System Overview
TENSOR Med is a longitudinal treatment management platform
that generates Living Reports: versioned, event-driven clinical summaries
synthesised from patient encounter data, laboratory results, treatments, and validated outcome scores.
The platform is clinical decision support, not a medical device under FDA 21 CFR 820
or EU MDR 2017/745 — all outputs are advisory, and every safety gate captures a documented override
rather than refusing the clinical action.
Six rheumatology diseases are supported: Axial Spondyloarthritis (axSpA),
Rheumatoid Arthritis (RA), Psoriatic Arthritis (PsA),
Gout, Systemic Lupus Erythematosus (SLE), and
Giant Cell Arteritis / Polymyalgia Rheumatica (GCA/PMR). The system encodes
disease-specific guidelines, drug profiles, validated calculators, and clinical trial evidence
to support treatment decisions across the full escalation pathway for each condition.
Four-layer architecture
Each patient view is organised into four layers of increasing depth — from the instant clinical
overview clinicians rely on at point of care, to AI synthesis, to raw data, to source documents.
1
Deterministic Dashboard
Instant, no AI required
Latency: < 200ms
- ASDAS, BASDAI, BASFI, BASMI scores
- Disease activity trends over time
- Treat-to-Target status tracking
- Action items and monitoring alerts
- Safety flags and drug interactions
- Treatment timeline
2
AI Agent Analysis
4 specialist agents + discussion
Latency: ~30-60 seconds
- Clinical trajectory analysis
- Guideline compliance assessment
- Literature and trial matching
- Safety and interaction review
- Cross-agent structured discussion
- Consensus next-steps recommendation
3
Raw Data Tables
Complete patient record
Source data, sortable
- Encounter history and notes
- Lab results with reference ranges
- Treatment records and dosing
- Symptom and PRO scores
- Imaging scores (mSASSS, SPARCC, SIJ grades)
- Event audit trail
4
Source Documents
Every paper, guideline, and label the AI had access to
Corpus-browsable, PMID-indexed
- Knowledge corpus (RCTs, guidelines, drug labels, NICE TAs)
- Per-citation drill-down (PMID, effect, confidence)
- Uploaded patient documents (originals, de-identified)
- Import summary — what was imported / what was dropped
- Search and filter by source type
Data Injection
→
Dashboard Refresh
→
30s Debounce
→
Report Generation
→
Living Report v(N+1)
Living Reports
Living Reports are versioned clinical documents that evolve with each data injection.
When new encounters, labs, treatments, or symptoms are added, the system automatically queues a
report regeneration after a 30-second debounce window (to batch rapid sequential inputs).
Each version is immutable once generated. The report includes a deterministic dashboard section
(scores, trends, action items) and an AI analysis section (4-agent synthesis with
structured discussion). All updates are automatic — no manual intervention required.
Approximate cost: $2–$5 per report regeneration against a rich
longitudinal patient record (4 analyst calls + discussion synthesis). Cost scales with
context depth — fresh new-patient reports trend cheaper, regenerations on accumulated
state are pricier. Checked against a per-practice ceiling on every run and logged with
each report version.
De-identification
All patient data is de-identified before AI processing using the HIPAA Safe Harbor
method. Agents receive age, sex, relative dates (e.g. "Day 0", "Month 6"), and clinical values
only — never names, dates of birth, identifiers, or addresses. The de-identification layer sits
between the data store and the AI pipeline, ensuring that no PII leaves the practice boundary
except in de-identified form.
Encoded Guidelines
The knowledge bank encodes the following clinical practice guidelines as structured decision logic,
enabling rule-based compliance checking and AI-informed escalation recommendations.
Drug Profiles
21 drugs across 5 therapeutic classes are profiled with dosing, contraindications, monitoring
requirements, and evidence strength. The system uses these profiles for safety checks,
drug interaction analysis, and escalation logic.
