It is 09:14 on a Tuesday morning at Oja Oba market in Akure. Mama Tola has been at her tomato stall since five. Her chest has been tight since seven. She is forty-five, sells tomatoes six days a week, and the last time she sat in a public-hospital queue she lost half a day's trade and went home with paracetamol. Today the pain is worse than usual. She also cannot afford to close the stall for a four-hour wait.
She walks five minutes across the square to a small lit room with a green awning. Inside is a nurse named Tola, a chair, a blood-pressure cuff, a tablet, and a monitor on the wall with a doctor's face on it. The doctor is in Lagos. The pharmacist is across town. Behind the monitor sits an architecture nobody in the room thinks about while Mama Tola is being seen, which is the right outcome — the architecture is doing its job when it disappears.
This piece walks through that architecture. The shape of the kiosk, the bridge to the remote doctor, the AI tier that listens and writes the notes, the pharmacist gate that decides what comes off the shelf, and the patient record that remembers her for the next visit. The point of the design is not the AI. The point is the asymmetry the AI dissolves — that Mama Tola can be seen by a doctor without losing her stall.
Key takeaways
- The hybrid micro-clinic sits between three failure modes — the standalone GP clinic that breaks when the doctor migrates, the pure telemedicine app that cannot draw blood, and the public-hospital queue that costs the patient half a day. The kiosk is the physical anchor; the remote doctor is the clinical authority; the AI tier compresses the cost.
- The architecture is six layers — physical kiosk, video bridge, transcription, clinical-note generation, pharmacist approval gate, and patient history. Each is a distinct decision and each gets the regulatory framing it deserves before any code ships.
- The AI tier runs African-first. Whisper hosted at AWS Cape Town or a Lagos co-location handles transcription. Local LLMs — YarnGPT, Awarri, Lelapa Vulavula, fine-tuned Llama-3 for Yoruba, Igbo, Hausa, and Pidgin — generate the clinical note by default. Frontier models reached through Bedrock-Frankfurt are the escalation tier, with explicit patient consent and NDPA Section 41–43 paperwork.
- The pharmacist-in-the-loop is the load-bearing safety primitive. The AI does not prescribe. The doctor prescribes. The pharmacist reviews and can veto. The dispensing log is the audit chain.
- The patient record stays in Nigeria. Postgres with column-level encryption, HSM-backed keys, FHIR-portable schema from day one. Cross-border transfer happens only through the escalation tier and only with consent — and even then, only the structured transcript crosses, never the persistent record.
Six Hours She Cannot Spare
The shape of the problem is not technical. A market woman in Akure earns four to eight thousand naira a day from her stall. A public-hospital visit costs her a morning of trade plus the queue itself plus the medicine. A private GP clinic costs her fifteen thousand naira a visit when she can find one open. The standalone neighbourhood clinic she trusted last year closed when the doctor moved to Manchester. The telemedicine app her son installed for her cannot take her blood pressure, cannot draw the blood sample her diabetes diagnosis needs, and cannot put medicine in her hand on the way out.
Each of these failure modes is a real product the market has tried. None of them serve Mama Tola. The architecture below is not a feature improvement over any one of them — it is a different shape of clinic, with the AI tier as the compression layer that makes the unit economics work for a patient paying three thousand naira for a visit rather than fifteen.
Inside the Room
The kiosk is a small lit space, four or five square metres, with a door that locks and a window with the green awning above it. Inside there is a chair for the patient, a chair for the nurse, a small examination bed that folds against the wall, a digital BP cuff, a glucometer with strips, a pulse oximeter, a digital thermometer, a basic ECG, and a webcam-and-headset terminal facing the patient seat. There is a locked dispensary cabinet behind a roll-down shutter. There is a Starlink Mini on the roof and a 4G modem in the corner — both running, because the consultation cannot fail when the network does.
The nurse runs the room. She greets the patient, takes vitals, draws blood if the doctor will order labs, dispenses the medication the pharmacist clears, and is the human anchor the patient walked in to see. The remote doctor is the clinical authority. The AI tier is invisible to the patient and almost invisible to the nurse — it runs in the background, transcribes what is said, drafts the note for the doctor to confirm, and surfaces a triage suggestion only when asked.
This shape — physical anchor plus remote authority plus background AI — is what makes the unit economics work. The clinic does not need a full-time doctor on-site. The patient does not need to travel to where one is. The room is open six hours a day, six days a week, and serves between fifteen and forty patients a day depending on the market's rhythm.
The Cable to the Doctor
The video link is Zoom Healthcare with a Business Associate Agreement, hosted by Zoom on US infrastructure. We chose Zoom because building a sovereign video stack from scratch is not where the engineering budget should sit when the market is waiting to be served, and because the Zoom audio pipeline is the most well-understood telehealth surface in the world. We accept the trade-off and we name it — Zoom traffic egresses to the United States, which means the live consultation crosses borders under NDPA Section 41–43.
