (and the arrow mirrors correctly) instead of being pushed to the far edge.

Patient wallet app

New app lock: set a PIN or passphrase to open the app; log out from Settings to lock it again without erasing your data.
Notifications now work — clinic updates and share requests appear in the inbox with an unread badge. Redesigned bottom sheets, a larger home logo, and refreshed typography throughout.

July 7, 2026 — Portal booking with doctors, Arabic layout, wallet fixes

Patient Portal: pick a doctor & book

The Patient Portal now lists the clinic's doctors and lets patients choose one, see that doctor's free time slots, and book a conflict-free appointment. Availability is server-authoritative — a slot taken in the meantime is rejected. New public endpoints GET /api/portal/{clinic}/doctors and /availability, and booking accepts a chosen provider. See the Patient Portal API.
Settings → Signing → Patient Portal adds buttons to open the portal, copy its link, and show a QR code. Scanning the QR with a phone camera opens the web portal; scanning it in the Temetro wallet app opens a native booking screen.

Clinic location — use my current location

The Clinic location editor gains a "Use my current location" button that fills the map coordinates from the device's GPS.

Right-to-left (Arabic) layout

Switching the interface to Arabic now mirrors the whole app: the sidebar moves to the right and toggles read in the correct direction, instead of leaving the layout misaligned.

Patient wallet app fixes

Tapping a record card no longer freezes the app — the detail bottom sheet opens reliably.
Reset wallet now asks for confirmation in a native dialog with Liquid Glass actions before erasing anything.
Fixed the white flash at the screen edges when moving between pages in dark mode.
The home header, onboarding, and registration now show the Temetro logo (was the placeholder app icon).

July 6, 2026 — Blood type & phone, clinic location, wallet app refresh

Patient blood type & phone number

Patient records now carry a blood type (e.g. O+) and a phone number. Both appear on the record sheet and the chat summary card, and are editable in the add/edit patient form.
Phone is a contact/demographic field — the reception role can see and edit it. Blood type is treated as clinical information and is hidden from reception, like allergies and vitals. See the Patients API.

Clinic location in Settings

Owners/admins can now set the clinic's location — address, city, country, and optional map coordinates — under Settings → Signing → Clinic location. This will be shown to patients in the wallet app. See the signing/clinic API.

Patient wallet app refresh

New blue look (replacing the old teal accent), a consistent tab bar, and the app logo on the home header, onboarding, and registration.
The home header's Settings and Notifications buttons now use Apple's native Liquid Glass material on iOS 26+. Tapping a visit / prescription / appointment opens a blurred bottom sheet with its details.
Removed the leftover demo data — a new wallet now starts from an empty record — and rebuilt the onboarding screens.

July 5, 2026 — Temetro Network

A big day for the clinic⇄patient-wallet connection: it moved onto Temetro Network (a dedicated relay), grew into a multi-clinic network with a Settings opt-in, and picked up several same-day fixes.

Multi-clinic network & "Join Temetro Network"

Join the Temetro Network from Settings. A clinic now opts into the relay explicitly: Settings → Signing → Join Temetro Network. It's off by default; while off, the clinic makes no relay connection and the wallet-import and update features stay hidden. See the Temetro Network guide.
Every clinic gets its own identity — no shared password. Clinics authenticate to the relay by signing a challenge with their own signing key (the same key patients already verify), instead of a shared RELAY_TOKEN. The relay identifies each clinic by its key and keeps each clinic's traffic separate, so many self-hosted clinics can share one public relay and a patient's response only ever reaches the clinic that asked.
The patient stays the trust anchor. The relay never decides which clinic is "legitimate" — it only routes; every record is signed and the patient approves it on their phone. RELAY_TOKEN is now optional (only for gating a private relay).

The relay itself

A dedicated network between the clinic and patient wallets. The connection to patient wallet apps runs through Temetro Network, a small, high-performance relay (Rust + Axum) at a stable address that is always on — replacing the ephemeral tunnel that made sharing work only sometimes.
Still a dumb, end-to-end-encrypted pipe. It forwards sealed bundles only your clinic can open, keeps no database, and stores nothing.
Open source and self-hostable. The relay lives in its own repo (github.com/temetro/temetro-network) and deploys in minutes on Railway or any container host.

