MediPassport

Inspiration

Your medical history lives nowhere A folder at a clinic you stopped going to A pharmacy database A hospital portal you cannot log into Move cities change insurance or end up unconscious abroad and none of it follows you

We wanted the passport model instead One document that belongs to you not to any institution and that any clinician anywhere can read and trust The failure we kept hearing about was emergency care A patient arrives unconscious nobody knows they are allergic to penicillin The information exists It is just not where it is needed

What it does

MediPassport is a lifelong medical record the patient carries and controls

One permanent ID that never changes even when email phone or password do

Full lifetime history every encounter medication lab result and body system reading with who where and when

Emergency passport a signed offline verifiable snapshot any responder can scan from phone watch or card

Real access control patients grant and revoke access every view is logged and the patient is notified

Clinical authorship only licensed clinicians write medical entries patients edit their own contacts

Two apps Two APIs One for patients one for medical staff

How we built it

Each patient gets a UUIDv7 at enrollment It is stored once and never written again

Records fall into three integrity classes that never mix

authored written by a licensed clinician hash chained and anchored to Solana

imported written by an external system source provenance preserved

ai_summary written by Gemini or Backboard labeled as derived and stored separately

Clinician entries are chained

H n equals SHA 256 of H n minus 1 concatenated with h n concatenated with p

Only the 64 character hash goes on chain No PHI ever touches Solana Anchoring is async writes return in under 100 ms and the anchor confirms in the background

Every PHI field is AES 256 GCM encrypted at rest Passwords use Argon2id The backend runs a 12 stage middleware pipeline where request scope is set from the verified JWT never from a URL or body Flutter frontend one codebase for iOS and Android Presage turns the camera into a vitals sensor ElevenLabs reads the record aloud Hosted on Vultr under a signed BAA FHIR store on Medplum domain through GoDaddy Registry

Challenges

Break glass access Emergency speed and privacy pull in opposite directions We made it logged and notified rather than blocked A responder can open the snapshot but the access is time limited justified and the patient is notified within 60 seconds Transparency is the control not denial

Keeping AI out of the trust path Our first diagram had Gemini inline between the store and the anchor Redrawing it as a branch that reads from the store and writes to a separate labeled table fixed both the architecture and the story

Two databases one patient FHIR resources and time series vitals are different shapes Medplum holds the graph Tiger Data holds the measurements joined by patient UUID Keeping them consistent without a distributed transaction was the hardest part

What we learned

Integrity classes are architecture not a feature Once authored imported and ai_summary became separate species the trust story collapsed into one image three rows three colors

Request scope should never come from the request We caught three places where a patient ID was read from a URL The fix was to make it structurally impossible

Built with Flutter Node js Fastify PostgreSQL Medplum Tiger Data Solana Presage Gemini Backboard ElevenLabs Vultr Argon2id AES 256 GCM

Working prototype Authentication permissions and the integrity chain all function External services display real connection state