That trade-off is paid for with three controls. First, an explicit patient consent screen at enrolment that says, in Yoruba, Igbo, Hausa, English, and Nigerian Pidgin, that the consultation video and audio will be processed by Zoom outside Nigeria, and what that means. Second, video retention is set to zero by default — Zoom does not retain the video; only the locally-captured audio reaches our transcription tier. Third, the consultation record itself — the structured clinical note, the prescription, the patient history — never leaves Nigeria.
A sovereign or self-hosted video plane — LiveKit, Jitsi, or a custom SFU at AWS Cape Town — is the production answer for V2. We do not start there because the operational maturity gap between Zoom and a self-hosted SFU is wider than the regulatory marginal benefit when only the audio stream is retained. When the pilot proves out, we migrate. We do not migrate first and discover the pilot does not work.
Whisper in Yoruba, Igbo, Hausa, Pidgin
The audio from the consultation feeds Whisper. We host Whisper ourselves — not the OpenAI API — at AWS Cape Town in af-south-1 by default, with a Lagos co-location as a planned alternative once the volume justifies the bandwidth contract. Base Whisper handles Nigerian-accented English reasonably. A fine-tuned variant — drawn from the open-source African-language work coming out of Lelapa and several Hugging Face contributors — improves materially on Yoruba, Igbo, Hausa, and Pidgin.
The reason this matters is not transcription accuracy in the abstract. It is that Mama Tola does not describe her symptoms in clinical English. She describes them in the language she lives in. A transcription tier that loses the texture of how she says she feels is a transcription tier that hands the LLM downstream a sanitised version of the consultation that no longer carries the information the doctor heard. We optimise for the doctor receiving the same texture in the note that they heard in the consult.
Audio reaches the transcription tier over an in-country private link. It does not touch the public internet. The transcript is structured — speaker-separated, time-stamped, vitals annotated by the nurse — and is stored locally before the clinical-note tier sees it.
The Local Model Sees First
The architectural inversion that gives Sirehs its data-sovereignty story sits at the clinical-note layer. The local-model tier is the default. The frontier tier is the exception.
The default flow is this. After the consultation ends, the structured transcript is handed to a local LLM — YarnGPT, Awarri's foundation model, Lelapa's Vulavula, or a fine-tuned Llama-3-70B running in-country — to produce a draft clinical note in the doctor's preferred format, plus a triage suggestion, plus any flagged red-line concerns. The local model never crosses a border. The doctor receives the draft, edits it, signs it, and the note is committed to the patient record.
The escalation path runs only when the local-model tier reports low confidence or the case complexity exceeds the boundary the doctor has configured. The structured transcript — not the audio, not the patient's identifying data, not the full record — is sent to Claude via Bedrock-Frankfurt. The patient is informed that the case is being escalated to a frontier model in the European Union. Standard Contractual Clauses cover the transfer. The NDPC notification flow is automated. The frontier model returns a note. The doctor signs.
This inversion is the difference between an architecture that uses African AI and an architecture that has a banner saying built in Africa. Most healthcare-AI products in this space default to OpenAI or Anthropic and route nothing to local labs. Sirehs defaults to the local tier and only reaches outside when the local tier cannot answer. The sovereignty is structural, not decorative.
The Pharmacist's No
The AI tier writes notes. It does not prescribe. The doctor prescribes. The pharmacist reviews the prescription before it is dispensed and has unconditional veto power.
This is the load-bearing safety primitive of the entire architecture. Every prescription, regardless of how confident the doctor was or how clean the AI's note was, lands in a queue belonging to a partner pharmacist — a NAFDAC-registered superintendent pharmacist who has signed a processor agreement with the operating entity. The pharmacist sees the prescription, the patient's drug history, the active medications, the relevant allergies, and any flags the AI tier surfaced about possible interactions. If they approve, the dispensary unlocks and the nurse hands the medication to Mama Tola on her way out. If they decline, the prescription is returned to the doctor with a note explaining why.
This is what stops AI hallucination from reaching the patient. It is also what survives a Nigerian regulatory audit. The dispensing log carries the doctor's signature, the pharmacist's signature, and the AI tier's involvement as a separate field on the audit chain. If a wrong drug is dispensed, the chain says who decided. If a right drug is dispensed against the AI's suggestion, the chain says who overrode. The principal-of-record discipline we apply to AI agents in other domains — the chain of who is on the cheque — applies here unchanged.
The Notebook Comes Back
Mama Tola's record stays in Nigeria. Always. The consultation note, the prescription, the dispensing log, the lab results, the visit history — all live in a Postgres instance hosted at AWS Cape Town initially and at a Lagos co-location once volume justifies it. Column-level encryption protects the sensitive fields. The encryption keys live in a Hardware Security Module that does not leave the country. The schema is FHIR R4-portable from day one, because the interoperability backbone is a future-Sirehs problem and the schema choice that makes it possible has to be made before the first record is written.
