Ask a doctor how they sent a colleague that X-ray last week and you’ll usually get a sheepish answer: WhatsApp. Ask how the patient sent the photo of their healing wound, and it’s the same. Clinical communication has quietly migrated onto consumer messengers — because they’re free, everyone has one, and they work.

They’re also a confidentiality problem hiding in plain sight. Patient images and clinical discussions end up on a third party’s servers, in another jurisdiction, on personal phones, in the same app as family group chats. The clinic doesn’t control where the data lives, how long it’s kept, or who could be compelled to hand it over. Most practices know this. They keep doing it anyway, because the compliant alternative was a six-figure enterprise contract or nothing at all.

There’s a third option worth knowing about: a self-hosted, end-to-end encrypted messaging framework you run yourself. VBWD‘s messaging plugins — meinchat and meinchat-plus — are open, source-available components designed for exactly this shape of problem. Here’s an honest look at what they do, and just as importantly, what they don’t.

What “end-to-end” actually means here

The claim that matters, stated plainly in the project’s own documentation: the server holds no keys and never encrypts or decrypts. Clients encrypt. The server checks that the sealed envelope is a legal shape and size, stores it, passes it on, and tracks delivery. That’s its entire role.

Read that again from a clinic’s perspective. It means your own server administrator cannot read a consultation. Neither can your hosting provider. Neither can anyone who obtains a copy of the database. The confidentiality doesn’t rest on a promise or a policy — it rests on the server not possessing the keys.

The encryption is a Signal-style double ratchet, the same broad design used by the messaging apps with the strongest privacy reputations. Around it sit the details that separate a real implementation from a demo: signed and one-time prekeys, so you can send a message to a colleague who’s offline and it decrypts correctly when they open their phone; padding of messages to fixed blocks, so an observer watching the traffic learns a message’s length only to within a block rather than exactly; a downgrade defence, so a client that demanded encryption refuses an answer that arrives unencrypted; and support for a second device, with biometric pairing on iOS.

One point of precision, because in security an imprecise claim is a false one: base meinchat is not end-to-end encrypted. It encrypts the message cache stored on the device, but the messages themselves pass through the server readable. End-to-end encryption comes from enabling meinchat-plus, a separate plugin that layers on top. For clinical use, that plugin isn’t optional — it’s the point.

Privacy that’s built in rather than promised

Three design decisions stand out for anyone handling patient information.

There is no way for an administrator to read conversations. The admin panel lets you manage nicknames, ban abusive accounts, and audit transfers. There is no screen anywhere that opens a doctor-patient thread. That’s not a permission you switch off — the feature doesn’t exist. A practice manager cannot read a consultation even if they want to.

Retention is short by default and yours to set. Server-side messages default to a two-day window, with a nightly job that hard-deletes them — no tombstones, no soft-delete graveyard quietly retaining what you thought was gone. Set it to zero and the server becomes effectively amnesic. That’s data minimisation as a default rather than an afterthought.

It runs on your infrastructure. Self-hosting means the data sits in a jurisdiction you chose, on hardware you control, with no third-party processor in the middle. For European practices weighing data-residency obligations, that’s a structurally different position from “a US vendor promises to store it in Frankfurt.”

What it fits: the conversation, not the consultation

Being clear-eyed about the shape of the tool matters more than listing features. meinchat has no video and no voice. It is text and images. It is not a video-visit platform, and if live consultations are what you need, this is the wrong tool and you should look elsewhere.

What it is good at is the enormous volume of clinical communication that isn’t a video visit:

• Doctor-to-patient follow-up — post-op check-ins, “does this look infected?”, medication questions, triage before a visit is booked. Photos travel as client-encrypted attachments.
• Doctor-to-doctor consults — the eConsult: a GP asking a dermatologist to glance at an image, a specialist second opinion, the informal question that currently happens over a consumer messenger.
• Multidisciplinary team discussion — group rooms for case conversations across a care team.
• Intake from someone who isn’t a patient yet — a public widget where a guest can start a conversation without an account.

Clinicians use web, iOS, or Android against the same backend, so the phone in a doctor’s pocket and the browser at reception are the same system, with one set of rules.

The bots — for admin, not diagnosis

The platform ships a bot framework that plugs into the messenger, and it’s worth understanding what’s appropriate here. A bot can answer questions grounded in your own documents — opening hours, preparation instructions, insurance and billing questions, what to bring — using full-text search over a corpus you supply. Notably, retrieval runs inside your own database: your document corpus isn’t shipped to an external search service.

There’s a hard safety boundary to state out loud. A retrieval bot answering “when should I stop eating before my procedure” is an administrative tool. It is not a diagnostic one, and it must never be presented to a patient as clinical advice. Triage and symptom assessment are regulated clinical activities with real consequences when they go wrong. Use the bot to take load off reception, not off the clinician.