Fixes

Reaching the network just works. The backend's RELAY_URL defaults to the hosted relay (https://network.temetro.com) — previously a clinic that joined the network without setting it couldn't reach the relay (inside Docker, localhost is the container itself). Clinics running their own relay still override RELAY_URL.
QR "scan to connect" fixed. A scan briefly returned "couldn't reach the clinic relay"; the clinic now pre-registers the pairing so a scanned approval routes back (and survives a relay restart). Generating a QR requires the clinic to have joined the network, with a clear prompt if not.
Patient wallet app polished. The wallet connects to the public relay by default, and its relay address is now fixed rather than hand-editable — a mistyped URL used to break record-update delivery. Record-update pushes now surface reliably, and the registration form no longer hides behind the on-screen keyboard.

July 4, 2026 — Read-only FHIR R4 server

Share your records over FHIR. temetro can now act as a read-only FHIR R4 server at /fhir, not just a FHIR client — external systems read a clinic's Patient, Observation (labs + vitals), AllergyIntolerance, Condition, MedicationRequest, Encounter and Appointment over standard FHIR REST. See the FHIR server API.
Per-clinic API keys. Authenticate with a tmf_… bearer token created under Settings → Integrations → FHIR server (owner/admin). The key is shown once, stored only as a hash, and revocable; every request is scoped to your clinic and written to the activity log. GET /fhir/metadata (the CapabilityStatement) needs no auth.
Honest FHIR. Clinical values are text-only CodeableConcepts (temetro stores free text, not SNOMED/LOINC), patients carry an age extension rather than a birthDate, and searches paginate with _count/_offset. Writes and OAuth2/SMART-on-FHIR are not yet supported.

July 3, 2026 — Push record updates to a patient's wallet

Clinic → wallet updates. For a patient imported from a wallet (a permanent share), a clinician can now push an updated record to the patient's app with Push to wallet on the patient sheet. It lands in a pending-updates inbox in the wallet and replaces the on-device record only after the patient approves it. See Pushing updates to a wallet.
Signed, sealed, offline-safe. Each update is signed with the clinic's key and encrypted to the wallet; the relay only forwards ciphertext. Updates are delivered live or on the wallet's next connect, so an offline phone catches up. The wallet pins the clinic key and warns if it ever changes. Track sent updates under Settings → Signing.

July 3, 2026 — Ambient AI visit scribe

Record or paste a visit → a reviewed note. A new Record visit action on the patient sheet turns a clinician↔patient conversation into a draft SOAP encounter note. Record with your microphone or paste a transcript; temetro transcribes and drafts the note, and you review and edit it before it's saved to the record — the same write-approval gate as the AI chat. See the visit scribe guide.
Uses your own model — transcription runs on your OpenAI (Whisper) or Gemini key; drafting works with any provider (including local Ollama, from a pasted transcript). No separate cloud scribe.
Privacy — the drafting step is de-identified through Veil like every AI write; audio sent to an external provider for transcription can't be redacted, and the dialog says so before you record.

July 2, 2026 — Three new languages & right-to-left support

Somali, Arabic and German join English and French — pick any of the five in Settings → Profile → Language. Native names are shown in the selector (Soomaali, العربية, Deutsch).
Right-to-left (RTL) layout for Arabic — choosing Arabic flips the entire interface: the sidebar moves to the right, menus and chat bubbles mirror, directional chevrons and arrows reverse, and Arabic text renders in a dedicated Arabic typeface. The direction is applied before the first paint, so there's no flash of the wrong layout on load.
Language now roams with your account — your choice is saved to the server (not just this browser), so it carries over when you sign in on another device.

Apple Silicon (arm64) Docker images — the published temetro-backend and temetro-frontend images are now multi-arch (linux/amd64 + linux/arm64), so docker compose pull works on Apple Silicon Macs instead of failing with no matching manifest for linux/arm64/v8. See Updating.
Language switch asks first — changing the interface language in Settings → Profile is now a dropdown that confirms before switching, so you won't reload the UI into another language by mistake.

June 29, 2026 — French, more pagination & smarter updates

Choose your language

French (Français) interface — temetro now speaks French. Pick your language under Settings → Profile → Language; the choice is remembered on that device. Selecting a new language asks for confirmation before the interface reloads its text.

Patients, activity & billing

Pagination everywhere — the Activity and Invoices pages now paginate (10 per page), matching the Patients list.

Self-hosting & updates

Accurate update checks — Settings → About & updates now reads the latest version straight from Docker Hub (the channel clinics actually pull from), so it no longer says Up to date when a newer image is already published. A new Check for updates button forces a fresh check. See Updating.
Configurable host ports — the ports temetro publishes on the host are now set from .env (BACKEND_PORT, FRONTEND_PORT, ADMINER_PORT, alongside POSTGRES_PORT), so a port clash on docker compose up -d can be fixed without editing the compose file.

