Roadmap & status

temetro is open source and in beta: under active development, and usable today. (The companion patient wallet app is a separate, earlier alpha.) This page is the honest summary of where things stand.

What works today

Mobile apps

Native clinician apps are in the works alongside the web app:

Both will talk to the same backend API as the web app. A first version of the patient companion app (a wallet for approving record shares) is now built — see below.

The AI chat is now live: free-form messages run a tool-using agent that looks up records and replies with cards and lab charts. You bring your own model — an OpenAI, Anthropic, or Gemini API key, or a local Ollama model — configured under Settings → AI. Patient data is protected by Veil (de-identification before any external call) and an approval gate for writes. See AI setup & safeguards.

In progress / planned

Deeper AI workflows

The agent reads records, charts labs, and imports databases today. Planned next: richer clinical reasoning, summarization across encounters, and tighter free-text PHI scrubbing in Veil.

Ambient visit documentation (AI scribe). ✅ First version shipped. The 2026 standard set by tools like Abridge, Nabla, Suki and Ambience is ambient note-taking — listen to the clinician↔patient conversation and draft a structured note automatically. temetro now does this: record or paste a visit, it transcribes and drafts a SOAP encounter note, and the clinician reviews it before it is saved (the same write-approval gate as the chat). The draft is de-identified through Veil before any external call; it uses your own model, a model-agnostic, self-hostable alternative to the cloud-only scribes. Next: local (Ollama) audio transcription and tighter free-text PHI scrubbing.

Patient-owned records & signing

The defining long-term vision (explained in Core concepts):

• Records stored on the patient's own device, not only in the clinic database. ✅ The patient wallet app stores the record encrypted on the phone.

• A patient companion app for reviewing and approving shares. ✅ A first version exists (Expo, @expo/ui).

• Clinic identity cryptographically signed, blockchain-style. ✅ Each clinic has a real Ed25519 signing key (Settings → Signing); shared bundles are signed + verified.

• Patient-approved sharing. ✅ Import from a patient app relays an encrypted request to the wallet, the patient approves on their phone, and a temporary share auto-deletes from the clinic afterward.

• Clinic → wallet update push. ✅ A clinician can push an updated record to a wallet-linked patient; it is signed with the clinic key and sealed to the wallet, lands in a pending-updates inbox in the app (delivered live or on next connect), and replaces the on-device record only after the patient approves it. The push carries the record plus the patient's appointments, invoices, prescriptions and documents. See Pushing updates to a wallet.

• Documents in the patient's hands. ✅ Files a clinic attaches to the chart open in the wallet app on demand (fetched over the relay, then cached encrypted on the phone so they work offline), and patients can photograph their own paperwork to keep alongside them — device-only, never uploaded.

• A dedicated relay to the wallet. ✅ Clinic↔wallet messages now travel over Temetro Network, a standalone, always-on relay (Rust + Axum) that replaces the old ephemeral tunnel. It forwards only ciphertext and keeps no database.

• Multi-clinic, no shared secret. ✅ One relay serves any number of self-hosted clinics. Each authenticates with its own signing key (not a shared token) and the relay keeps clinics' traffic isolated. A clinic opts in via Join Temetro Network (Settings → Signing). Legitimacy is anchored where it belongs — the patient approving signed records on their phone.

QR "scan to connect" pairing now works too — the patient scans the clinic's QR in the wallet app to approve a share without typing anything. What's still ahead: in-app record editing and cryptographic time-boxing of temporary shares. Accountability in the clinic is also backed by the activity log.

Hospital ledger (blockchain)

A future, hospital-side blockchain-style ledger: every clinical change hash-chained to the previous one and signed by the clinic, so the hospital's own record history is tamper-evident and verifiable end-to-end. This is the on-prem counterpart to — and a stepping stone toward — the patient-owned signing above. Today it's approximated by the plain activity log; the chained-and-signed version is planned.

Email verification enforcement

Verification emails are already sent (and the /verify-email page exists), but sign-in currently does not require a verified address. Enforcement is wired and can be switched on; it will be enabled by default once email delivery setup is documented for production.

Catching up with established EHRs

temetro focuses on the AI-chat + patient-owned-records core first. Features that established clinic systems offer and temetro doesn't yet — all planned for later:

How temetro compares

temetro sits at the intersection of two markets, and borrows the best of both:

• Open-source EHRs — OpenEMR (ONC-certified, mature billing/scheduling, the largest install base), OpenMRS (a flexible "concept dictionary" data model + strong FHIR APIs), Bahmni (a full hospital information system on top of OpenMRS), and Medplum (a FHIR-native developer platform). These are deep and battle-tested, but none is built AI-first, and most are heavier to run and extend.
• Ambient AI scribes — Abridge, Nabla, Suki, Ambience. These lead on turning a visit conversation into a note, but they are cloud-only, closed, and bolt onto an existing EHR rather than being one.

Where temetro is different: an AI middleman over the record (chat that retrieves and organizes data, with a write-approval gate) that is open source, self-hostable, and model-agnostic (bring your own OpenAI/Anthropic/Gemini key or a local Ollama model), aimed at the patient-owned-records vision no incumbent offers. The honest trade-off today is maturity: the platforms above have years of certification and edge-case coverage temetro is still building toward (see the table above).

Contributing

temetro is open source — if any of the above sounds like something you'd like to help build, see the contributing guide. Patient-facing telehealth and write support for the FHIR API are particularly good places to start.