Medical paperwork in. Structured clinical data out.

{ "jobId": "job_8Kd2", "status": "QUEUED" }

{
  "type": "document.processing_completed",
  "data": {
    "documentId": "doc_3Fq9",
    "documentType": "LAB_REPORT",
    "processingStatus": "PROCESSED"
  }
}

{
  "display": "Hemoglobin",
  "coding": { "system": "LOINC", "code": "718-7" },
  "valueNumeric": 13.5, "unit": "g/dL",
  "interpretation": "LOW",
  "confidence": 0.93,
  "provenance": { "documentId": "doc_3Fq9",
                  "method": "AI_TEXT" }
}

Manual abstraction doesn't scale

Nurse reviewers and claims adjusters retype values into forms. Throughput is capped by headcount, and the cost per file never falls.

Raw OCR isn't an answer

A text dump still needs classifying, coding and unit normalization before a rules engine or model can use it.

Unsourced extraction is unusable

If a reviewer can't trace a value back to the page it came from, it can't support a decision that has to be defended.

Building it in-house is a detour

OCR, template detection, prompt versioning, schema validation, idempotent retries, audit trails. Months of work that isn't your product.

curl -sX POST "$ZUREE_BASE_URL/v1/patients" \
  -H "Authorization: Bearer $ZUREE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"pseudonym":"ext-user-42"}'

# → {"id":"<patientId>",
#     "pseudonym":"ext-user-42",
#     "createdAt":"2026-07-01T09:12:04.000Z"}

import { ZureeClient } from '@zuree/sdk';

const zuree = new ZureeClient({
  apiKey: process.env.ZUREE_API_KEY!,
  baseUrl: process.env.ZUREE_BASE_URL!,
});

const patient = await zuree.patients.create({
  pseudonym: 'ext-user-42',
});

CONTENT=$(base64 -i lab-report.pdf)

curl -sX POST "$ZUREE_BASE_URL/v1/documents" \
  -H "Authorization: Bearer $ZUREE_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d "{\"patientId\":\"$PATIENT_ID\",
       \"filename\":\"lab-report.pdf\",
       \"mimeType\":\"application/pdf\",
       \"content\":\"$CONTENT\"}"

# → {"document":{"id":"<documentId>",
#                "status":"SECURITY_CHECKED"},
#     "duplicate":false}

import { readFile } from 'node:fs/promises';
import { randomUUID } from 'node:crypto';

const bytes = await readFile('lab-report.pdf');

const { document } = await zuree.documents.create(
  {
    patientId: patient.id,
    filename: 'lab-report.pdf',
    mimeType: 'application/pdf',
    content: bytes.toString('base64'),
  },
  { idempotencyKey: randomUUID() },
);

curl -sX POST \
  "$ZUREE_BASE_URL/v1/documents/$DOCUMENT_ID/process" \
  -H "Authorization: Bearer $ZUREE_API_KEY"

# → 202 {"jobId":"<jobId>",
#          "status":"QUEUED",
#          "attempts":0}

await zuree.documents.process(document.id);

let s = await zuree.documents.status(document.id);
while (s.status === 'PROCESSING') {
  await new Promise((r) => setTimeout(r, 2000));
  s = await zuree.documents.status(document.id);
}

curl -sX POST "$ZUREE_BASE_URL/v1/webhooks" \
  -H "Authorization: Bearer $ZUREE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://your-app.example/hooks/zuree",
       "events":["document.processing_completed",
                 "document.processing_failed"]}'

# → {"id":"whe_…","secret":"whsec_…"}

import { verifyWebhookSignature } from '@zuree/sdk';

app.post('/hooks/zuree', async (req, res) => {
  const raw = await readRawBody(req);
  const check = verifyWebhookSignature({
    payload: raw,
    signatureHeader: req.headers['zuree-webhook-signature'],
    secret: process.env.ZUREE_WEBHOOK_SECRET!,
  });
  if (!check.ok) return res.status(401).end();

  const event = JSON.parse(raw);
  res.status(200).end();
});

curl -s \
  "$ZUREE_BASE_URL/v1/patients/$PID/observations?limit=50" \
  -H "Authorization: Bearer $ZUREE_API_KEY"

# → { "items": [ { "display": "Hemoglobin",
#       "coding": {"system":"LOINC","code":"718-7"},
#       "valueNumeric": 13.5, "unit": "g/dL",
#       "interpretation": "LOW", "confidence": 0.93,
#       "provenance": {…} } ],
#     "nextCursor": "b2Zmc2V0OjUw" }

for await (const obs of zuree.clinical.observationsAll(patient.id)) {
  console.log(
    obs.display,
    obs.valueNumeric ?? obs.valueText,
    obs.unit ?? '',
    `(${obs.confidence})`,
  );
}

for await (const e of zuree.clinical.timelineAll(patient.id)) {
  console.log(e.date ?? '(undated)', e.kind);
}

zuree.app  (iOS / Android)
   │
   └─ POST /v1/documents
      POST /v1/documents/:id/process
      GET  /v1/patients/:id/timeline
         │
         └─ the same V1 API on this page

Zuree makes no regulatory compliance claim — not GDPR, not HIPAA, not any other framework. The controls beside this are the technical mechanisms we implement and will walk your security team through. Determining lawful bases, retention periods and erasure obligations in your jurisdiction remains yours. We’d rather tell you that up front than in diligence.

No clinical content in telemetry

Logs, metrics, analytics, error trackers, webhook payloads and audit records carry opaque IDs, codes and counts — never document content.

Tenant isolation on every query

Tenant identity resolves server-side from your API key. A tenant_id is never accepted from a request body.

Private storage, short-lived URLs

Object storage buckets are private; signed URLs expire in minutes. Uploads are malware-scanned and content type is verified from the bytes.

AI provider transparency

Every extraction records which provider, which exact model, which prompt version and which pipeline version produced it — readable via the API.

Coordinated deletion

Deleting a document clears it from the database, object storage, processing queue and temporary files — leaving an audit record of IDs and counts, not content.

Retention on your terms

Indefinite by default — Zuree never deletes what you didn’t ask it to. Enable a per-tenant document-age window and expired files purge through the same path.