One architectural detail deserves credit. The bot’s search can read your catalogue of services — and the platform’s core registry hard-blocks user records and invoices from ever being searchable, by refusing the registration outright. A bot cannot be misconfigured into searching your patient list or their billing, because there is no code path that would allow it.

The honest limits — read this part

Anyone selling you software for healthcare should tell you where it stops. So:

This is not a compliance product, and no software is. End-to-end encryption and self-hosting are strong technical foundations, but HIPAA, GDPR, or MDR compliance is an organisational achievement, not a feature you install. You’d still need your data protection impact assessment, your processor agreements, your access policies, staff training, and an audit trail. The software is a building block. Your practice remains the data controller and carries the responsibility.

This is not a certified medical device, and nothing here is validated for clinical decision-making.

The messenger must not be your medical record. This one is easy to get wrong and important to get right. Medical record-keeping laws require retaining records for years; this messenger defaults to deleting messages after days, deliberately, for privacy. Those two facts only coexist if you’re clear about roles: the record of truth is your EMR, and anything clinically significant gets documented there. The messenger is the conversation channel, not the chart. Treating a disappearing chat as a clinical record is how practices get into trouble.

Real encryption cuts both ways. If the server can’t read messages, the server also can’t recover them. A clinician who loses their device loses that history. That’s the honest cost of the guarantee, and any vendor offering both perfect confidentiality and full admin recovery is not offering the first one.

Self-hosting is real work. Someone patches the server, takes the backups, and holds the keys to the infrastructure. A practice without IT capability may genuinely be better served by a managed vendor with a signed agreement — and that’s a legitimate answer, not a failure.

Why it’s interesting anyway

The reason this matters isn’t that it’s free — it’s that the trade-off clinics have been living with was always false. The choice was never “consumer messenger or nothing.” It was that the alternatives were priced and packaged for hospital systems, so smaller practices used WhatsApp and hoped.

A source-available framework where the server provably cannot read your patients’ messages, where retention is yours to set, where no administrator can open a consultation, and where the data never leaves your jurisdiction is a different starting point. It doesn’t make you compliant, and it doesn’t do video. But for the everyday traffic of modern care — the photo, the follow-up question, the quick word with a colleague — it is a considerably better foundation than the app your patients also use to send memes.

The messaging plugins are source-available under the platform’s licence and free for commercial use below a defined revenue threshold. Technical details are in the developer documentation and the architecture overview; the source is on GitHub.

General information for practice and technology decision-makers, not legal, regulatory, or medical advice. Compliance obligations vary by country and speciality — consult your data protection officer and legal counsel before deploying any system that handles patient information.

You did not go to medical school to spend your evenings fighting a scheduling screen. Yet most clinicians now run their practice on software they do not control: a portal vendor holds the patient list, an appointment tool holds the calendar, a messaging add-on holds the conversations, and each one bills monthly while quietly deciding what you can export. When you want to move, you find out the data was never really yours.

VBWD takes the opposite starting point. It is a self-hosted, source-available platform you run on your own server, assembled from a small agnostic core plus plugins for the parts of practice life you actually use: booking, patient accounts, secure messaging, an on-site chatbot, membership care plans, and a loyalty credit system. This is a practical look at what a clinical day looks like on top of it, and an honest account of what it is and is not.

The problem: rented software, borrowed data

The frustration is rarely one big failure. It is the accumulation of small ones. A booking system that cannot express “I do not take new patients on Fridays.” A patient portal that emails you a CSV instead of an API. A messaging tool that stores threads in a jurisdiction you never chose. And the standing cost of administration: reminders that go out by hand, routine questions that interrupt a consultation, patients who cannot see their own next appointment without phoning reception.

Underneath all of it is lock-in. If the record of who your patients are, when they come, and what you have told them lives on someone else’s infrastructure, your practice is a tenant. VBWD is built so that the practice is the landlord.

Your calendar, your availability

Start with the part of the day you touch most: the schedule. The booking function is a plugin that models your availability, not a generic grid. You define when you see patients, how long each appointment type runs, and where the gaps are. Patients with an account can self-book into the slots you have opened, which removes a large share of the phone-and-callback churn without handing the calendar to a third party.

Because availability is yours to define, the awkward real-world rules fit: buffer time between patients, a hard stop before lunch, blocked mornings for home visits. You are not bending your week to match the tool’s assumptions. The booking and scheduling plugin is one of several you can enable or leave off depending on how your practice runs.

Patient accounts, and the patients who are yours

Every patient can have an account with their own portal: their upcoming appointments, their history with you, their messages. From the clinician side you see your patients — the people who belong to your practice — rather than a slice of some shared vendor pool. Access is governed by granular per-role permissions, so a receptionist, a nurse, and a physician each see exactly what their role warrants and nothing more. That separation matters both for privacy and for the plain question of who is allowed to open what.

