KFSH Employees

A hospital runs on shifts. The employee app was organised by department. Sixteen thousand people walked the difference.

Role: Design & research, product team
Year: 2025–now
Platform: iOS & Android
Type: Product design
Impact: 16K+ employees on it, 40+ screens shipped, 5 areas replace a menu

① At a glance

The problem. A hospital runs on shifts. The employee app was organised by department, so six of the most common tasks happened somewhere else.

What I did. Rebuilt it around the shift. Attendance, credentials, HR self-service, the directory, oncall escalation and a policy assistant, behind one login.

What changed.Live on iOS and Android with more than 16,000 employees on it. The walk to HR for a payslip is a tap. The 02:40 punch has a route.

16K+employees on it

40+screens shipped

5areas replace a menu

01 · context

② The app opened. Then the walking started.

Someone comes off a night shift and opens the app to correct a punch they missed at 02:40. There is nothing in there for it. The correction is an email to a manager, the manager reads it in the morning, and the fix lands on a payslip a fortnight later.

KFSH&RC already had an employee app. It was dated and partial. You could open it, look at a little, and then still go somewhere else for the thing you actually came for. A payslip. An employment letter. A policy answer. Proof of who you were at a locked door. A clinical workforce does not carry a laptop around a hospital, so every gap in the app became a phone call, a walk, or a ticket for someone in HR to close.

The app was not missing features. It was ordered by who owns a service rather than by when a person needs one.

Still done somewhere else

Payslipwalk to HR

Employment letterraise a ticket

Proof of IDplastic badge

Policy questionphone a colleague

Missed punchemail a manager

Who is oncall?printed rota

Six of the most common tasks: none of them in the app

METHOD	WITH	Where	WHEN
Shadowing and semi-structured interviews	Clinical and non-clinical staff 11 users	KFSH	2026

The day has a shape: arrive, prove who you are, work, need an answer, leave. The old app was ordered by department instead.

RESEARCH: HOW THE SHAPE OF A SHIFT WAS ESTABLISHED

STAGE	ARRIVE	PROVE WHO	WORK	NEED AN ANSWER	LEAVE
DOING	Punch in at a wall terminal, or in the old app	Carry a plastic badge for doors and checks	Need a payslip, a letter, the rota	Ask a colleague what the policy says	Punch out, hope it registered
WHERE IT BREAKS	A missed punch has no path. It becomes an email to a manager.	Badge left at home means a locked door and a phone call.	Each one lives elsewhere: an HR office, a ticket, a printed rota.	The answer depends on who you ask, and carries no source.	Same gap as arrival, discovered a fortnight later on the payslip.
OPPORTUNITY	Punch in and out above the fold. Justify Absence gets its own route.	The phone becomes the badge: door access, mask fit, safety cards.	One Home, quick access ordered by how often a thing is needed.	PolicyGPT: answer first, source second, policy document is authority.	The day’s record sits in the same place the punch does.

CURRENT STATE: ONE SHIFT, FIVE STAGES. FRICTION MARKED WHERE THE APP STOPPED AND THE BUILDING STARTED

02 · approach

③ The unit of design is a shift, not a department

WHAT WE SAW	WHAT IT MEANT	WHAT CHANGED
Staff opened the app, then still walked to an office or phoned someone.	The app was a directory of departments, not a container for the day.	Five areas built around the shift, not the org chart.
Every person asked about policy asked a colleague first.	The trusted source was a person, and people are not available at 3am.	PolicyGPT, with the source document shown beside every answer.
A forgotten plastic badge stopped someone at a door.	Identity was the one thing that could not fail, and it lived on plastic.	Digital badge and door access, states drawn to be unambiguous.
A missed punch became an email to a manager, found weeks later.	The error path was outside the product, so it was invisible and slow.	Justify Absence as a first-class route, not a dead end.

SYNTHESIS: FOUR OBSERVATIONS, WHAT EACH ONE MEANT, AND THE DECISION IT FORCED

the shift, not the department

Where the day actually goes

01Start with the day, not the backlog

Shadowing first, then interviews, with clinical and non-clinical staff. The question was never what people wanted from an app. It was what a day contains: arrive, prove who you are, work, need an answer, leave. The old app served pieces of that, in an order that matched the org chart. Nobody’s day is ordered by department.

