Engineering

Technical overview

How the product is assembled end to end — the stack, the request path, the AI pipeline, and the guarantees we hold ourselves to.

Stack

FrontendReact 19 + TanStack Start (SSR), file-based routing, TanStack Query for cache and optimistic state.

StylingTailwind CSS v4 with semantic design tokens; serif display type paired with a neutral UI sans.

ServerTyped RPC server functions on an edge worker runtime; public webhooks isolated under /api/public/*.

DataPostgres with row-level security on every table; object storage for avatars scoped per user folder.

AIManaged model gateway with a Gemini-class multimodal model for text and image reasoning.

Request path

A single chat turn touches four hops. Everything except rendering happens server-side, so no model key or privileged credential is ever shipped to the browser.

browser
  └─ sendChatMessage({ chatId, content })      typed RPC, bearer token attached
       ├─ insert user message                  RLS: user_id = auth.uid()
       ├─ load last 12 turns                   bounded context window
       ├─ POST model gateway                   system prompt + history
       ├─ insert assistant reply
       └─ bump chat.updated_at
  └─ reply appended to cache                   no refetch round trip

Latency budget

Perceived speed matters more than raw model time, so the UI never blocks on the network.

0 msUser message renders optimistically from local cache.

~40 msRPC dispatched; input cleared and focus retained.

~120 msUser turn durably written under row-level security.

0.6–2.5 sModel reply returns and is appended in place with no follow-up fetch.

On failureThe optimistic turn rolls back and the user is prompted to retry.

AI pipeline

A fixed clinical-safety system prompt frames every conversation: informational only, clarifying questions first, explicit red-flag escalation, no invented diagnoses.
History is truncated to the most recent turns and replies are length-capped, which keeps both cost and time-to-first-token predictable.
Uploaded photos are passed to the multimodal model as inline content for that turn only and are never used to train models.
Red-flag phrasing routes the user to the severe-conditions library, which carries symptom lists, immediate actions, and emergency thresholds.

Security model

Every table denies by default; policies scope reads and writes to auth.uid().
Avatar storage is partitioned by user id — cross-folder reads return empty, not errors.
Privileged database access is server-only and never reachable from client bundles.
Leaked-password protection is enforced at sign-up against known breach corpora.
A runtime probe verifies policy behaviour live rather than trusting configuration.

Known limits

The assistant is not a diagnostic device. It has no access to your records, labs, imaging, or medication history, it cannot examine you, and it can be confidently wrong on rare presentations. Treat every answer as a prompt to talk to a licensed clinician.