| Class |
Drug |
Route |
Key Monitoring |
| NSAID |
Naproxen |
Oral |
GI, renal, CV risk |
| NSAID |
Ibuprofen |
Oral |
GI, renal, CV risk |
| NSAID |
Diclofenac |
Oral |
GI, renal, CV risk (highest) |
| NSAID |
Etoricoxib |
Oral |
CV risk, BP monitoring |
| NSAID |
Celecoxib |
Oral |
CV risk, sulfa allergy |
| csDMARD |
Sulfasalazine |
Oral |
FBC, LFTs, peripheral arthritis only |
| TNFi |
Adalimumab |
SC |
TB screen, infections, LFTs |
| TNFi |
Etanercept |
SC |
TB screen, infections (not IBD) |
| TNFi |
Infliximab |
IV |
TB screen, infusion reactions, LFTs |
| TNFi |
Golimumab |
SC |
TB screen, infections, LFTs |
| TNFi |
Certolizumab pegol |
SC |
TB screen, pregnancy-compatible |
| IL-17i |
Secukinumab |
SC |
TB screen, candidiasis, not with IBD |
| IL-17i |
Ixekizumab |
SC |
TB screen, candidiasis, not with IBD |
| IL-17i |
Bimekizumab |
SC |
TB screen, oral candidiasis (higher rate) |
| JAKi |
Tofacitinib |
Oral |
FBC, lipids, VTE risk, age >65 caution |
| JAKi |
Upadacitinib |
Oral |
FBC, lipids, LFTs, VTE risk |
| JAKi |
Filgotinib |
Oral |
FBC, lipids, male fertility monitoring |
Note: 4 additional NSAIDs/analgesics (indomethacin, meloxicam, piroxicam, ketoprofen)
are available in some configurations, bringing the total to 21 profiled drugs.
Treatment Algorithm
The ASAS/EULAR 2023 escalation pathway encoded in the system follows a 4-step ladder.
Escalation is triggered when a treatment fails to achieve the target (ASDAS < 2.1 or
clinically significant improvement) after an adequate trial period.
01
NSAIDs
First-line. Try at least 2 NSAIDs at full dose for 2-4 weeks each.
Continuous preferred over on-demand if active disease.
02
TNF Inhibitor
First biologic after NSAID failure. ASDAS >= 2.1 required.
Assess response at 12 weeks. Consider switching mechanism on failure.
03
IL-17 Inhibitor
After TNFi failure or if TNFi contraindicated. Preferred if
concomitant psoriasis. Avoid if active IBD.
04
JAK Inhibitor
After biologic failure or oral route preferred. Requires VTE/MACE risk assessment.
Age >65 or CV risk: additional caution per EMA/FDA guidance.
Sulfasalazine is considered only for predominantly peripheral disease, not axial.
It is not part of the core axial escalation pathway.
Validated Calculators
The following validated disease activity and functional indices are computed deterministically
from patient data. All are auto-calculated when sufficient input values are available.
ASDAS-CRP
Ankylosing Spondylitis Disease Activity Score (CRP-based)
ASDAS-ESR
Ankylosing Spondylitis Disease Activity Score (ESR-based)
BASDAI
Bath Ankylosing Spondylitis Disease Activity Index
6 questions (0-10 VAS), range 0-10. BASDAI ≥ 4 is widely used as an eligibility criterion for biologic initiation. ASDAS is preferred by ASAS/EULAR as the primary composite measure for treat-to-target.
BASFI
Bath Ankylosing Spondylitis Functional Index
10 questions (0-10 VAS), range 0-10. Measures functional limitation in daily activities.
BASMI
Bath Ankylosing Spondylitis Metrology Index
5 spinal mobility measurements (tragus-to-wall, lumbar flexion, cervical rotation, lumbar side flexion, intermalleolar distance), range 0-10.
Clinical Trials Cited
The knowledge bank indexes 262+ papers across ~1,027 retrievable chunks:
randomized controlled trials, published guidelines (ASAS/EULAR, BSR/BHPR, ACR/SAA/SPARTAN,
NICE Technology Appraisals), drug labels (EMA / FDA prescribing information), and safety
monographs. The Literature Analyst agent performs deterministic chunk-level retrieval — it
can only cite chunk_ids that appear in the patient-specific retrieval block, and every
citation is verified post-hoc by the citation verifier (F1–F7 tiered failure matrix).
The highlighted trials below are the pivotal studies surfaced most often by the matcher.
Knowledge version: v1.3.0-axSpA
Supported Formats
TENSOR Med accepts clinical data in four standard formats. Each is parsed,
validated, and normalized before being committed to the patient record.
Import Workflow
Data import follows a 3-step process to prevent errors and ensure data quality.
01
Upload
Select file(s) and optional data type. The parser identifies the format,
extracts records, and maps fields to the internal schema.
02
Preview
Review parsed record counts, patient groupings, and any parsing errors
before committing. Duplicate detection runs automatically.
03
Confirm
Commit records to the database. Living Reports queue for regeneration
(30s debounce). Audit log entries created for each import.
Date Format Handling
The import pipeline auto-detects and normalizes date formats across international conventions.
