For MBBS learners, MD students & practising clinicians · invite-gated · private by design

Your next clinical question
deserves a private place
to become evidence.

Whether you are learning in MBBS, training in MD, practising, or building research, start with the observation, uncertainty, or problem you cannot let go of. HiDoctorly turns it into a searchable question, an honest answer to “has this already been done?”, and — when appropriate — a protocol draft you can review with your team and ethics committee.

Nothing you write is readable by another clinician, pooled with another doctor’s work, or sent to any external model. That is enforced in code, not promised in a policy.

Why nobody else can do this

Every other tool searches the literature. HiDoctorly searches yours first — and gets better at your subspecialty every time you use it, without your work ever leaving your control or reaching another doctor.

Request private accessSee how it works
01Observation
02Evidence
03Research
04Protocol
05Claim
Evidence integrity · visible from the first session

A prompt can describe a process. HiDoctorly stores and enforces it.

Every private question becomes an accountable research artifact: scoped to you, grounded in retrieved evidence, checked claim by claim, and recorded as it moves through the chain.

Read the boundary
01

Private scope

Your owner and project boundary is established before research begins. No cross-owner or cross-project synthesis.

02

Evidence trail

Retrieval tier, source, date and licensed-content handling stay attached to the research run.

03

Claim validation

Claims bind to sources and pass the HI-EI-AI checks before an exportable record is issued.

04

Accountable history

Artifact hashes, approvals and audit events make the path reviewable after the answer is written.

The practical difference. General assistants optimise for an answer. HiDoctorly helps you produce a private, source-bound and reviewable evidence artifact.
How you actually use it

One clinic session in, one protocol out. Here is what that looks like.

You do not need to know how to phrase a MeSH query, and you do not need a research methodologist sitting next to you. You need forty minutes and one observation you cannot let go of.

Start the way you would tell a colleague

Open a project, and type the observation in ordinary clinical language — “younger MI patients in the last two years seem to be presenting later than they used to.” No template, no keywords, no structured fields. Strip the identifiers before you paste; the system checks and stops you if you forget.

Let it tell you if it has been done already

Run the cascade. You get papers with design and year, and a synthesis where every claim shows the source behind it. This is the step that either kills your idea in twenty minutes or tells you the gap is real — and either outcome is a good use of your afternoon.

Teach it your literature

Star the papers you already trust. They become Tier 1 — searched first, every time, and never sent anywhere. After two or three projects the cascade starts from your own reading list rather than from cold.

Choose a study you can genuinely run

Ideas come scored for feasibility in your setting, not in an ideal one. A design needing 400 cases a year is marked as such if your unit sees 90. Pick against your real case volume and your real follow-up rates.

Take the draft to your IEC

Export the protocol with the governance record attached — objectives, population, outcomes, sample-size assumptions, statistical plan, bias table, limitations. Edit it as a clinician. It is a strong first draft, not a submission.

Nothing you write leaves your control

Your corpus is yours alone. No cross-owner flow, no cross-project synthesis, nothing sent to an external model. The only thing that ever leaves for outer-tier search is a derived query string — never your case text.

What it will not do. It will not tell you what to prescribe, start or stop. It will not diagnose. It will not tell you your idea is the first in the world — it cannot know that, so it says “based on searches through this date, limited evidence was found” instead. If you want a tool that flatters your hypothesis, this is the wrong one.

The seam

Literature tools answer questions. None of them help you find the question hiding in your own practice.

We looked hard at what the field already has, and where it stops. Six seams are still open. They are the whole product.

The snippet ceiling

Today  Extraction tools return fields and snippets. Composing them into a defensible position is still entirely manual, and nothing records how the composition was reached.

HiDoctorly  Evidence strength is composed into a single banded verdict you can read at a glance — and the composition is shown to you, not hidden behind a number.

Confident wrongness

Today  General models will answer a clinical research question in the register of an authority, and will assert novelty it cannot possibly verify.

HiDoctorly  The HI-EI-AI stance validator runs before every render and every export. Absolute-novelty phrasing and clinical-authority speech are blocked at the sentence level, not softened.

