Concept explainer
Multi-site and tenancy
Explains how Pensieve holds several sites in one deployment, how each tenant's data stays separate, and how shared reference data is managed.
Pensieve holds several sites in one deployment. This page explains how a single deployment serves an organisation and all of its sites, how each tenant's data stays within its own boundary, and what little the platform shares centrally.
One deployment, many sites
An organisation is the custodian that runs the hospital and the Data Fiduciary for the care it delivers. Within a deployment it is a grouping label for naming and reporting, and it scopes no query and no access decision of its own. A site is a physical location the organisation operates, such as a main hospital building or a satellite clinic. One organisation holds one or more sites.
The unit of tenancy is the site. Each site authors and holds its own operational data within its own boundary, and one deployment serves an organisation and all of its sites together. The patient record sits outside this structure, as the sections below set out.
- organisation
- main hospitala site
- satellite clinica site
- day-care centrea site
Where the boundary sits
Almost all data and permissions are scoped to a site. A member of staff, a role, a duty roster, a bed, and an access decision belong to the site they were made in.
| Data | Scope |
|---|---|
| Staff, roles and rosters | Site |
| Permissions and access decisions | Site |
| Units, locations, beds and services | Site |
| Catalogues, tariffs and forms | Site |
| The patient record | Outside tenancy, follows the patient |
| The shipped clinical terminology baseline | Central, with per-site overrides |
Scoping to the site keeps each site's working data within its own boundary. A person acts inside the site their role was granted in, and the interface they see is drawn from that site.
The record follows the patient
The patient record is the exception, and by design. It belongs to the patient, who holds the decision rights over who may read it. It exists once across every hospital that runs Pensieve, so care draws on the same history wherever the patient is seen. The organisation is the custodian and Data Fiduciary for the care it delivers, not the owner of the record.
A patient seen at the main hospital and later at a satellite clinic carries one record across both. The encounter, a single contact between a patient and the hospital, attaches to the site where it happens, while the record it writes to is a single object, held once outside the tenancy structure, that follows the patient rather than resting inside any organisation boundary.
One patient, one history
Holding the record once, outside the tenancy structure, is what keeps one account of a patient across every hospital that treats them, not merely across the sites of one organisation, while the day-to-day working data stays scoped to each site.
Configuration per site, with a shared baseline
Each site authors its own operational configuration: its orderable catalogue, its charge item definitions and tariffs, its forms, its workflows and its roles. An item means what its own site defines it to mean, and a site draws on its own lists rather than a central one.
What the platform holds centrally is the layer beneath that configuration: the authorisation model, the registry of grantable permissions, and the shipped clinical terminology baseline the record is coded against. A site extends that baseline with its own terminology overrides, which resolve ahead of it.
Each site authors its own orderable catalogue, charge item definitions and tariffs.
The clinical terminologies shipped with the platform, which every site codes against.
A site's own terms, which resolve ahead of the shipped baseline.
Crossing between sites
Access crosses between sites only under defined conditions. The site boundary holds by default, and a crossing is a recorded, permitted exception rather than an open door.
Read how that boundary is drawn and when a crossing is allowed in the site boundary, or how one record follows a patient across sites in the record is cross-site.