MOVO-X Singapore Technology Architecture

MOVO-X Singapore's AI triage architecture ensures full PDPA SG compliance: no patient health information leaves the hospital or polyclinic's Singapore infrastructure.

Edge Layer (On-Premise): A quantized clinical LLM processes patient-reported symptoms at the kiosk. The model runs entirely on local hospital hardware — no network connectivity is required for the triage decision itself. Output: a Singapore Emergency Triage (SET) acuity score (P1–P5) and a structured symptom cluster. SET P1 and P2 cases trigger immediate nursing notification via WebSocket push to the staff dashboard.

Cloud Layer (PHI-Free): Symptom category (not raw text), acuity score, and consultation type are sent to Anthropic Claude API to generate enriched clinical language for the doctor's pre-consultation note. Because patient identifiers are stripped before this API call, the cloud processing satisfies PDPA SG's purpose limitation requirement. The enriched note is returned to the clinician dashboard within 3 seconds.

Multilingual Triage Input: Singapore patients can enter symptoms in English, Mandarin, Malay, or Tamil. The on-premise model includes a translation layer that normalises all input to English clinical terminology before symptom classification. This ensures consistent acuity scoring regardless of input language.

Audit Trail: Every triage event is immutably logged with timestamp, model version, acuity score, input language, and clinician override (if any). This log satisfies MOH's clinical audit requirements and PDPA accountability principle. The consent disclosure for AI-assisted triage is displayed in the patient's preferred language before symptom entry.

MOVO-X Singapore's queue engine is purpose-tuned for Singapore's polyclinic and public hospital scale — facilities handling 500–2,000 patient interactions per day.

Queue Assignment Logic: Patients receive a queue position using a weighted scoring function: appointment type (booked GP panel vs. walk-in) × CHAS subsidy class routing × SET acuity weight × arrival time. Walk-in to booked ratio is configurable per time slot. Subsidized patients (Class C/B2) and private patients (Class B1/A) are routed to separate queues with independent service counters.

Prediction Model: A clinic-specific XGBoost regression model predicts wait times using: (1) rolling 30-day consultation duration distribution for each doctor, (2) current queue depth per service type, (3) time-of-day seasonality index for this specific polyclinic, (4) CHAS verification time variance (±90 seconds per patient). Model is retrained weekly on each polyclinic's own data — predictions are clinic-specific, not generic industry averages.

Supabase Realtime Push: Queue state is maintained in Supabase PostgreSQL. Every patient event (check-in, call, no-show, consultation end) triggers a Supabase Realtime broadcast to: (1) TV queue displays — refreshed in under 200ms; (2) Patient's registered mobile number (WhatsApp or SMS) when they are 3 positions from being called; (3) Clinician dashboard showing next 5 patients with AI triage summaries pre-loaded.

Polyclinic Load Balancing: For polyclinic groups (SingHealth, NHGP), MOVO-X provides cross-polyclinic wait time visibility, allowing operations managers to see which nearby polyclinics have shorter queues and optionally suggest patients redirect. This inter-facility intelligence layer is a Singapore-specific capability.

MOVO-X Singapore fulfils two critical Singapore-specific integration requirements: NEHR contribution (mandatory under HCSA 2020) and SingPass MyInfo patient identity (96% adult adoption).

SingPass MyInfo Check-In Flow: 1. Patient opens SingPass app and scans MOVO-X kiosk QR code. 2. Patient reviews and approves attribute sharing (name, NRIC, DOB, contact details). 3. SingPass issues a consent token; MOVO-X exchanges it for MyInfo attributes via GovTech API. 4. MOVO-X matches NRIC against appointment records in the cluster HIS. 5. Patient is presented with their appointment details, payment summary, and PDPA consent statement. 6. Total check-in time: under 60 seconds.

The SingPass integration runs over HTTPS with GovTech's production environment. All tokens are single-use and expire after 5 minutes. MOVO-X does not store the SingPass access token — only the resolved MyInfo attributes (which are personal data covered by PDPA consent captured at step 5).

NEHR FHIR R4 Submission: After each consultation, MOVO-X submits two FHIR resources to NEHR via the IHiS API gateway: - Encounter resource: Clinical encounter details (admission type, department, attending provider NPI, duration, discharge disposition). - DocumentReference resource: AI-generated SOAP note linked to the Encounter, formatted per NEHR DocumentReference profile.

Submission uses SMART on FHIR OAuth2 with per-facility client credentials issued by IHiS. Failed submissions (network errors, NEHR downtime) are queued with exponential backoff and retried for up to 72 hours. Submission status is surfaced on the CLINIC_ADMIN dashboard with per-patient NEHR acknowledgement tracking.

Cluster HIS Integration: MOVO-X maintains three integration paths: - SingHealth → TrakCare FHIR R4 API (Patient $match, Appointment read, Encounter write) - NUHS → i.MedOne FHIR R4 + HL7 v2.5 ADT translation layer - NHG → iHIS Sunrise XA HL7 v2.5 with FHIR R4 NEHR passthrough

MOVO-X Singapore's security architecture provides three independent isolation layers, ensuring tenant separation, PHI protection, and full PDPA SG and HCSA 2020 compliance.

Layer 1 — Application (JWT): Every API request carries a clinicx_token cookie: HS256-signed JWT containing clinicId (facility-level), userId, role, and expiry. Verified in Next.js middleware via jose before any handler executes. Kiosk devices authenticate with a separate KIOSK_API_KEY + HMAC signature, scoped to their registered clinicId. No kiosk can impersonate another facility.

Layer 2 — Database (RLS): Supabase PostgreSQL has Row-Level Security on every clinic-scoped table. Policies deny ALL to anon and authenticated Supabase roles. Only the server-side service_role key bypasses RLS — this key is never exposed to client code. Even if the Supabase anon key were leaked, no patient data is accessible.

Layer 3 — Network (Singapore residency): Vercel Fluid Compute in sin1 (Singapore) processes all compute. Supabase ap-southeast-1 (Singapore AWS region) hosts all data. TLS 1.3 enforced for all connections; HSTS max-age=63072000 prevents protocol downgrade. No patient data transits outside Singapore.

PDPA Consent Gate: The kiosk displays a consent notice in the patient's selected language (EN/ZH/MS/TA) before collecting any personal data. The consent notice discloses: data controller identity (facility + MOVO-X), purpose of collection, data sharing (NEHR submission), retention period, and patient rights. Consent is logged as an immutable event with PDPA version reference. This satisfies PDPA Sections 13–15 (Consent Obligation).

DNC Registry Check: Before sending appointment reminders to unverified phone numbers, MOVO-X performs a DNC registry check via the PDPC API. Verified SingPass numbers (MyInfo-sourced) are exempt from DNC as they represent active consent. Marketing communications never go to DNC-registered numbers.

Breach Response: MOVO-X Singapore's breach response procedure targets PDPC notification within 24 hours of internal detection (ahead of the mandatory 3-calendar-day deadline). The CLINIC_ADMIN receives automated alerts via Resend email when anomalous data access patterns are detected by the PostgreSQL audit trigger.