One QR code. Every record. Under 3 seconds.

The problem

India's healthcare system is deeply fragmented. A patient seeing a specialist in Bengaluru carries physical files from their GP in Mysuru. Lab reports live in WhatsApp folders. Prescriptions get photographed and lost. When someone arrives unconscious at an emergency room, the attending doctor has nothing — no allergies, no medications, no prior diagnoses, no blood type.

The government's ABHA (Ayushman Bharat Health Account) initiative was a step in the right direction, but adoption was low and the UX was clinical-facing, not patient-facing. There was no consumer layer that made it easy for an ordinary person to gather, organise, and share their own health history.

The brief was to build that consumer layer — a mobile-first platform where patients own and control their records, and doctors can access exactly what they need, when they need it, with explicit patient consent.

What we built

Every patient gets a QR code that is the entry point to their medical profile. In an emergency, a paramedic or ER doctor scans the code and retrieves a pre-consented emergency summary — blood type, known allergies, current medications, recent diagnoses — in under 3 seconds, without requiring the patient to be conscious or present. The emergency payload is a minimal encrypted bundle stored for fast retrieval separately from the full record.

For routine care, the consent model is granular. A patient can share their full history with their GP, share only their current medications with a pharmacist, and share only their latest lab results with a specialist — each as a time-limited, revocable access grant. Doctors see a structured view with timeline, notes, attachments, and prescription history. Patients see every access event logged.

All records are encrypted at rest with AES-256-GCM. Documents (scanned reports, prescription photos, imaging) are stored in encrypted S3 buckets. The ABHA API integration lets users link their government health ID and import any records already registered under their ABHA number.

The doctor-facing app is a separate view within the same platform — verified through a medical registration number check flow. Over 500 doctors onboarded, generating a real network effect: patients upload records their doctors can see, doctors add clinical notes patients can carry forward.

Security model

Patient data is the most sensitive category of personal information that exists. Every architectural decision reflected this. Encryption at rest (AES-256-GCM), encryption in transit (TLS 1.3), short-lived JWT access tokens, consent tokens scoped to specific record sets with expiry, and a full audit log of every data access event.

Row-level security via Supabase ensures no patient record is ever accessible from another patient's session — not through misconfiguration, not through an API bug. The only exceptions are explicitly granted consent tokens, and those are audited.

Tech stack