One shift, end to end

ArrivePunch inJustify a missed punch

IdentifyDigital badgeDoor access

WorkOncall escalationDirectoryReport incident

AskPolicy questionPayslip / letter

LeavePunch out

SHIFT MAP: THE TASKS A WORKING DAY ACTUALLY CONTAINS

02Five areas, each named for a moment

Home for the day, HR for the record, PolicyGPT for the question, Directory for the person, Oncall for the escalation. Everything else sits on Home as quick access, ordered by how often a thing is needed. Ordering by owning department is easier to defend in a meeting and worse for everyone who has to use the result.

KFSH Employees

Home

Attendance
Punch in / out
Justify absence
Quick access grid
Report incident
Dispense water

My information
Payslip
Letters
ESC membership
Management levels

PolicyGPT

Ask a question
Answer + source
Generated-text notice
Error state

Directory

Search staff
Department
Contact card

Oncall

Today's rota
Level one
Level two
Escalate

Five areas in the bottom nav. Everything else reached from Home

IA MAP: FIVE AREAS AND WHAT SITS UNDER EACH

HOME	HR	POLICYGPT	DIRECTORY	ONCALL
Punch in / out	Payslips	Ask	Search staff	Who is on now
Justify Absence	Employment letters	Answer + source	Extension	Rota by unit
Quick access	Leave balance	Generated notice	Department	Contact
Announcements	Requests	Policy library	Location	Handover

Everything else sits on Home as quick access, ordered by how often it is needed rather than by which department owns it.

FIVE AREAS INSTEAD OF A MENU: EACH ONE NAMED FOR A MOMENT IN THE DAY, NOT A DEPARTMENT

03Argue about sequence before anyone argues about colour

Low fidelity, in grey, on purpose. Attendance, the policy assistant and the credentials set were drawn and redrawn before any visual design began. Three flows carry most of the traffic, and the other thirty-seven screens follow whatever those three establish.

LOW-FIDELITY: ATTENDANCE, POLICYGPT, CREDENTIALS

what they opened it for

Attendance, policy, credentials

04Attendance: the thing most people opened it for

Punch in and punch out sit above the fold with the time and the date. The missed punch, the case that used to become an email, gets its own route: Justify Absence. An error path that lives outside the product is invisible to the people who could fix it, and invisible means slow.

Punched in and out — ATTENDANCE: PUNCH IN, PUNCH OUT, JUSTIFY ABSENCE

05PolicyGPT: an answer you are allowed to check

An assistant over HR policy is only useful if people trust it, and trust here means being able to see where an answer came from. Answer first, source second, and a standing notice that the text is generated and the policy document is the authority. The trusted source before this was a colleague, and colleagues are not available at 3am.

Answer and consent — POLICYGPT: ANSWER, SOURCE, AND THE STANDING NOTICE

Notice — POLICYGPT: ANSWER, SOURCE, AND THE STANDING NOTICE

06Credentials: the phone becomes the badge

Digital badge, door access, mask fit and safety reference cards in one place, designed for the conditions they get used in. One hand. A corridor. A locked door. Someone waiting behind you. The door access states are drawn to be unambiguous, because a maybe at a door is worse than a no.

03 · outcome

④ One app that holds the whole shift

Live on iOS and Android, with more than 16,000 employees on it. Attendance, HR self-service, credentials, the staff directory, oncall escalation and the policy assistant now sit behind one login. The walk to HR for a payslip is a tap. The 02:40 punch has a route.

04 · what I’d do differently

⑤ What I’d do differently

Test the policy assistant with the people who answer policy questions today, not only the people who ask them. HR officers know which questions actually get asked and which answers get argued with. We tested with the askers and shipped something that answers them well. The people who would have caught the hard cases were down the corridor the whole time.

KFSH Employees

① At a glance

② The app opened. Then the walking started.

③ The unit of design is a shift, not a department

Where the day actually goes

01Start with the day, not the backlog

02Five areas, each named for a moment

03Argue about sequence before anyone argues about colour

Attendance, policy, credentials

04Attendance: the thing most people opened it for

05PolicyGPT: an answer you are allowed to check

06Credentials: the phone becomes the badge

④ One app that holds the whole shift

⑤ What I’d do differently

Case 02 · Patient Kiosks