When Mama Tola comes back in two weeks, the nurse pulls her record on the tablet. The next doctor — possibly a different one from the queue — sees her history, her trend, the last visit's note, the pharmacist's reasoning on the last prescription. The continuity that a single neighbourhood GP would have provided, before the GP migrated to Manchester, is provided structurally by the record. The doctor changes; the notebook does not.
Cross-border data transfer happens only when the escalation tier is invoked, only with consent, only with the structured transcript, never with the full record. This is what NDPA Section 41–43 looks like when it is engineered, not described.
What the AI Is Not
The architecture above will be tempting to read as an AI clinic. It is not. The AI does three things and only three things — it transcribes the consultation, it drafts a clinical note for the doctor's signature, and it surfaces a triage suggestion the doctor may consider. It does not diagnose. It does not prescribe. It does not decide what to dispense.
There are three reasons this boundary is hard, not soft. The first is regulatory. The Nigerian Medical and Dental Council is the licensing authority for diagnosis and prescribing in Nigeria. An AI tier that claims either crosses a licensing surface for which no AI vendor in the world is currently licensed, and no Nigerian regulator is currently prepared to license. The second is clinical safety. LLM hallucination at the local tier is real, and the African-language fine-tunes are newer and less battle-tested than the frontier models. The pharmacist gate exists precisely because the model can be wrong and the patient must not pay for the model being wrong. The third is trust. Mama Tola walked into the room because there was a person in it. She did not walk in to be seen by a chatbot. The AI is in the room because it makes the doctor and the pharmacist more available — not because it replaces them.
Where Sirehs goes next is the operating model. The kiosk shape works at one location with one nurse and one rotating doctor pool, which is what the pilot is built for. The follow-up piece in this series walks through the operating model that takes this shape and turns it into a network — and it makes a different architectural commitment along the way, because the kiosk that stays still is not the only answer to the problem the kiosk solves.
FAQs
Why does the AI tier not prescribe directly when the model is confident?
Because confidence is not authorisation. The Nigerian Medical and Dental Council licenses doctors to prescribe and the Pharmacists Council licenses pharmacists to dispense. No regulator anywhere has licensed an AI to do either. Even if the model is right ninety-five per cent of the time, the architecture has to answer the question of who carries the licence and the liability when the model is wrong, and the answer cannot be the model.
Why Zoom instead of a sovereign video stack from day one?
Because the operational maturity gap between Zoom and a self-hosted SFU is wider than the regulatory marginal benefit at pilot scale. Zoom retention is set to zero, the audio is captured locally for the transcription tier, and the structured patient record never leaves Nigeria. We name the trade-off explicitly in the patient consent flow and we plan the migration to a sovereign video plane for V2. We do not migrate first and discover the pilot does not work.
What happens when the local LLM tier is down or returns low confidence?
The doctor still sees the patient. The note is drafted manually, or the case is escalated to the frontier tier — Claude via Bedrock-Frankfurt — with explicit patient consent and NDPC notification. The escalation tier is the exception, not the default. The architecture is designed to degrade to a human-only flow without breaking, because the network and the local model will fail at some point and the consultation must not.
Is the pharmacist always available in real time?
The partner pharmacist works on a queue with a service-level commitment — typically under five minutes for routine prescriptions during operating hours. For acute cases that require immediate dispensing, the doctor can mark a prescription as time-sensitive and the partner pharmacist gets a push notification with a higher response priority. The architecture treats the pharmacist as a tier in the SLA, not as a manual checkpoint, because the queue cannot become the bottleneck that defeats the unit economics.
How does the patient history layer handle a patient who visits a different kiosk?
The record is keyed on the patient's identity, not on the kiosk. When the patient enrols at any Sirehs location, the consent flow includes cross-location lookup. The next nurse at the next kiosk pulls the same record. The architecture is designed for a single network of kiosks under one operator from the start, because the alternative — a record per kiosk — recreates the standalone-clinic problem that the network was supposed to fix.
Companion content
- When the Clinic Comes to Oja Oba: The Sire Mobile Unit Operating Model — Part 2, the operating-model evolution from kiosk to mobile network
- IAM for AI Agents: Delegation and the Principal-of-Record Chain — the audit-chain pattern Sirehs reuses for clinical actors
- The AI Act Enforcement Cliff: The August 2026 Deadline — regulatory pattern adjacent to NDPA Section 41–43
- DSPM Meets RAG: Data Classification in the Knowledge Base Era — the data-classification discipline behind the in-country patient record
How to engage
Sirehs is a CreativeMinds-incubated project building toward a pilot at a Nigerian market. We are working through ten Phase 0 items — NMDCN licensing scope, NAFDAC pharmacy partnership, NDPA Section 65 designation, clinical advisory board, medical co-founder, pilot site agreement, unit economics, local-LLM benchmark, model availability SLA, and African-AI lab partnership scope — before any code is committed. If you operate in Nigerian primary care, telemedicine, regulatory advisory, or African-AI infrastructure and the architecture above is in your zone, talk to us at creativeminds.dev/contact. The Phase 0 work is collaborative, and the partnerships that make the pilot possible are the partnerships that will make the network worth building.