All dates are stored internally as ISO 8601 (YYYY-MM-DD).
| Format |
Pattern |
Example |
Locale |
| ISO 8601 |
YYYY-MM-DD |
2024-03-15 |
International standard |
| European |
DD/MM/YYYY |
15/03/2024 |
UK, EU, most of world |
| US |
MM/DD/YYYY |
03/15/2024 |
United States |
| German |
DD.MM.YYYY |
15.03.2024 |
Germany, Austria, Switzerland |
Lab Normalization
Lab results are normalized to a common coding system for consistent interpretation
across different source systems.
- LOINC Mapping
- Lab codes are mapped to LOINC identifiers for standardized reference ranges and interpretation thresholds.
- NHS Read Codes
- Read v2 and CTV3 codes from UK GP systems are mapped to SNOMED-CT equivalents.
- Unit Conversion
- Common unit conversions are handled automatically (e.g. mg/L to mg/dL for CRP, mm/hr standardization for ESR).
- NHS Number Support
- 10-digit NHS Numbers are recognized and validated (Modulus 11 check) during import for patient matching.
Phase 1: Parallel Analysis
Four specialist agents analyze the de-identified patient record simultaneously, each through
a distinct clinical lens. All agents run in parallel for a total latency of approximately
30-60 seconds. Temperature is set to 0.0 for deterministic, reproducible output.
Clinical Analyst
Treatment Response & Disease Trajectory
Evaluates how the patient has responded to each treatment over time. Identifies temporal
patterns in disease activity, correlates treatment changes with ASDAS/BASDAI shifts, and
assesses whether the current trajectory is toward target or diverging.
treatment response
temporal patterns
trajectory analysis
T2T assessment
Guideline Analyst
ASAS/EULAR Compliance & Escalation Logic
Checks the patient's current treatment against the ASAS/EULAR algorithm position.
Identifies whether escalation criteria are met, flags deviations from guideline
recommendations, and maps the patient to the correct step in the treatment ladder.
guideline compliance
algorithm position
escalation criteria
ASAS/EULAR
Literature Analyst
Evidence Matching & Trial Relevance
Matches the patient's clinical profile (disease subtype, prior treatments, comorbidities,
demographics) against the encoded trial database to identify the most relevant evidence.
Highlights applicable ASAS20/40 response rates and NNT data from matching trials.
evidence matching
trial relevance
PubMed references
NNT data
Safety Analyst
Drug Interactions, Monitoring & Contraindications
Reviews the patient's current and proposed medications for interactions, contraindications,
and monitoring gaps. Checks lab monitoring schedules (FBC, LFTs, lipids, TB screening),
flags overdue tests, and identifies risk factors for specific drug classes (VTE, MACE, infections).
drug interactions
monitoring gaps
contraindications
risk assessment
Phase 2: Structured Discussion
Next-Steps Consensus
After Phase 1, the four agent analyses are combined into a structured discussion round.
Each agent's findings are presented to a synthesis pass that evaluates areas of agreement
and disagreement, then produces a consensus recommendation for next steps.
Consensus threshold: 3 out of 4 agents must agree on the recommended
next action for it to be presented as a primary recommendation. If agreement is lower,
the report presents the options with each agent's rationale and highlights the disagreement.
Disagreement tracking: The system records an agreement score (0-1),
confidence spread across agents, and preserves dissenting views in the report for
clinician review.
Enriched Clinical Context
Agents receive a structured patient brief far richer than the raw EHR extract. Before the
first prompt fires, the server assembles the following blocks (each generated
deterministically from the patient record, so the same patient always produces the same
context and the same citations):
- Prior recommendation action log — for every previous report
version, whether the clinician accepted / modified / rejected each recommendation, with
reason text. The moderator prompt mandates that new reports explicitly
reiterate, revise, or depart from the prior position rather
than silently repeating it.
- Lab trends (computed) — rate of change, direction (rising / falling
/ stable), and latest vs previous values for every longitudinal analyte, pre-computed
so the agent sees a trajectory rather than a raw time series.
- Data freshness signals — per-metric staleness: FRESH / AGING /
OVERDUE against recommended cadences, so agents can propose the right workup
(e.g. "ASDAS-CRP last measured 277 days ago — OVERDUE").
- Symptoms by resolution status — active persistent (≥3 weeks),
active recent (<3 weeks), and resolved, so chronic disease activity is distinguished
from acute post-visit complaints.
- Clinician-acknowledged advisories — safety flags the clinician has
already counselled on (e.g. "JAKi CV risk, dismissed — patient fully counselled"), so
agents don't re-raise resolved concerns.
- Current-encounter header — visit type (routine / urgent / transfer
of care) and gap since last rheumatology visit.
- Therapeutic drug monitoring — TDM labs (trough levels, anti-drug
antibody titres) segregated from general labs with target-range annotations.