Silent contradiction

Today  Each query is a fresh transaction. Nothing notices when the protocol you are drafting quietly contradicts the observation that started the project.

HiDoctorly  Cross-stage regression protection reads the whole trajectory. If a later stage drifts from an earlier one, export is held until you reconcile it.

Your data on someone else’s model

Today  Zero-egress AI exists as infrastructure — air-gapped hosting, private endpoints. It does not exist as a research workflow a clinician can actually work inside.

HiDoctorly  Rule 11 makes you the sole controller of your project corpus. No cross-owner flow, no cross-project synthesis, and a private-self deployment where nothing leaves your estate.

Chat is not a workflow

Today  A conversation has no state you can hand to an ethics committee. Threads are not artifacts, and scrollback is not an audit trail.

HiDoctorly  The longitudinal engine holds the project as a staged trajectory — observation, evidence, idea, protocol, claim check — each stage a durable artifact with its own hash.

No signed handoff

Today  Tools produce output. None of them produce a record of who accepted that output, on what basis, and at what moment.

HiDoctorly  HI-EI-AI gates. Every advance carries actor, timestamp, decision and the artifact hash it signed over. Nothing advances silently.

The mechanism

Every claim carries its receipt.

HiDoctorly does not ask you to trust its synthesis. It shows you the binding: each statement, its verdict, its evidence strength, and the exact sources it rests on.

SUPPORTEDBound to at least one resolvable source with a matching evidence snippet.
PARTIALA source is adjacent but not direct. Rendered, and marked, for your judgement.
UNSUPPORTEDNo binding. Visible to you, held out of every export.
PROHIBITEDA clinical instruction or an absolute-novelty claim. Blocked outright.

HiDoctorly never writes “never been studied”. It writes “based on searches through <date>, limited evidence was found — a potential gap”.

Abstract visual: evidence cards each bound to a source by a single thread of light, with one unsupported card held apart
The HI-EI-AI chain

Five stages. Every one of them gated by you.

Human-in-the-loop by construction. Nothing advances to the next stage without your signed approval, and every approval is written to an audit trail with the artifact hash it signed over.

01

Observation intake

Write what you saw, the way you would tell a colleague in the corridor — “the last dozen or so post-CABG diabetics on empagliflozin seemed to mobilise faster than I expected.” No structured form, no keywords. De-identify it: no names, no UHID/MRN, no dates of birth, no phone numbers. A PHI scanner runs before anything else and, if it finds one, intake stops and points at the exact text so you can strip it. HI-EI-AI then hands back your observation as a PICO — population, intervention/exposure, comparator, outcome — plus a three-sentence paraphrase in plain clinical English.

HI-EI-AI gateRead the paraphrase. If that is not what you saw, reject it and rewrite — everything downstream is built on this framing.
02

Evidence workspace

The cascade runs a query ladder built from your framing — tightest search first, broadening only until it has enough to stand on. You get a source list with study design, year and where it came from, and a synthesis in which every sentence is bound to the papers it rests on. Expect a genuine answer to “has this already been done?” If the honest answer is “partly”, it will say partly.

HI-EI-AI gateYou know your literature. Star the landmark paper the cascade missed — it joins Tier 1 and is searched first from then on.
03

Research idea radar

Candidate studies you could actually run, each with a proposed design — retrospective cohort, case-control, prospective, registry, diagnostic accuracy, prediction model — and each scored three ways: how new it is against what Tier 1–2 found, how feasible it is in your own unit given your case volume and what you can realistically measure, and how publishable it looks. The feasibility score is the one that saves you a wasted year.

HI-EI-AI gatePick the one you will pursue. The rest stay in the project, archived not deleted, for when your case mix changes.
04

Protocol builder

A draft in the shape your ethics committee expects: objectives, population with inclusion and exclusion criteria, exposure, comparator, primary and secondary outcomes with how each is measured, sample size with every assumption written out where you can argue with it, statistical plan, bias risks with mitigations, ethics section, limitations. It is a first draft for a clinician to edit — not a submission-ready document, and it does not pretend to be.