The portal also does quiet administrative work. A patient who can see their own next visit, reschedule within your rules, and read a follow-up note is a patient who generates fewer interruptions. Less admin is not a slogan here; it is the direct result of giving patients a controlled window into the data that is already about them.

Secure messaging for follow-ups and results

The messenger is a plugin for secure doctor–patient communication: sending a follow-up, letting someone know results are ready to discuss, answering a logistical question between visits. Because it lives inside the same platform as the accounts and the calendar, a message is attached to a real patient in your practice, not floating in a separate inbox.

Be clear about the boundary. This is general secure communication. It is not a telemedicine system, not a clinical-decision tool, and not a substitute for examining a patient or exercising judgement. “Your results are back, let’s book a call” is what it is for. Diagnosis over chat is not. Keeping that line sharp protects both you and the patient.

A chatbot that only knows your practice

Routine questions are a tax on attention. Where are you located, do you take walk-ins, how do I prepare for this test, what are your hours over the holiday. VBWD includes an LLM-based retrieval chatbot grounded in your own practice content — your pages, your policies, your FAQs — so it answers from what you have actually published rather than from the open internet.

Two design choices are worth understanding. First, the bot rides a search seam that deliberately blocks privacy-sensitive slices of the system. It is built so a general-purpose assistant does not surface patient records; it should be talking about your opening hours, not about anyone’s chart. Second, retrieval runs through an LLM connection manager, so you decide which model backend answers and under what configuration. You can read how the retrieval and permission seams fit together in the platform architecture.

The honest caveat: a language model can be wrong. Keep a human path open. The bot is there to absorb the routine so you are interrupted less, not to be the last word on anything that matters clinically.

Care plans and a reason to come back

Two plugins address the business side of continuity without turning your practice into a storefront. Subscriptions and membership let you offer structured care plans — a recurring wellness membership, a managed-condition programme, a bundle of visits — billed on a schedule you define. For patients who want an ongoing relationship rather than one-off visits, this formalises it.

Alongside that sits a token, or credit, loyalty system. It rewards the behaviours a healthy practice depends on: returning for follow-up, keeping appointments, referring family or friends. Credits accrue and can be recognised in ways you set. It is a modest, optional layer, but for a practice that lives on long-term relationships it gives repeat engagement something concrete behind it. Both sit among the practice functions listed under the platform’s features.

The part that actually matters: you own the data

Here is the structural difference. VBWD is self-hosted. It runs on infrastructure you choose, on a stack of Python and Flask, PostgreSQL, Redis, and a Vue 3 front end, packaged with Docker. If you host it on EU-resident infrastructure, your patient data resides where you put it — data residency by architecture, not by a vendor’s promise. The practice is the data controller. There is no upstream company holding a copy and setting export terms.

The licensing follows the same logic. VBWD is source-available under BSL 1.1: free to run, including commercially, until attributable sales cross a defined threshold, and it converts to Apache-2.0 over time. You can read the source, audit what it does with patient data, and modify it. That is a categorically different relationship than a closed portal where you take the vendor’s word for how records are handled.

Honest limits

Ownership comes with responsibility, and you should hear the boundaries plainly.

• VBWD is not a certified electronic health record and not a medical device. It is a practice platform, not a clinical-records system with regulatory clearance.
• It makes no claim of HIPAA certification or any equivalent. Self-hosting on EU infrastructure gives you data residency and controller status; it does not by itself discharge your regulatory duties.
• Because you are the data controller, the lawful basis for processing, retention policy, consent, and any compliance obligations for clinical records remain your responsibility as the clinician or operator.
• The messenger is general secure communication, not telemedicine. The chatbot can be wrong and must never replace clinical judgement or a human contact route.
• Self-hosting means someone maintains the server, backups, and updates — you, or someone you pay. That is the price of control.

None of this is a reason to avoid the platform. It is a reason to run it with your eyes open, the same way you would adopt any tool that touches patient care. The documentation is the place to work through hosting, roles, and setup before you commit real patients to it.

The takeaway

A clinician’s version of “good software” is quiet: the calendar reflects how you actually work, patients handle their own bookings and see their own history, routine questions get answered before they reach you, follow-ups go out securely, and the record of it all sits on infrastructure you control. VBWD assembles that from parts you can turn on one at a time, on a source-available base you are free to inspect.

It will not sign your compliance paperwork or replace your judgement, and it does not pretend to. What it does is stop your practice from being a tenant in someone else’s system. For a doctor who wants less administration and genuine control over the relationship with each patient, that ownership is the whole point.

Learn more about VBWD

VBWD is a self-hosted, source-available platform for building subscription products, marketplaces, and AI-powered apps. Explore it further:

• Website and documentation: vbwd.cc — see the plugins, architecture, and developer docs.
• Source code and plugins on GitHub: github.com/VBWD-platform
• Watch VBWD in action: demo video 1 and demo video 2
• Follow the project on LinkedIn: linkedin.com/company/vbwd