Data sovereignty · Regulated teams · VDI
A sovereign workspace on hosts you already trust.
LocumView packages AI-assisted work as a portable workspace, designed to be signed and independently reviewed, that runs on the hardened host your organization already trusts, in the jurisdiction you choose: alongside your existing Windows desktop, or in place of it.
- Live: RHEL desktop in the browser
- Live: Keycloak SSO with MFA
- Built: signed desktop images with SBOMs
- Planned: data residency by deployment
Live LocumView session, delivered in the browser.
Two ways to deploy
Start alongside your existing desktop. Replace it when you are ready.
Alongside
Staff keep their standard Windows desktop, including the EHR, untouched. LocumView runs as a companion workspace in a browser tab. Where AI tools need clinical data, they connect only through sanctioned SMART on FHIR APIs with your organization’s approval, to retrieve, summarize, and draft. No rip-and-replace, no disruption to existing workflows.
- Existing Windows desktop stays exactly as it is
- Companion workspace in a browser tab
- Data only through approved SMART on FHIR APIs, never from the screen
Instead of
Where the EHR and other core systems already run in a browser, LocumView becomes the full desktop: one hardened Linux workspace for those systems, AI tools, and everything else, hosted where your data is allowed to live. Retire per-seat Windows desktop licensing and extend the life of thin-client hardware.
- One workspace for browser-based systems, AI tools, and daily apps
- Fewer per-seat Windows desktop licenses
- Thin clients and older hardware stay in service longer
In either mode, the AI layer is the same signed, versioned module, so it can be adopted without changing the desktop and updated without revalidating everything around it.
Design goal. Built: the desktop as a bootc image that CI builds, signs, and ships with an SBOM, that installs and provisions itself, that accepts only signed updates, and that rebuilds from a clean clone with no manual steps. Planned: independent review. Live today: the RHEL desktop in the browser behind Keycloak SSO with MFA.
The core idea
The workspace is the product. The EHR is one governed data source.
Clinicians already work across a dozen windows. LocumView turns that sprawl into one governed workspace, where the EHR is a trusted source of data rather than the place everything has to happen.
LocumView is designed to connect to the EHR through sanctioned, standards-based APIs: FHIR R4 and SMART on FHIR. No screen scraping, no fragile automation. From that data, the workspace will run AI assistants, dashboards, and a coordinated clinical environment around it. This layer is planned and not built yet.
- AI assistants
- Dashboards
- Secure messaging
- Files and documents
Platform
Four commitments that shape every decision.
Secure by design
Linux desktops hardened to the DISA STIG profile and scanned with OpenSCAP, with every exception documented (done on the reference desktop and built into the desktop image), and each HIPAA technical safeguard mapped to its control, with the gaps stated. Compliance evidence is versioned alongside the code.
DISA STIGOpenSCAPHIPAA mappingAI that stays inside the boundary
Planned: local models and assistants run inside your environment, so no patient data leaves the regulated boundary. Local GPU inference already runs in the build lab; the assistants are not built yet.
Local inferenceNo external callsLoggedDelivered anywhere, through the browser
Desktops reach users through a browser with single sign-on and MFA. No desktop is ever exposed directly to the internet.
Browser accessSSOMFAReproducible and auditable
The goal: every desktop a versioned, rollback-capable image built from code. Built: the desktop image installs and provisions itself with no manual steps. CI builds, signs, and attaches an SBOM to every image, and desktops accept only signed updates. Proven rebuildable from a clean clone with zero manual steps. The live demo still runs on the hand-built reference desktop, which moves to the image next.
Image-basedVersionedRollback
AI in the workspace
AI that does the paperwork, inside your boundary.
Lead example (planned)
Guideline and document digests
When an updated guideline or protocol is published, an assistant will retrieve it, summarize what changed, and draft a short digest for the team, citing the exact document version. It runs on local models inside your environment. Not built yet.
- Retrieves, summarizes, organizes, and drafts. People write the final word.
- Shows its sources and the exact document versions it used
- Every action is logged and auditable
- Runs on local models inside your environment, in your jurisdiction
Ward team · Internal medicine
New document: local antibiotic guideline v2026.1
- Sections changed
- 4.2, 6.1
- Summary length
- 180 words
- Sources retrieved
- 2 documents
- Audience
- Ward team
Draft digest of what changed in sections 4.2 and 6.1, organized for the ward team, ready for editing.
Local antibiotic guideline v2026.1 · previous version v2025.3
Planned assistants
- Planned
Document and guideline digests
Retrieves new or changed documents and drafts short, sourced summaries for the team.
- Planned
Pharmacovigilance intake
Organizes source material and drafts case narratives for pharmacist review.
- Planned
Literature monitoring
Retrieves and summarizes new publications on topics your team follows.
Governed knowledge
A governed knowledge base, not a black box.
Versioned sources
Guidelines, protocols, and policies live in a curated library. Every document is dated and versioned.
Scheduled review
Each source has an owner and a review date. Nothing ages out of date silently.
Clinician sign-off
An accountable owner reviews and signs off every update before it reaches an assistant.
Regression testing
Updates are tested against the scenario cases and their reference answers. Any change in output is reviewed before release.
Feedback loop
Edits by staff are logged and reviewed, and every update can be rolled back.
Capabilities
Everything in one workspace.
Browser-based EHR access
Planned: Meditech Expanse, Epic, and Oracle Health via SMART on FHIR.