HI-EI-AI gateSign off on population, exposure, outcomes and the statistical plan. Those four are where IEC queries come from.
05

Claim & citation check

Before anything leaves the system, a full validator chain sweeps the whole project — stance, evidence composition, cross-stage consistency, gate completeness, ownership and citation binding. This is the pass that catches the protocol that has quietly drifted away from the observation that started it, and the sentence with no paper behind it.

HI-EI-AI gateEvery unsupported claim must be resolved or removed. Until then no governance record is issued — the export is refused outright, not flagged with a warning you can click past.
The retrieval spine

A cascade, not a search box.

You will recognise the problem: a plain-English clinical question typed into a biomedical index returns almost nothing, because indexes match terms and not sentences. So retrieval here runs in four tiers, in order, working a query ladder from your framing — tightest first, broadening only until it has enough to stand on, then stopping.

Cascade guaranteeThe Private Secured Search Engine is withheld entirely unless the indexed tiers produced grounding first. When it does run, egress is query-only — the derived search string and nothing else.
Tier 1
Your starred corpus

The papers you have already read and kept, held inside your own project. Searched first, always, and never sent anywhere.

Tier 2
Biomedical index

Peer-reviewed biomedical indexes, queried through a query ladder that walks from specific to broad until the corpus is grounded. A plain-English framing returns almost nothing from an index; the ladder exists because of it.

Tier 3
Full text on request

Retrieved only for papers you ask for by name. Bandwidth and attention are both finite; neither is spent without your instruction.

Tier 4
Private Secured Search Engine

Society guidelines, trial registries and health-authority sources — reached through a private secured search engine that receives nothing but the derived search string. No case text, no patient-adjacent detail, no part of your corpus. Withheld entirely unless Tiers 1–3 produced grounding.

Absolute privacy

Your clinical thinking is yours. Absolutely, and by construction.

You are being asked to put your unpublished observation — the thing you have not told anyone yet — into a piece of software. So this is stated plainly rather than buried in a policy page.

Nobody reads your corpus. Not another clinician, not another department, not us. Every row is anchored to your owner id and every query is scoped to it. There is no admin view of your project text.

No external model ever sees it. Your observations, sources, ideas, protocols and claims are never sent to any third-party model. Reasoning runs against the endpoint your instance is configured with — in Private self, one inside your own estate.

No cross-project synthesis. Your projects are not mined against each other, and never against another doctor’s. Nothing you write becomes training data, an aggregate statistic, or a “similar research” suggestion to someone else.

PHI is refused, not stored. The de-identification gate blocks patient identifiers at the door, checked before the text is written anywhere. The safest posture is to hold no PHI at all, so that is the posture.

The outer ring gets a query string, nothing else. When Tier 4 runs, the Private Secured Search Engine receives the derived search terms and nothing more. No case description, no patient-adjacent artifact, no part of your corpus. That boundary is in code, not in a promise.

You can take it all with you. Every artifact is exportable with its governance record. There is no lock-in on your own research, and deletion means deletion of the artifact — the append-only audit ledger keeps only the fact that an action occurred.

And if institutional policy says nothing may leave the building at all — Private self.

A deployment mode, not an enterprise upsell. The same canon, the same validators, the same gates — on infrastructure you control.

On-premise / sovereign cloud / private VPC

The whole surface runs inside your boundary. Nothing about the deployment topology changes the constitutional behaviour.

Bring your own model

Open-weight models served locally. The HI-EI-AI preamble, the stance validator and the citation binder are model-independent by design.

Query-only outer ring

If the Private Secured Search Engine is enabled, only the derived query string leaves. No observation text, no patient-adjacent artifact, no project corpus.

SSO, SAML, SCIM

Identity stays with your institution. HiDoctorly holds no credential it does not need.

Encrypted at rest

Project corpora are a distinct storage tier with no cross-corpus joins, held under your own key management.

Governance record on export

Every export emits the directive verbatim, the owner approval, the security posture honoured, and the full validator chain result.

Governance

The constraints are the product.

