Pippa

A multi-surface HIPAA platform where clinical safety rules are enforced in the architecture, not in the interface copy.

Pippa is outpatient support for eating-disorder care: a patient app, a clinician dashboard, and a backend that keeps them in sync. I owned the software architecture and the release path. Patients photograph a meal, a custom vision model reads it, and an LLM companion responds. Clinicians see adherence, notes, and messaging. The patient-facing contract is strict: no calorie numbers, no punitive streaks, journaling that never syncs.

Problem

After-care stops when the patient leaves the office, and most logging tools make the day worse by centering numbers. The engineering problem was to run vision and an LLM in a HIPAA system without putting those numbers, or the model keys, on the patient surface. Two hundred clinics and a daily-active base in the tens of thousands meant the sync path had to survive bad networks and a patient who is offline.

Process

Requirements from 229+ clinicians landed in a Jira backlog and shipped in two-week sprints. I treated safety as invariants: crisis language is checked on device before chat text leaves the phone, clinician access is consent-gated, and the journal is local-only. Local state is the source of truth and cloud sync is best-effort, backed by an on-device queue. Release checks are path-filtered pre-push lanes per surface, so a dashboard change does not drag the mobile apps through an unrelated suite.

Solution

• Clinician dashboard in React and TypeScript on Next.js: roster, consent with a signed photo, care plans, clinical notes, measures, engagement graphs, team chat, and a family view that can see meals and mood but never the journal, AI chats, or clinical notes.
• Patient clients in Swift/SwiftUI and Kotlin/Compose, plus Flutter and React Native paths. Local persistence first, StoreKit and push on iOS. Meal photos go to a worker that proxies the vision model and the LLM so keys never sit on the device.
• Backend on Cloudflare Workers with DynamoDB, R2, Cognito, and SES. Automated daily check-in jobs keep patient logs and the dashboard aligned in real time. A Capacitor shell wraps the dashboard so clinicians get a native app while the web surface keeps shipping.
• When Apple review and corporate networks blocked workers.dev, I put a first-party proxy on api.getpippa.app and taught the clients to fall back between hosts.

Results

• 10K+ Daily active users
• 200+ Outpatient clinics
• 229+ Clinician requirements in the backlog
• 0 Calorie numbers on the patient surface

Justin Moran · Software Engineer · Chicago, IL · LinkedIn · GitHub · Resume (PDF)