AI assistants
Planned: launchable assistants that draft, summarize, organize, and retrieve. People stay in control.
Secure messaging and video
Planned: Matrix and Element, self-hosted inside your environment.
Files and documents
Live: ONLYOFFICE on the desktop. Next: Nextcloud for shared files and real-time editing.
Email, calendar, and contacts
Planned: Evolution, connected to Nextcloud for shared calendars and address books.
Data science and research
Live: Python. Planned: R, Jupyter, and local model serving for approved research work.
Centralized dashboards
Planned: unit and service views built directly from FHIR data.
Curated per role
Each desktop carries only the apps that role needs.
Third-party names are trademarks of their respective owners and are listed for interoperability only.
Workspace
Familiar from day one.
Windows-style
Taskbar, start menu, and window controls on the right.
Mac-style
Top menu bar, centered dock, and window controls on the left.
GNOME
The standard GNOME desktop: an overview for apps and windows, no dock or taskbar.
Deploy
Deploy anywhere: your infrastructure, your choice.
Data sovereignty starts with who controls the stack.
Clinical data is only as sovereign as the software and infrastructure it runs on. Because LocumView builds on open, auditable Linux and deploys wherever you decide, jurisdiction over patient data stays with your organization, not with a vendor.
You choose the jurisdiction
Data residency is decided by where you deploy: your data center, your cloud account, or a sovereign provider.
No single-vendor dependency
Open, enterprise-supported distributions mean no proprietary OS license or foreign platform holds the keys.
Auditable end to end
Open source operating systems and code-defined builds let your security team inspect exactly what runs.
Operating systems
- Demonstrated
Red Hat Enterprise Linux
The reference build. The live demo runs here today, hardened to the DISA STIG profile.
- In progress
SUSE Linux Enterprise · openSUSE
European-rooted enterprise Linux and a natural fit for sovereignty-focused deployments. In progress: infrastructure work has begun and runs largely in parallel with the RHEL build. Not supported or shipped yet; the goal is the same code with equivalent hardening.
- Planned
Debian
Community-governed and vendor-neutral. Intended to build from the same definitions; not built yet, and validation will follow customer need.
Infrastructure targets
On-premises virtualization
Demonstrated on KVM/libvirt, where OpenTofu creates each desktop from the desktop image and removes it again (image signing is next). Planned: Proxmox VE as the production target; designed for the hypervisors already in your data center.
Kubernetes
Live: the access layer (Guacamole, Keycloak, and the tunnel) runs on k3s. Planned: desktops on Kubernetes with KubeVirt.
Public or sovereign cloud
Planned: the cloud your governance allows, with the same images and controls.
Thin-client ready
Because desktops are delivered through the browser, endpoints stay simple: any modern browser works, including on phones. Managed thin clients such as IGEL OS devices should work the same way but have not been tested yet.
Sovereign by design. Your data stays where it belongs.
Digital sovereignty and data residency are now part of healthcare procurement. LocumView runs on open, enterprise Linux and is designed to deploy on European-owned infrastructure, with no dependency on a single US hyperscaler.
- Planned: deployment on European-owned clouds such as IONOS, STACKIT, OVHcloud, Scaleway, and Hetzner
- In progress: SUSE Linux Enterprise and openSUSE (not supported or shipped yet); other European-supported distributions planned
- Data residency controlled by where you deploy, not by a vendor contract
- Supports the move toward sovereign, open infrastructure in public healthcare
Security architecture
One path in. Nothing else exposed.
- User browserNo client install
- TLS reverse proxyTerminates HTTPS
- Guacamole gatewayKeycloak SSO + MFA
- Hardened desktopSTIG baseline
- Access
- Browser only, via Apache Guacamole
- Identity
- Keycloak SSO (OIDC)
- Directory
- Red Hat IdM, federated into Keycloak
- MFA
- TOTP enforced for organizational accounts; guest demo is password-only and isolated; WebAuthn / FIDO2 next
- Transport
- TLS at the edge, encrypted tunnel inward, WireGuard between cluster nodes, RDP over TLS
- Clipboard
- Copy-out blocked, clipboard cleared after 5 minutes (live tests pending)
- Backups
- Identity server backed up nightly, encrypted, off-host
- Network
- Outbound-only Cloudflare Tunnel, no open ports
- RDP / VNC
- Never exposed to the internet
- Baseline
- DISA STIG + OpenSCAP: applied to the reference desktop and at image build time
- Disk encryption
- LUKS on image-built desktops, unlocked by the vTPM; cluster nodes next
- Audit
- Sign-ins and connections logged; session recording next
Michael Olszewski
PharmD, BCPS, BCCCP
Clinical Pharmacist Specialist
Clinical AI & DevOps Engineer
Charlotte area, NC
AWS Certified Solutions Architect – Associate (SAA-C03)In progress
The founder
Two decades in acute care, now building the systems behind it.
Michael Olszewski is a dual board-certified clinical pharmacist with two decades in critical care and infectious disease pharmacy. For eight years he led an antimicrobial stewardship program. He is also the engineer who builds LocumView: the identity layer, the desktops, the cluster they run on, and the documentation behind every change.
LocumView comes from the gap between those two jobs: the extra logins, the copied numbers, the alerts that arrive too late or too often.
See it running
See it running.
Request demo access
Share a few details and we will email guest credentials for the live demo. Questions about pilots, deployment, or partnerships are welcome too.
[email protected]