June 28–29, 2026 — AI chat card fixes on Google Gemini

Record cards now render on Gemini — the card-emitting chat tools shared an empty parameter schema, which Google Gemini can't call, so it printed the raw tool call as text instead of drawing a card. The tools now use a non-empty schema. See migration & import.
Patient lookups by name — asking "Show me <name>'s medical record" now draws the record card directly when exactly one patient matches, instead of depending on a follow-up tool call that Gemini sometimes skipped.

June 27, 2026 — polish

Patients pagination now renders as proper page buttons (the controls were unstyled and wrapping).
Patient sheet header reflowed so the patient name is no longer truncated by the action buttons.
Messages now shows sender and recipient avatars alongside the chat bubbles.

June 27, 2026

Patients: pagination, history & PDF export

Pagination — the Patients list now shows 10 per page, and status badges are colour-coded (active → green, inpatient → blue).
Record history — each patient sheet shows an audit timeline of every change to that chart, drawn from the activity log.
Download summary — export a clean, printable one-page clinical summary (Save as PDF) straight from the patient sheet; it's built in the browser, so nothing leaves your server.

AI chat & messages

Reliable import approval cards — the assistant now always renders an approval card when importing patient data instead of occasionally printing the raw tool call as text (a Google Gemini quirk).
Setup heads-up — a one-time notice above the chat input points you to AI settings when no provider (API key or local Ollama) is configured yet.
Refreshed Messages thread — conversations now use chat bubbles and tidy attachment cards.

Self-hosting

Network address fix — Settings → About & updates no longer shows an unreachable container address when running under Docker; it falls back to a clear "open via the server's IP" hint. See Network access.

June 26, 2026

Updates, versioning & easier install

Prebuilt Docker images — temetro now publishes khalidxv/temetro-backend and khalidxv/temetro-frontend to Docker Hub via a tag-triggered release workflow. Clinics install and update with docker compose pull && docker compose up -d instead of building from source. See Updating.
In-app update awareness — a new GET /api/version endpoint reports the running version and checks GitHub for a newer release. Settings → About & updates shows the current/latest version and the one-click update command, and an optional, dismissible banner appears when an update is available.
LAN access — the web app now finds the backend from the host you open it on, so other departments can reach temetro at http://<server-IP>:3000 with no rebuild. The Settings panel surfaces the shareable address; GET /api/network reports detected LAN addresses. See Network access.

AI chat: voice dictation

The chat input's microphone now works — dictate with the browser's speech recognition and the transcript fills the message box. Falls back gracefully where the browser lacks support.

June 24, 2026

Wallet app: rebuilt on HeroUI Native — simpler 3-tab design + registration

New UI foundation — the wallet app's screens are now built with HeroUI Native (React Native + Uniwind/Tailwind) instead of @expo/ui, as cross-platform single files. The native tab bar stays (expo-router NativeTabs) with crisp SF Symbol icons; in-screen icons are lucide.
Three tabs — Home, Scan, and Settings. Home leads with a greeting, a copyable tmw_… wallet-number chip, an allergy alert, and a 2×2 card grid — Patient Visits, Prescriptions, Appointments, Documents — each opening a detail page.
Registration — first launch now captures name, date of birth, and sex, mints the Ed25519 wallet, and seeds the record, instead of dropping straight into a sample record.
Scan & share — scanning a clinic QR opens a bottom sheet that reviews exactly what will be shared before you approve. Settings keeps wallet number / fingerprint copy, the relay editor, a dark-mode toggle, and reset.

Wallet app: a data-rich screen — vitals, trends & status color

The record now shows data, not just labels — the wallet screen gains an at-a-glance vitals strip (heart rate, blood pressure, SpO₂, temperature as big tabular numbers) and a trend chart (a native SwiftUI line chart of the heart-rate trend with the latest value called out).
Color-coded status — each record card carries a semantic chip: allergy severity (mild / moderate / severe) and lab flags (normal / high / low / critical), plus a real second line (dose · frequency, "since YYYY") so cards are full instead of empty.
A wallet-pass hero — the identity card is now a branded teal "pass" with a shield / Verified motif and the wallet number as the focal element, in aligned tabular figures.

Wallet app: a warmer redesign, a history timeline & first-launch onboarding

Richer, less "flat" wallet UI — the iOS wallet screens move beyond the plain grouped-list look to a hero wallet card (large avatar, a prominent monospace wallet number with one-tap copy, a live connection dot, and a filled Scan to connect button) and a two-column health grid where each category — Allergies, Medications, Problems, Labs — has its own color instead of one accent everywhere.
History timeline — the wallet now shows a vertical History timeline of past encounters (date · type · provider · summary) built from the record itself.
First-launch onboarding — new patients now see a short intro (your record lives on your device → encrypted on-device → scan to share) before the wallet, instead of being dropped straight in. It shows once and can be skipped.
Light + dark, done properly — a shared theme drives a clean shadowed-card look in light and a frosted glass look in dark, switching automatically with the device appearance. The QR scanner also gets accent-colored corner brackets.