- Reproductive status — pregnancy intent, contraception state, LMP,
last β-hCG, breastfeeding status (critical for teratogen prescribing decisions).
- Coverage / funding constraints — NICE Technology Appraisal number,
BlueTeq status, prior-auth state. Agents won't recommend therapies that are
un-fundable for this patient.
- Biosimilar brand differentiation — Humira vs Amjevita vs Hulio are
distinguished (originator vs biosimilar, prior switches annotated), since
immunogenicity and cost profiles legitimately differ.
Reproducibility & Audit Trail
Every generated report persists a frozen copy of the exact prompt context the agents saw
(prompt_snapshot, capped at 512 KB) alongside the model
identifier, knowledge-bank version, and the patient-data hash used as the idempotency
key. This makes every conclusion reproducible months later — a regulator or clinician can
replay the run, inspect what the agents knew, and verify that a given recommendation
was appropriate at the time it was made.
Document ingestion is traceable end-to-end: the History tab renders each uploaded
document side-by-side with its machine-readable extract — original PDF / HL7 / FHIR /
C-CDA on the right, structured text on the left. Clinicians can inspect exactly what the
system parsed from any document without leaving the patient view. PDFs are served over
short-lived HMAC-signed URL tokens (5-minute TTL) — every view is audit-logged as a
data_read event.
Agent Configuration
| Parameter |
Value |
Rationale |
| Model |
claude-sonnet-4-5-20250929 |
Balanced capability, cost, and speed for clinical analysis |
| Temperature |
0.0 |
Deterministic output for reproducibility and audit |
| Parallel execution |
4 agents simultaneously |
Minimizes wall-clock time (30-60s total vs 2-4 min sequential) |
| Max tokens per agent |
~4,000 |
Sufficient for detailed analysis without runaway cost |
| Cost per report |
$0.25 - $0.40 |
4 analyst calls + 1 discussion synthesis |
De-identification for AI
Agents operate on de-identified data only. The following transformations are applied before
any patient data is sent to the AI model:
- Retained (de-identified)
- Age (at encounter), sex, clinical values (ASDAS, CRP, ESR), treatment names and doses, symptom scores, imaging results, HLA-B27 status, disease subtype
- Transformed
- All absolute dates converted to relative dates (Day 0, Month 3, etc. from first encounter)
- Stripped entirely
- Patient name, date of birth, medical record number, NHS number, address, phone, email, SSN, and all other HIPAA Safe Harbor identifiers
HIPAA Safe Harbor Compliance
TENSOR Med implements the HIPAA Safe Harbor de-identification method
(45 CFR 164.514(b)(2)), stripping all 18 categories of identifiers before any data
is transmitted to the AI processing pipeline.
18 Identifier Categories Stripped
Names
Dates (except year)
Telephone numbers
Geographic data
FAX numbers
Social Security numbers
Email addresses
Medical record numbers
Health plan beneficiary #
Account numbers
Certificate/license #
Vehicle identifiers
Device identifiers
Web URLs
IP addresses
Biometric identifiers
Full-face photographs
Any other unique ID
Access Control
Role-Based Access
- Owner: Full access, manage team members, delete data
- Admin: Read/write all patients, manage imports, generate reports
- Member: Read/write assigned patients only, no team management
Authentication
- Supabase Auth with JWT bearer tokens
- Token refresh handled automatically
- Session timeout after inactivity
- Password requirements enforced at auth layer
Audit Logging
- All data access events logged with timestamp and user ID
- Data modifications tracked with before/after state
- Report generation events recorded with trigger source
- Import operations logged with file metadata and record counts
Data Storage
- Supabase (PostgreSQL) with Row Level Security (RLS)
- RLS policies enforce practice-level data isolation
- No cross-practice data access possible at DB level
- Encrypted at rest and in transit (TLS 1.2+)
Rate Limiting
API rate limits are applied per practice to prevent abuse and ensure fair resource allocation.
| Endpoint Category |
Rate Limit |
Window |
| Read operations (GET) |
300 requests |
per minute |
| Write operations (POST/PUT) |
60 requests |
per minute |
| Report generation (AI) |
10 requests |
per minute |
| Batch import |
5 requests |
per minute |
Data Flow
Patient data remains within the practice's Supabase instance at all times. The only external
data transmission is the de-identified clinical payload sent to the Anthropic Claude API for
AI analysis. No patient-identifiable data leaves the system boundary.
Practice Data
→
Supabase (encrypted)
→
De-identification Layer
→
Claude API (de-identified only)
→
Report stored in Supabase