Arya Health

Github Link:https://github.com/nikunj474/ariahealth

Inspiration

Patients spend hours on hold with insurers to answer simple questions: Is this covered? Do I need prior authorization? Where is my claim? Doctors lose even more time playing phone tag to refer patients to in-network specialists. We built Arya because getting a benefits answer or booking a referral should be as easy as making a phone call — and it should never come at the cost of privacy.

What it does

Arya is a voice AI platform for insurance benefits. Patients call a single phone number and speak naturally to check coverage, prior authorization requirements, and recent claim status. Doctors use a separate referral console to pick a patient, see AI-ranked in-network specialists, and confirm bookings with an automated voice call. Identity verification and PHI access are enforced server-side, not just asked for in a prompt.

How we built it

Frontend: TanStack Start with server functions and an authenticated admin dashboard. Backend / data: Lovable Cloud (Postgres) with row-level security for patients, claims, insurance plans, and prior-auth rules. Voice layer: Twilio webhooks route calls, collect speech, and stream audio through a voice state machine. AI: Lovable AI Gateway powering the patient agent and a second guardrail model that reviews every reply for PHI leaks, off-topic drift, and jailbreak attempts. Safety: Tool-level identity gating — no PHI is returned unless the caller’s name and date of birth match the verified patient session. Challenges we ran into

Voice latency and turn-taking: Making a phone conversation feel natural while waiting for speech recognition, LLM inference, and database lookups required careful state management. Safety as architecture: We learned quickly that asking the model “don’t leak PHI” is not enough. We had to build a server-side verified patient ID and reject tool calls at the function level. Prompt injection: Caller speech is wrapped as untrusted data, and a second classifier flags attempts to override instructions or extract other patients’ records. Real-time call coordination: Passing keypad input and call status between Twilio, the backend, and the admin UI in near-real time took several iterations. Accomplishments that we're proud of

A working phone line where a patient can be identified by name and DOB, then get real coverage answers from a restricted tool set. Server-side identity verification that blocks PHI access even if the LLM is tricked. A doctor-facing referral console with ranked specialists and one-click voice confirmation. An admin dashboard that surfaces live calls, verification events, and guardrail flags. End-to-end guardrails: no medical advice, no discussion of other patients, and injection-hardened caller input handling. What we learned

Compliance is a system property, not a prompt. If identity verification lives only in the system message, it will eventually fail. Voice UX is unforgiving. Every extra second of latency hurts trust; concise, spoken replies beat long paragraphs. Dual-model review works. Having one model act and a second model audit catches edge cases that a single prompt cannot. Building on an edge-ready stack matters. Server functions let us keep sensitive logic and credentials off the client. What's next for Arya Health

EHR integration so doctors can pull patients and diagnoses directly from their existing systems. Multi-language support for Spanish and other common languages in the patient population. Outbound calls for appointment reminders, referral follow-ups, and claim updates. Production hardening including a full HIPAA readiness review, audit logging, and BAA-aligned infrastructure. Pilot with a small clinic or DPC practice to validate the referral workflow in a real clinical setting.