The platform

One record, wearing three uniforms.

A drug drawn up at the roadside is a clinical fact and a stock movement and a line on tomorrow's audit. Today those live in different systems that never quite agree. Castellan builds them as one record — captured once, at the moment it happens, correct everywhere it matters.

For the crew

The field record

The mission data terminal and the electronic patient report have always been two systems pretending not to know each other. Our field record — product name announced soon — merges them: the job and the patient are two tabs of one app, from the pager going off to the hospital handover — on the vehicle tablet and on the phone in a crew member's pocket.

Offline is not a mode. It's the design. Every screen a crew must read works with zero coverage; everything written queues and syncs when the world allows. A record that needs signal to work is a record that fails exactly when the job gets hard.

The scribe listens so hands stay on the patient. A clinical AI scribe, purpose-built for ambulance practice, listens through the job and drafts as it hears: vitals timed at the moment they were said, medicines, history, impressions. It learns from every correction working paramedics make — and nothing it produces enters the record until a clinician confirms it.

The record does arithmetic. Early-warning scores from the national charts your crews work to — adult, maternity, and every paediatric age group — recalculate with each set of vitals, alongside shock index and trend. Honest scoring: a partial set of vitals says exactly what's missing rather than guessing.

And when one patient becomes twenty, it becomes the major-incident toolkit — built section by section against national doctrine: METHANE reporting, triage categories that match the wristbands in the pack, casualty tracking from scene to hospital door, command structure, transport boards.

Offline-first AI scribe Early warning scores MCI command Phone + tablet
For the base

QuarterMaster — the equipment register

The controlled-drug register is the record an audit reads, a court trusts, and a career stands on. QuarterMaster keeps it as an append-only evidence chain: every movement attributed, every correction kept alongside what it corrected, nothing silently rewritten. A register that cannot be quietly edited protects the people who sign it.

Dual signatures are captured where they happen — at the shelf, at the drug safe, at the patient's side — as one act, recorded once. The same movement a clinician logs in the field is the movement the register holds; nothing is re-keyed at end of shift, because re-keying is where records drift.

Checks and expiries page the right person before they become problems. Vehicle and kit checks record what was checked, by who, when — and surface what wasn't. Expiring stock is a schedule, not a surprise.

Notifications arrive on your terms. Each person chooses what reaches them, and when. A notifiable event — a missed check, a discrepancy, stock running out of date — lands with the people it belongs to, who can acknowledge it, add a note, and close it out right there in the app. Nothing nags everyone; nothing slips past the person it was for.

Stores keep themselves stocked. QuarterMaster watches levels against your minimums and drafts the reorder to your suppliers before the shelf runs dry — a person approves it, the register remembers it. Ordering becomes a workflow the register runs, not a Friday job someone has to remember.

QuarterMaster runs standalone for services that only need the register — and becomes more when the field record stands beside it. By design, it holds no patient data at all.

Append-only Controlled drugs Dual signature Checks & expiries Stores & ordering Notifications on your terms No patient data
For command

Dashboards — the operational picture

The same record the crew is writing is the picture command is reading — live, without anyone transcribing anything.

Operations sees the fleet at a glance: which vehicles are ready, which checks are due, who's crewed, who's responding. Hospitals see what's inbound — status, ETA, acuity — with acknowledgement built in, because a board being right is not the same as the right people having seen it.

Major incidents get command surfaces: the casualty board, destination planning that shows which hospital is absorbing what, the command structure with the gaps made visible. The doctrine's own shape, at the doctrine's own pace.

And beyond the live picture: audit and quality review work the append-only record with every attribution intact, and learning and CPD keep the education file — training, endorsements, professional hours — beside the clinical work it comes from.

Live Ops & fleet Hospital inbound MCI command Audit Learning & CPD
The seam

Captured once. Correct everywhere.

The moment that proves the platform: a controlled drug given at the roadside. One act — the clinical record and the drug register both hold it, with the dual signature captured right there, even if the aircraft doesn't see coverage again until it lands. Nobody re-keys it. Nobody reconciles it at midnight. The two records agree because they were never two records.

And every service runs it on a dedicated database of its own — a bespoke tenancy built for one customer, holding one organisation's records and nobody else's.

Both products are in active development and field testing with New Zealand HEMS clinicians. Product names, pilots and availability will be announced.