Kno|bility

Patient records with the patient's consent. Care knowledge without the patient.

Kno | bility does two separate jobs. Practitioners find a patient in a connected EHR and read their C-CDA once the patient approves. Separately, de-identified case knowledge is shared and peer-reviewed across the network. The two never mix: nothing identified is ever published.

Sign inCreate an accountRead the guide

Records exchange

Identified. Needs an account. Lives only in the practitioner's session.

  • Practitioners register with an NPI that is checked against the provider registry.
  • Patients register by matching their name, birth date and MRN to their EHR record.
  • A practitioner can search an EHR only if that EHR lists them on its roster.
  • The patient approves access, and decides whether a copy may be kept afterwards.
  • Signing out deletes everything the patient did not allow to be kept.

Knowledgebase

Anonymous. Patients can read it without an account.

  • Case notes are de-identified inside the organization that wrote them.
  • Only cohort-level insights are published, each with stated limitations.
  • Credentialed peers endorse or challenge every insight.
  • Consults return safety signals that cite the insights behind them, or say nothing is known.
  • Read it as a patient
Care insights
24
Peer reviews
45
Contributing nodes
8
Verified contributors
10

The knowledgebase in five principles

Decentralized

Every participating organization runs its own node. Case notes are read, parsed and stripped of identifiers where they already live. Nothing identified is ever sent anywhere, because there is no central store to send it to.

Fully anonymous

The unit of storage is an insight, not a person. There is no patient entity in the knowledgebase and no lookup table behind the case references. Cohorts are checked for re-identification risk before they can be published at all.

Peer-reviewed

Credentialed clinicians endorse, refine or challenge every contribution. Consensus is scored and shown. Contested insights stay visible and stay marked contested, because hiding disagreement is how a knowledgebase rots.

Real-world, real-time

Not a textbook. What was actually done, in how many cases, across how many organizations, and what followed. Each insight carries its own stated limitations.

For practitioners and patients

Clinicians describe the case in front of them and get ranked reference with safety signals that cite their sources. Patients read the same knowledge in plain language, without an account, and leave with better questions.

Knowledgebase: where the de-identification boundary sits

Everything to the left of the dashed line stays inside the organization that produced it. Only what is to the right of it exists on the network.

INSIDE THE NODE - IDENTIFIED DATA NEVER LEAVESNODE BOUNDARYTHE NETWORK - ANONYMOUS KNOWLEDGE ONLYLocal case notesC-CDAPDF and OCRHL7 v2 / XMLPlain textNames, MRNs, dates, addresses.De-identificationNames removedMRNs removedDates reduced to yearAddresses generalizedAges over 89 bandedk-anonymity checkedTreating practitioners are kept:a provider is not a patient identifier.Care insightCohort, not a personPresentationInterventionOutcome observedReal-world signalStated limitationsAn anonymous case reference thatresolves to nobody, by design.Peer reviewCredential verifiedEndorseRefineChallengeConsensus scoredStatus publishedContested insights stay visible,marked as contested.Practitioner consultDescribe the case in front of you.Get ranked real-world referenceand safety signals that cite theinsights they stand on.Patient knowledgeThe same knowledge in plainlanguage, with no account andno record kept of the reader.Questions worth asking.The dashed line is the whole product. To the left, care as it is actually delivered, with every identifier intact. To the right, only what was learned.In this MVP every stage runs in the browser against fabricated data. Nothing is transmitted, and the de-identification stage genuinely runs.

Knowledgebase walkthrough

Six steps, in order. These pages need a practitioner sign-in. For the records exchange, follow the guide.

  1. 1

    Watch identifiers being destroyed

    Twelve case documents are waiting in the local queue. Open one and see the real names, record numbers and dates beside the redacted output the network actually receives.

    Open local ingestion →
  2. 2

    Ask before the knowledge exists

    Run the atrial fibrillation consult now. The network has almost nothing to say, and it tells you that rather than inventing a warning.

    Run a consult →
  3. 3

    Process the queue

    Six stages per document, ending at a k-anonymity check. Insights only publish once every document behind them has been processed.

    Process the queue →
  4. 4

    Ask the same question again

    The same consult now returns ranked insights, aggregate real-world signal, and safety signals that name the insights they stand on.

    Re-run the consult →
  5. 5

    Disagree with something

    The review queue holds the contested and under-review insights. One of them is being argued about by two reviewers right now.

    Open the review queue →
  6. 6

    Read it as a patient

    No account needed to read. The same knowledge in plain language, with the questions it suggests you ask.

    Open the patient view →

What this build is, and what it is not

It is

  • A functional front-end MVP of the whole journey, from registration to sign-out.
  • A real de-identification engine. It genuinely scans and redacts the 18 case documents in this repository.
  • A real retrieval and safety engine that refuses to emit an uncited signal.

It is not

  • Connected to any real EHR, node, network or backend. The EHRs and their FHIR APIs are simulated in the browser.
  • A clinical reference. Every insight is fabricated for demonstration.
  • Holding any real patient information. Every patient, record and practitioner is invented.