June 22, 2026

Scan to connect from any network

Off-network scanning — a patient can now scan the clinic QR from any network (cellular, different Wi-Fi), not just the same Wi-Fi. The fix is giving the relay a public address:
- npm run docker:tunnel (backend) opens a Dockerized cloudflared tunnel — one command, no install — and the backend auto-discovers its public URL for instant testing. (npm run dev:tunnel does the same without Docker.)
- Deploy configs for Fly.io, Render, and Railway (backend/fly.toml, render.yaml, railway.json) plus a new Deploying the relay guide.
Proxy-aware QR URL — behind a TLS proxy the backend now honors x-forwarded-proto, so the QR carries an https:// (→ wss://) URL that iOS will connect to.
Reliable tunnel handshake — the Cloudflare tunnel now connects over http2 (TCP/443) instead of QUIC (UDP), which is blocked on many networks and previously left the tunnel dead — the QR then pointed at a URL nothing answered, so scans still failed with "must be on the same network". The backend also now waits for the tunnel to be reachable end-to-end before putting its address in the QR, so it never hands out a not-yet-live URL. Wait for the "reachable via Cloudflare tunnel" log line before generating the QR. See Deploying the relay.

QR scan fix & an Apple-Health wallet redesign

Scan to connect now works end-to-end — the QR previously baked in the web app's own API URL (often localhost), so a real phone could never reach the relay and the share silently stalled. It now uses the server-resolved, phone-reachable address. Self-hosters can pin it with the new PUBLIC_RELAY_URL setting (or just open the web app over their LAN IP). See Import from a patient app.
Faster, clearer pairing — the wallet shows a "Connecting to clinic…" state while sharing, and an unreachable clinic now fails fast with a clear message instead of hanging.
Apple-Health-style wallet redesign — the wallet app's iOS screens were rebuilt around a calm, clinical look with full light + dark support: a clean identity card, a connection status pill, and grouped HEALTH RECORD / Settings-style sections. The previously plain-React-Native scan and network sheets are now native @expo/ui (including a SwiftUI text field and a polished camera overlay).

June 21, 2026

QR pairing, a native wallet redesign & zero-config relay

Scan to connect (QR) — the Patients → "Import from a patient app" dialog can now show a QR code; the patient taps Scan to connect in the wallet app and scans it. The QR carries that clinic's own server address, so nothing is typed and it works across per-clinic servers. See Import from a patient app.
No setup for patients — the wallet ships with a built-in default server and a Identity → Network screen to change it; the manual EXPO_PUBLIC_API_URL is now dev-only.
MetaMask-style redesign — the wallet app's screens are rebuilt with native SwiftUI (@expo/ui/swift-ui) on iOS and Jetpack Compose / Material 3 (@expo/ui/jetpack-compose) on Android: an account header with identicon, action buttons, an elevated share-request card, and grouped record sections.

Patient wallet app — a new Expo (SDK 56, @expo/ui) mobile app where a patient stores their record encrypted on their own device. Their identity is an Ed25519 keypair; the public key (base58check, tmw_…) is their wallet number.
Real Signing — Settings → Signing now shows your clinic's actual Ed25519 key and fingerprint, and owners/admins can rotate it. (It was previously a placeholder.) See the Signing & wallet import API.
Import from a patient app — the Patients page can pull a record straight from a patient's wallet: enter their wallet number, they approve on their phone, and the record arrives end-to-end encrypted for review. See Import from a patient app.
Temporary shares — opt to share temporarily (1 hour / 1 day / 7 days); temetro auto-deletes the imported record when the window ends, and the patient can revoke earlier.
Encrypted relay — sharing rides a WalletConnect-style relay over the backend's /wallet socket namespace that only ever forwards ciphertext. Records stay off-device only with consent; this is not a blockchain (which is what lets a temporary share be deleted).

June 20, 2026

Reset by username, system messages & meetings polish

Forgot password by username — the reset page now has Email and Username tabs, so staff who sign in with a username can start a reset too. See Setting up email.
System messages — automated notices (like a forgot-password alert) now stand out with a System badge and shield icon, and are read-only — no reply box, no call button.
Meetings — rooms can now be deleted from the list; the call's control bar is a tidier, slightly larger pill; your tile shows your initials when the camera is off (instead of a black screen).
Email setup guide — a new Setting up email page walks through connecting a provider; the Patient Portal guide was rewritten in plainer language.
Sidebar — username-only accounts now show their @username instead of a synthetic email address.

