Electronic health record
Mobile-first system with role-based access control, SOAP clinical notes, voice dictation and LGPD (Brazilian GDPR) compliance.
- Year
- 2025
- Status
- In production
- Context
- Multi-site pediatric clinic · Client under NDA
The challenge
Clinical records lived on paper and in spreadsheets. With no searchable history, every appointment started from zero and information travelled through insecure channels.
The solution
A mobile-first record, designed to be used one-handed during an appointment.
SOAP clinical notes (subjective, objective, assessment, plan) and voice dictation so practitioners don't lose time typing.
Role-based access control: front desk, practitioner and management each see a different data set.
Architecture
Supabase as database and auth layer, with access policies enforced in the database itself (row level security) rather than only in the front-end.
A design system derived from the clinic's logo palette, so the product feels like part of the brand instead of a generic tool.
Documented privacy decisions: data minimization, access trail and separation of clinical from administrative data.
What I learned
In healthcare software, access rules belong in the database. Front-end validation is convenience, not security.