HiDoctorly is not a lighter, research-flavoured tool with its own reduced security model. It runs our full clinical-grade security harness, unmodified — the same canon, the same HI-EI-AI voice, the same validators, the same owner-first root. Nothing is relaxed for research convenience. These are not settings. They cannot be turned off.

Governance ruleSecurity harness inheritance. HiDoctorly uses the whole of our clinical security harness. Not a subset, not a research-only variant, and with nothing disabled to make the workflow faster. Every control below is inherited wholesale and enforced in code — on the same paths a clinical surface uses.
Rule 11 owner-first isolationConstitutional string enforcementCore-stance validation before render and exportPHI de-identification gate at intakeZero external corpus egressSigned HI-EI-AI gates on every stage advanceContent-addressed artifact hashingAppend-only audit ledgerResearch-corpus separation, no cross-corpus joinsHardened credential derivation + owner-scoped sessions

Inherited security harness

Every control listed above runs here unchanged. When the harness is hardened upstream, this surface hardens with it — there is no separate, weaker research security model to fall behind.

Rule 11 — owner-first

The clinician-owner is the sole controller of their project corpus. The institution is the authorising authority for datasets and PHI-adjacent artifacts. Scope defaults to owner-only until the owner widens it with an explicit approval event.

Zero external corpus egress

No cross-owner data flow. No cross-project synthesis. No owner corpus sent to any external model. The research corpus is a distinct storage tier, with no cross-corpus joins.

Constitutional strings

HiDoctorly is a research-support system, not a clinical authority. It cannot claim absolute novelty, fabricate a citation, infer PHI, bypass a gate, or dilute owner-first. The stance validator runs before every render and every export.

Signed audit trail

Every gate decision writes actor, timestamp, artifact hash and decision. Every validator run is persisted. Nothing advances silently, and every advance is reconstructable after the fact.

Cross-stage regression protection

A later stage may not silently contradict an earlier one. Idea against observation, protocol against idea, manuscript against analysis. If a regression fires, export is blocked until you reconcile it.

Governance record on export

Every project can emit a governance record: the directive verbatim, the owner approval, the security posture honoured, and the full validator chain result — auditable by the same lens you already use.

Private access

Access is selective. Commercial terms stay confidential.

HiDoctorly is invite-gated and scoped to the learner, clinician, researcher, or institution using it. We share pricing privately after understanding the required workspace, governance model, and deployment boundary.

Clinician research

Private projects, evidence retrieval, claim binding, and an auditable research trail.

Request private access
Institutional teams

Owner-partitioned workspaces, review controls, and governance conversations shaped to your setting.

Request private access
Private self

For deployments that require a dedicated security, retention, and infrastructure discussion.

Request private access
The next moat

Instant guidance for the problem in front of you — without turning privacy into a trade-off.

In an encounter, a doctor or clinical researcher often needs structure before they need prose: frame the problem, compare workable approaches, expose unknowns, and identify the next safe check. HiDoctorly can make that loop immediate while keeping the source trail, owner boundary, and human authority intact.

Frame the problem

Turn a spoken operational or technical problem into a concise frame: desired outcome, constraints, unknowns, and the decision that still belongs to the human.

Compare approaches

Show evidence-grounded options with rationale, trade-offs, and a checkable verification point — including human factors, equipment readiness, and local workflow.

Leave a safe trace

Produce next actions, escalation triggers, cited sources, and a time-stamped record that can be reviewed after the encounter.

Release boundary. Instant means fast problem framing and evidence retrieval, not autonomous diagnosis, prescribing, dosing, or patient-specific emergency instructions. The moat is private, source-bound, auditable guidance with the clinician still in control.

What HiDoctorly is not

Not a diagnostic aid. Not clinical decision support. Not a novelty oracle. Not a generic chatbot with a stethoscope. HiDoctorly supports the design of research, and the clinician remains the scientific decision-maker at every stage.

Access is invite-gated.

HiDoctorly is open to MBBS learners, MD students, practising clinicians, clinical researchers, and institutions where private validation space is critical. Tell us your role and setting, and we will route you to the right rollout.

Request clinician accessI have an invite code