Email provider & admin-driven password reset

Email provider — set Resend, Postmark, SendGrid or SMTP in Settings → Developers so temetro actually sends verification, password-reset and invitation emails (with a Send test button). New email endpoints.
Forgot password with no provider — instead of a dead end, temetro alerts the clinic admins with a System message card in Messages + a bell notification; opening it jumps to that employee in Care Team, where an admin can set a new password directly (/api/staff/{id}/password).

Patient Portal — new-patient booking & no double-booking

The kiosk's Book flow now offers Returning vs New patient: a first-timer registers (name/sex/age) and gets a file number on the spot, then books. Bookings now reject an already-taken slot. New /api/portal/{clinic}/patients endpoint.

Chat history pill

The in-chat history pill now shows a clear history icon plus a dedicated new chat button; the duplicate chat list was removed from the sidebar.

Patient Portal — self-service kiosk

A brand-new Patient Portal at /portal/{clinic} — a standalone, full-screen kiosk (no sidebar, no login) for a waiting-room iPad. Patients choose Book an appointment or View my results; bookings land on the clinic's Appointments page. Privacy is minimal-by-design (name and file number required; results never show clinical values). New public /api/portal endpoints and a Patient Portal guide.

Tasks, records & chat polish

Assign a task to a specific person — the New task dialog's Assignee control is now Myself / Department / Person, with a provider picker; the task surfaces for that person. New assigneeUserId field on the tasks API.
Records import & export — Settings → Records can now export the whole clinic's patient records to a JSON archive and import one back (with a preview; existing file numbers are skipped). New settings endpoints.
Meetings calendar — past dates are disabled, an Upcoming list sits under the calendar, and empty days show a proper empty state. The Inbox gained a call button next to each conversation that jumps to Meetings with that person preselected.
Call invites now ring for 30 seconds with Accept and a dismiss (×); all toasts got a close button.
Chat — a searchable history panel opens from the top-left of the chat with a Start new chat button (the sidebar's new-chat entry is now Ask temetro). The Veil active chip shows once per conversation, and record cards only offer Click for more when there's actually more to see.

Meetings: invites, scheduling & a Discord-style refresh

Add people to a call — ring a teammate in; they get a toast with Join plus a bell notification. The control bar was redesigned (mic · camera · screen · add people · a separated red leave), tiles show a speaking ring, and the room list shows live occupancy.
Schedule meetings — a new Calendar tab lets you plan a meeting (title, date, time, participants) and see everyone's agenda; days with meetings are dotted. New /api/meetings/events endpoints.

Chat & analysis polish

In-chat patient cards are compact now, with a "Click for more" affordance, instead of large mostly-empty cards.
Source citations are sparse — one chip per record (no more a tag after every word).
The Analysis page defaults to All Time, drops the redundant 12-month range, and the 30-day view renders correctly.

Staff meetings — voice & video calls

Messages now expands to Inbox and Meetings. Meetings are Discord-style voice/video rooms your team can hop into: create a room, join, and you get a tile grid with mic, camera, screen-share and leave controls. Calls are peer-to-peer (WebRTC mesh, up to 4 people) so media never touches the server. New /api/meetings endpoints and call-signaling socket events; see the Meetings guide.

Source citations in the AI chat

When the assistant states something from a record, it now shows an inline citation chip you can hover to see which record it came from, with a Sources footer as a fallback. Powered by a new data-source stream part (see the chat API).

Doctor specialties

Admins can set a clinician's specialty (e.g. Orthopedist, Dentist) in Settings → Care team. A patient's treating clinician's specialty now shows on the patient sheet. New PATCH /api/staff/{userId} and a specialty field on the staff and provider lists.

Fixes & polish

Fixed a clinic onboarding loop where creating a clinic could bounce you back to the onboarding page.
Notifications are now clickable — selecting one jumps to where it happened (the conversation or patient).
A mobile menu button opens the sidebar on phones, and the Analysis page gained an Overview header with a time-range filter and a Customize control.
Redesigned the Messages composer (auto-sizing input; Enter to send, Shift+Enter for a newline).

