Blue Care Health OS is built as a multi-tenant SaaS with a FHIR R4-native core. Each organisation and facility is a tenant that controls its own operations — users, roles, local scheduling — while a shared patient-identity and longitudinal-record layer spans every tenant, which is what makes connected care possible instead of isolated systems. An interoperability layer isolates all external integrations behind configurable adapters, so a new system (a national registry, a lab, an insurer) is connected without changing the core.

Tenants (organisations) Blue Care Gaborone Group Princess Marina Hospital Users · Roles · Local scheduling Nyangabgwe Health District Nyangabgwe Referral Hospital Users · Roles · Local scheduling Future organisation Onboarded via configuration — not redevelopment Provider interface React responsive web app Clinician · Admin · MPI Steward consoles Platform core — shared across every tenant Patient Identity + MPI Blue Care Health ID issuance Deterministic + probabilistic match, review queue FHIR R4 API Patient · Encounter AllergyIntolerance · Medication OpenAPI-documented, REST Core data model PostgreSQL Relational integrity for identity, records, audit Security & governance RBAC · Consent Encryption in transit + at rest Full audit trail Interoperability layer — adapter / gateway pattern Configurable adapters — national systems, labs, insurers, SMS/email Designed now (Module 4) · connected in Phase 2–3 · isolates the core from every external integration

Tenancy model

Two levels: Organisation (the legal/administrative entity — a hospital group or health district) contains one or more Facilities (a physical hospital or clinic). Users, roles and local scheduling are scoped to a facility within an organisation. The patient-identity layer is the one thing that is never tenant-scoped — a Blue Care Health ID resolves the same way everywhere.

Country configuration

Botswana is the first implementation. A new country is onboarded by configuring terminology packs, identifier formats (the Omang pattern is one such configuration) and regulatory profiles — not by rebuilding the core. This is what the Ongoing · Configurability roadmap line means in practice.

Deployment

Containerised (Docker), cloud-agnostic — deployable to the client's chosen dedicated, private-cloud, or sovereign environment. Hosting and any component licences (e.g. the FHIR server) are provisioned in the client's own cloud accounts and billed at cost (SOW §11), so ownership and control stay with Blue Care.