Slotback
Freed hospital appointment slots, returned to the waiting list in the hospital’s order, with proof.
Overview
End-to-end deployment of a voice AI agent for a fictional Spanish public hospital, Hospital General (fictional), part of a regional public health service in Spain: from account research and business case to a working system, an eval gate, real recorded calls and a pilot plan. An independent reference deployment, built on synthetic data.
At a glance
- 14 of 14freed slots refilled from the waiting list, in list orderSimulated · one synthetic clinic day
- 14 vs 3.7freed slots refilled: voice loop against SMS reminders only. After the slots staff would refill anyway, 9 are billableSimulated · one synthetic day
- €3.54platform cost per refilled slot (€5.51 per billable slot); excludes telephony and integrationSimulated
- 15/15 · 0release-gate scenarios pass · privacy leaks: 12 tool tests on real Postgres and 3 simulated text conversationsEval runs
- 2 callsreal phone calls recorded; the first one found 4 bugs that simulations missedReal calls
- 1,707ledger events, independently verifiableSimulated · synthetic day
The problem
Patients miss specialist appointments in Spanish public healthcare. No-show rates run from 5.75% (Galicia, 2024) to 14.6% (2011 study), depending on region and year. In the best-documented case, a 2013–14 study of one Andalusian health area, 13.8% of 400,761 appointments were missed, at about €61 per missed visit, and 46% of no-shows came from patients forgetting or never getting the message. These are benchmarks from other regions, not Slotback results.
Reminder calls work, but admissions staff cannot make enough of them, and a slot freed the day before is hard to refill in time. SMS is cheaper against forgetting, but most reminder messages are one-way: even when a patient can cancel by reply, the text cannot hand the slot to the next person on the waiting list.
The insight: do not build a better reminder. Build the loop SMS cannot run: confirm, take the cancellation, and refill the slot from the waiting list before the day, in the hospital’s order.
What I built
An outbound voice agent on ElevenLabs Agents calls patients a few days before their specialist appointment to confirm, cancel or reschedule it. When a slot frees up, it calls the hospital’s waiting list strictly in order and offers the slot, holding it for 10 minutes per person. Every step is written to a signed, hash-chained ledger that the hospital or an auditor can verify.
My role
I ran the whole deployment lifecycle on one problem, not just the voice demo.
- Account research. Problem sizing with sourced public figures, a stakeholder map (hospital director, head of admissions, IT, data protection officer, works council, patient advocate) and buying triggers.
- Discovery. Interview guides per stakeholder, a current-state admissions process map, and the baseline metrics to request.
- Use-case prioritisation. Six candidates scored on value, feasibility and risk. Clinical triage was excluded as a patient-safety risk.
- Business case and commercials. An interactive ROI model; pricing per verified recovered slot (outcome-based) against per minute; a public procurement route (a small pilot contract under the contrato menor threshold, then an open tender) with a draft technical tender specification in Spanish. Business case ↗ · Tender spec (ES) ↗
- Solution design and compliance. Architecture, security, failure modes, FHIR R4 mapping and a DPIA draft. GDPR Art. 6.1.e and 9.2.h, EU AI Act Art. 50 disclosure, and a design aimed at staying outside the AI Act Annex III high-risk area. Production hosting in the EU on ENS-conformant infrastructure, with no transfers outside the EU, and a price cap that keeps the pilot under the contrato menor limit. Solution design ↗ · DPIA draft ↗
- Prototype. The working system (stack below).
- Evals. A release gate with deterministic checks, a leak detector and live conversation tests. Evals method ↗
- Real calls. Recorded, reviewed line by line, with bugs fixed the same day. Demo calls ↗
- Pilot plan. 90 days, one specialty, an SMS-only control group, go/no-go criteria and a kill switch. 90-day pilot plan ↗
- Executive readout. About 10 slides and a memo for the hospital director, Spanish first. Readout (ES) ↗ · Readout (EN) ↗
- Feedback to Product. Field notes to the platform’s product team, for example on speech recognition for elderly Spanish speakers, voicemail detection, and connectors for hospital information systems. Field notes ↗
Key design decisions
Where the judgement is.
The agent never decides priority.
It offers freed slots only in the order of the hospital’s own list, and never reorders, scores or removes anyone. A lockout only stops automated calls and flags the patient to admissions staff, who follow up. The design aims to stay outside the AI Act’s high-risk use for access to public services; that needs legal review before a pilot. The ledger shows each offer matched the list snapshot taken when the slot was freed.
Pay per verified outcome.
A slot is billable only if the agent refilled it, the patient attended, and it matches the hospital’s own booking record, minus what staff would have refilled anyway.
Safeguards live in code, not just in the prompt.