June 18, 2026

Smarter file import

The AI now normalizes messy exports itself instead of asking you to reformat them: gender words → M/F, IDs like P00001 keep their digits, semicolon/comma lists split into separate allergies/medications/problems, and a visit table becomes encounters. Realistic exports import with nothing skipped.
The import preview gained Review & edit — open any parsed record (including skipped ones) in the full patient form, fix it, and it re-validates instantly before you import. New dry-run endpoint POST /api/ai/import/validate.
The assistant never replies blank anymore — if the model ends on a tool call it now summarizes what it did instead of returning empty.
Proposal cards (Add / Review & add / Import) lock once committed and stay locked after a conversation reload, so the same records can't be added twice.

Integrations: HL7/FHIR, e-prescribing & insurance claims

New Settings → Integrations tab connects temetro to external systems with real, standards-compliant clients: HL7/FHIR lab results, e-prescribing (NCPDP SCRIPT), and insurance claims (X12 837/835). Point each at your own sandbox or production endpoint and supply credentials (encrypted at rest).
On-page actions appear once an integration is enabled: a Sync results card on the Lab page, Send to pharmacy on the prescription sheet, and Submit claim on the invoice sheet. New /api/integrations endpoints.

File attachments on the chart

Upload patient files from the patient Add/Edit dialog and analysis files from the Lab "add result" dialog. The patient sheet now has a Files section that previews images inline and downloads other types. Files persist on the server. New /api/attachments endpoints.

Record graph redesign

The patient record graph is now an Obsidian-style view (round nodes, hover-focus highlighting) that pops out into a full dialog from the patient sheet, which also lists the patient's records as clickable entries that open in a dialog.

AI proposal cards: edit before adding

When the assistant proposes records (e.g. an imported inventory or appointment batch), you can now edit them — whole or item-by-item — before approving, and the cards render dense item lists as a tidy, scrollable list instead of a wall of text.

AI assistant: clearer clinic-wide kill-switch

The Settings → AI → Availability master switch now clearly disables AI for everyone, including owners and admins, and hides every AI surface (New chat, Analysis, chat history) and blocks their routes. A separate toggle keeps the older employees-only restriction.

Fixes

The Care team member dialog now shows the Lab results permission row with its icon (it previously rendered a raw key).

June 17, 2026

Patients: record graph, fuller chart, delete

A patient's chart now opens a Record graph — an Obsidian-style view linking the patient's problems (illnesses) to their visits, draggable and zoomable. The same graph powers the new chat Graph mode (below).
The patient sheet now aggregates the patient's appointments, prescriptions and invoices alongside the clinical record, for a 360° view.
Charts can be deleted (owner / admin) via the patient sheet, with confirmation. New endpoint: DELETE /api/patients/{fileNumber} (already shipped) plus DELETE /api/patients/{fileNumber}/labs to remove a single result. See the patients API.

AI chat: situation modes

The composer's model picker is replaced by Chat / Analysis / Graph modes — clinicians pick what they want, not which LLM runs (the model is set in Settings → AI). Analysis steers the assistant toward interpreting patterns; Graph renders the record graph for a patient.

Billing: invoice payments

Invoices gained a Mark paid action and per-installment Pay buttons with Paid / Overdue badges; the installment plan now shows its due-through timeframe and is hidden once an invoice is settled.

Deleting records everywhere

Every page that adds items can now delete them too, each behind a confirmation: lab results, dispense records (DELETE /api/dispenses/{id}), prescriptions, inventory items and tasks (appointments and notes already had it).

Messages

Fixed file attachments silently failing (and the missing attachment chip); shared appointments are now clickable, opening a detail dialog for both sender and recipient.

Analysis

The realtime Live card is replaced by a Patient visits area chart over the last six months.

June 16, 2026

Pharmacy: dispensing ledger + clickable stock

The pharmacy dispensing queue now records each fulfilment: pressing Dispense writes a dispense (who received which medication, by whom, when) and a new Recently dispensed feed lists them. See the Pharmacy guide and the new dispenses API.
Inventory rows are clickable — open an item to see stock, reorder level, location, expiry and notes. The "expiring soon" badge now flags only courses with ≤2 days left (it previously fired on nearly every freshly-issued short course).

Prescriptions: inventory link, dates, keyboard nav

The New prescription dialog suggests medications from your inventory as you type (free text still works when there's no match), supports arrow-key + Enter navigation in the patient search, and can record optional start / end dates behind an Add dates toggle. When set, the end date drives expiry instead of the duration text. Prescriptions gained startDate / endDate — see the prescriptions API and Prescriptions guide.

Lab: work-queue detail

The Lab work queue rows now expand to show the full task — notes, status, patient, assignee and creator — alongside the complete button. See the Tasks guide.

Smaller fixes

The AI chat appointment results are now a condensed card with a View in calendar link (instead of one dense row per appointment), the composer reads as a lighter, clearly-bordered box, and attaching a file works with or without text.
Tasks gained a top-level New task button; the sidebar now scrolls as one when the navigation grows tall.

