Health Library keeps a whole family's medical history in one secure place on Android. Users store lab reports, prescriptions, scans, visit notes and vaccinations for themselves and their family, then tap a button for a plain-language AI summary of any record.
Platform: Android (Google Play) with a Next.js API and website
Scope: Product design, mobile app, backend API, admin panel, public website
Status: Version 0.0.1, first release
The challenge
Families keep medical paperwork in drawers, photo galleries and WhatsApp chats. When a doctor asks for last year's blood test or a child's vaccination dates, nobody can find it. Most people also struggle to read the reports they do have.
The brief was an app that:
Holds records for every family member, not only the account holder
Turns a phone photo or PDF into a searchable record in seconds
Explains medical reports in everyday language, without replacing a doctor
Protects sensitive health data to the standard Google Play requires for health apps
The solution
Family health profiles
Each person gets a profile with personal and medical details: blood group, allergies, chronic conditions, up to five emergency contacts, and height and weight with an instant BMI reading. A switcher at the top of Home and Profile moves between family members in one tap.
Family linking
Family members can be invited by email. They choose Join or Not me, so nobody is ever linked automatically and family membership stays hidden until the email is verified. A link is one shared connection: if either side removes it, it ends for both, and each person's own profile stays theirs.
Records from camera, gallery or PDF
Users capture a document with the camera, pick it from the gallery or attach a PDF, then search and filter by type and date. Photos and PDFs open in a built-in viewer, so nothing leaves the app.
On-request AI summaries
Tapping Get AI summary on a record returns a structured explanation:
An overview of what the document is
Key points, each marked normal, needs attention or urgent
What the results mean in plain language
Questions to ask the doctor
Summaries run in the background and a push notification arrives when one is ready. AI only runs when the user asks for it, and a privacy notice appears the first time.
Security built for health data
Email sign-up with one-time-code verification and password reset
Short-lived access tokens with rotating, hashed refresh tokens and reuse detection
Opt-in fingerprint unlock, plus automatic sign-out after 15 minutes in the background
Private file storage, served only through short-lived signed links
Account-deletion requests reviewed in an admin panel, followed by a full purge of data and files
Tech stack
Mobile: React Native with Expo and Expo Router, TypeScript, TanStack Query, Reanimated, Expo Notifications, Secure Store and Local Authentication
Backend: Next.js (App Router) API routes, MongoDB with Mongoose, Yup validation shared with the app
Storage and services: Private AWS S3 storage, Expo Push Service with Firebase Cloud Messaging, SMTP email, a hosted LLM for summaries
Web: Landing page, privacy policy, terms, medical disclaimer and an admin panel, built with Tailwind CSS
Engineering highlights
Privacy-first linking. Invitations never reveal whether an email already belongs to a family, and every link needs explicit consent.
Device-bound fingerprint sign-in. The phone holds a secret behind the fingerprint prompt and the server stores only its hash. Credentials expire, are capped per account, and are revoked automatically on a password reset.
Resilient AI pipeline. Multi-page documents are transcribed in batches before a single summary call, and saving a record never fails because of an AI error.
Accessible design system. Brand colours taken from the logo, light, dark and system themes, and an automated WCAG AA contrast check on every palette change.
Tested backend. More than 600 automated tests cover services, API routes, validation and emails.
Process
The product was built in short, reviewable phases: foundation, authentication, profiles, compliance, family vault, family linking, records, AI summaries and fingerprint unlock. Each phase went through a written design, an implementation plan, a full code review and on-device testing before release.
Every phase shipped as a self-contained, reviewed release, so the app was usable and testable at each step rather than only at the end.
What's next
Medications: structured prescriptions, local reminders and a dose log
Emergency QR code, secure share links and an access audit log
Family roles, multi-language support (Urdu, Arabic with right-to-left layout, Spanish) and FHIR interoperability
An AI health assistant across a family's whole record history