Each call carries a token bound to one patient, and identity (date of birth plus part of the ID) is checked server-side before anything is disclosed; even the specialty counts as health data. Two failed attempts end the call, and three failed calls in 24 hours lock the patient. Voicemail or a relative gets only a callback number, and medical questions go to a person. In the first real call, the server refused an action the agent should not have taken: the guard held even though the prompt was wrong.
A tamper-evident ledger.
A per-day SHA-256 hash chain with an Ed25519-signed head. A command-line verifier checks four things: the chain is intact, identity was verified before any detail, offers followed list order, and the head is signed. Change one event and verification fails at exactly that line.
Config as code.
Prompt fragments compose into four agent profiles (demo and production reference, outbound and inbound). Tool schemas are generated from the API models, and CI fails if the configs drift.
Its reusable part became a kit.
The ledger, safety defaults, release gate, deploy checks and call review moved into voiceops, an open-source kit, with no change in Slotback’s behaviour; a second deployment then went live on it.
Every number has a provenance.
SIMULATED, BENCHMARK, SYNTHETIC, MEASURED or ASSUMPTION, carried from one registry into every document and page.
Hear it
Real calls.
Two real calls through Twilio to my own phone. I play a synthetic patient. The agent speaks Spanish. Each call starts with a short Twilio trial-account notice in English before the agent speaks.
The full flow: AI disclosure → identity check → reads the appointment → offers three slots → reads back → moves it in the live system → declines a medical question (“do I need to fast?”) and books an admissions callback → hangs up by itself.
All 15 simulated evals had passed. The first real call still found four problems: an English voice reading Spanish, a confirmation call treated as a waiting-list offer, a “transfer” that did not exist, and no way to hang up. All four were fixed the same day; call 02 is the result.
Evals: a release gate, not a demo Simulated
- Gate PASS, 15/15 (simulated): 12 tool-level scenarios against real Postgres (social engineering, prompt injection, two patients racing for one slot, a late accept after the hold expired, lockout, voicemail, wrong number, opt-out, cancel-then-backfill in order) and 3 conversation scenarios on ElevenLabs Tests against the live agent, run as simulated text conversations (an elderly patient who is hard of hearing, an angry patient, a switch to Romanian).
- My own deterministic checks run on every transcript, because the platform’s judge is advisory only: the AI is disclosed first, and a privacy-leak detector (Spanish, English, Romanian and Arabic) must catch 16/16 planted leaks with 0 false alarms before its “0 leaks” result counts.
- A scenario that did not run is never counted as a pass: PASS, FAIL or ERRORED.
- What evals caught: an angry caller was not offered a person, so I fixed the prompt structure. What only real calls caught: the four bugs in call 01. Simulations are necessary, not sufficient.
Results on one synthetic clinic day Simulated
| Appointments / confirmation calls | 400 / 400 |
|---|---|
| Calls answered | 68.5% |
| Slots freed by a cancellation during the call | 14 |
| Refilled from the waiting list, in list order | 14 (median 11 min) |
| Billable after attendance and staff baseline | 9 |
| SMS-only counterfactual | 3.7 |
| Identity-before-detail violations found by the ledger verifier | 0 |
| Estimated platform cost per refilled slot (per billable slot) | €3.54 (€5.51) |
The 90-day pilot plan is how these would become measured numbers: one high no-show specialty, against an SMS-only control group, with go/no-go criteria and a kill switch.
Architecture
Tech stack
- Python 3.12
- uv
- FastAPI
- PostgreSQL (psycopg 3)
- Jinja2 + vanilla JS dashboard (EN/ES)
- ElevenLabs Agents (voice, tools, Tests API, webhooks)
- Twilio
- SHA-256 hash chain + Ed25519 signatures
- pytest + Hypothesis property tests (117 tests)
- Ruff
- GitHub Actions CI
- Docker
- Render (EU)
- Hugging Face Spaces
Screens
Screens from the live dashboard, running on a synthetic clinic day.
What I’d do next
- Measure voice-level latency (only text-test latency is measured so far).
- Calibrate the platform’s built-in judge against about 20 hand-labelled transcripts.
- Run the real 90-day pilot: the only way simulated numbers become measured ones.
Fictional hospital, synthetic data only. Slotback performance figures are simulated and labelled as such. Public figures are benchmarks from other Spanish regions, with source and year. Sources: Jabalera Mesa (2015), doctoral thesis, Universidad de Málaga, data 2013–14; Galicia region 2024 figures (press report, Jan 2025); Pereira-Victorio et al. (2016), data from Aug 2011. ElevenLabs is the voice-agent platform used; this is an independent project, not endorsed or sponsored by ElevenLabs.
Next projectvoiceops