June 15, 2026

Tasks are a kanban board

The Tasks page is now a To Do / In Progress / Done board. Drag cards between columns (or use Move to in a task's details), add tasks straight into a column, and see due date + priority at a glance. Tasks gained a status field — see the Tasks guide and tasks API.

Turn the AI on or off

Owners/admins get an Availability switch under Settings → AI: disable the assistant clinic-wide, or only for employees (owners/admins keep access). When off, the AI page and sidebar entry disappear and the chat endpoint is blocked — enforced on the server. See the Settings guide and AI policy API.

Stock inventory with the AI

Hand the chat a medications/stock list and ask it to add to inventory — it parses the items and shows an approval card; on Add they're saved to your inventory (distinct from invoicing a patient). See The chat.

Files in messages and chat

Messages now support attachments: the + button shares files (up to 10MB) and appointments (as a snapshot card). See the Messages guide.
In the AI chat, uploaded files render as attachment chips instead of raw pasted text, and you can attach a file even when the box already has text. The Chain-of-Thought trace now stays collapsed by default.

June 14, 2026

The AI can see the whole clinic

Ask the assistant about your clinic ("what's my clinic called?"), your analytics and earnings ("how much have we billed this month?"), or your inventory ("what's low in stock?") — it renders clinic, analytics (with an earnings chart), and inventory cards, not just patient charts. See The chat.
Invoice from a file. Hand the AI a list of purchased medications/items and it drafts an invoice (line items) for your approval instead of typing it in. The client is created as a patient (with a file number) if they aren't one yet.

Earnings on the Analysis page

A new Earnings section shows billed / paid / outstanding and a billed-vs-paid by month chart, computed from your invoices.

Live card shows real data

The Live card now plots a real signal — patients checked in today — and the axis labels and value pill stay inside the card.

Chat history (Claude-style)

Conversations are saved: past chats appear in the sidebar, click to reopen one exactly as it was, and New chat starts fresh. (Saved chats include the record cards shown in them, stored within your clinic's access scope.)

Invoices

New Invoices page (under Patients). Create invoices with inline line items and a live total, set issue/due dates and a status, split a bill into equal monthly installments, and Download PDF (a clean, print-styled copy via your browser's "Save as PDF" — no extra software). Backed by a new org-scoped invoices API. See the Invoices guide.
Billing access goes to clinicians and reception (front-desk billing); pharmacy and lab have none. See Roles & permissions.

AI-added records save instead of stalling

The chat no longer refuses incomplete data. Imports and proposals with gaps now save with safe placeholders, a missing file number is auto-assigned, and the record is tagged Added by AI so you can review and complete it on the Patients, Appointments, Prescriptions, or Invoices pages. Only rows with no usable identity (or a duplicate file number) are skipped. See Migrating from another system.
Importing appointments now creates patients. When you import a schedule for people who aren't in the system yet, each gets a patient record with a file number (deduped by name) so they appear on the Patients page — appointments are no longer left unlinked.

Appointments: edit from the schedule

Click any appointment to open a detail panel and edit its date, time, type, provider, or status — or delete it. The New appointment dialog's patient search and provider field are now searchable, keyboard-navigable pickers (arrow keys + Enter). See the Appointments guide.

Chat: more like a real assistant

Each tool the agent runs shows as a collapsible tool card; a reasoning block surfaces the model's thinking when available; the empty chat offers suggestion chips; and messages sent while the agent is busy now queue and send automatically when it's free. See The chat.
Bulk approval. When the agent proposes many records at once (e.g. an imported file), they're collapsed into one approval — Review & add opens a dialog listing every record (remove any you don't want) and Add all commits them together.

Fixes

Analysis page: chart axis labels no longer spill outside their cards, the patient-growth chart labels every month, and the Live card only streams after you press Go live (it's idle by default). The live value pill stays inside the card.
Chat: the error banner can now be dismissed, the import preview no longer balloons when many rows have issues, and the input toolbar (attach, add-patient, model picker, mic, send) no longer gets clipped on the empty chat screen.

Guide: migrating from another system

New migration guide. A dedicated Migrating from another system page walks through moving your patients off an existing EHR: export a CSV/JSON, attach it in the chat, and the agent maps and validates it into a preview you approve before anything is written. Includes export tips for Epic, Oracle Health (Cerner), athenahealth, eClinicalWorks, NextGen, Practice Fusion, DrChrono, and OpenEMR, plus the 500-records-per-import limit and privacy notes (run a local model to keep bulk loads on your own infrastructure).
Clearer chat prompt. The chat input placeholder now reads "Ask anything, or type /patient 10293" — reflecting that the agent does far more than patient lookups.

June 13, 2026

The chat can act — and it feels alive

Live "thinking". Sending a message now shows a Thinking… indicator and a Chain-of-Thought step trace as the agent works — so you can see it looking up a patient, searching, or validating records, even on cloud providers where the prose arrives all at once.
Inline Veil confirmation. The first send to an external provider no longer pops a modal. A compact, inline Veil confirmation appears above the input (with Use local model as an option) and asks only once per session.
Add by chat — with approval. The agent can now add appointments, tasks, and prescriptions, and add/migrate patients. Each add is proposed as a one-click approval card; nothing is written until you click Add, and the action still respects your role's permissions. The agent only displays and adds — it never edits, deletes, or changes the database structure.
Display anything. Ask to see the schedule, open tasks, or prescriptions and the agent renders them as list cards.

Pharmacy: add inventory items

The Inventory page now has an Add item button that opens a dialog to add a medication (name, form, strength, stock, reorder point, location, expiry). New items appear in the list immediately.

The AI chat is live

Real AI chat. Free-form messages now run a tool-using agent that looks up records and answers with record cards and lab charts (with a high/low flag in the card's top-right corner), not just text. The /patient <fileNumber> shortcut still works instantly. New APIs: /api/chat and /api/ai.
Bring your own model. Connect an OpenAI, Anthropic, or Gemini API key, or run a local model with Ollama — all under the new Settings → AI tab. Keys are encrypted at rest and never shown again.
Veil — PHI safeguards. On cloud providers, Veil de-identifies patient identifiers (names, MRNs, providers) to tokens before anything leaves your infrastructure, then restores them in the answer. Local Ollama keeps all data in the clinic. Every external request is audited.
Database import with approval. Attach an existing patient-database export and the agent maps it to temetro's shape, shows a preview, and writes only after you approve it.

Cleaner chat input

The chat input's five clinical dropdowns are replaced by a single model + effort picker; AI configuration moved to Settings → AI.

Zero-setup Docker & reliability

docker compose up now works with no setup — the backend generates and persists its secret keys on first start (stored in a Docker volume, stable across restarts). No more hand-editing .env or running openssl.
The chat uses whichever provider you've configured, even if the model picker shows a different one, so a single saved key just works.
AI failures now show a clear alert (banner + toast) instead of silently doing nothing.
Model list refreshed to current IDs (e.g. Gemini 2.5 Pro/Flash).

June 12, 2026

Pharmacy inventory

New Inventory page under Pharmacy — search the clinic's medication stock and check availability at a glance (in stock / low / out, derived from a per-item reorder threshold). The Pharmacy sidebar entry now expands into Pharmacy (dispensing queue) and Inventory.
New API: /api/inventory — org-scoped CRUD for stock items. Pharmacy and full clinicians can edit it; reception and lab have no access.

Pharmacy: the Expiring badge now appears only for courses ending within the next 7 days — previously it showed for courses that had already elapsed.
Lab — Add analysis result: the patient picker no longer lists patients until you type, and supports arrow-key + Enter selection. The test field offers a catalog of common analyses (with an Advanced option for custom analyses and a reference range), and submitted results now appear immediately in a new Recent results feed instead of requiring a refresh.
Analysis: added a Live panel (real-time line chart of patients in the building) and replaced the flat trend sparklines with area and bar charts.

June 11, 2026

Department roles: Pharmacy & Lab

New Pharmacy role — read patients and appointments, review and update prescriptions (mark courses completed), but never prescribe or delete. Pharmacy members land on a new Pharmacy dashboard: stat cards (active prescriptions, expiring within 7 days, patients on medication) over a searchable dispensing queue.
New Lab role — its own task queue plus the ability to submit analysis results to a patient's record through a dedicated lab permission, without patient-edit rights. Lab members land on a new Lab dashboard with an "Add result" flow.
New API endpoint: POST /api/patients/{fileNumber}/labs appends lab results without replacing the rest of the record.
Tasks can now be assigned to five departments: Admin, Doctor, Reception, Pharmacy, and Lab.
Removed the read-only Viewer role. Members who held it were migrated to Member automatically.

Improvements

Messages — avatars and numeric unread badges in the inbox, day separators (Today / Yesterday / date) and grouped consecutive messages in threads, and a "Start a conversation" button on the empty state.
Tasks — the New Task dialog's assignee picker is now a proper tab control (Myself / Other) with the department select inside the "Other" tab.

Earlier changes predate this changelog; see the git history for the full record.