PledgeCheck

End-to-end user flow diagram
Architecture diagram

Inspiration

Isotretinoin (often known by brand name Accutane) is one of the only medicines that can clear severe acne for good. It also causes serious birth defects if taken during pregnancy. To prevent that, the FDA runs a safety program called iPLEDGE. Every patient who can become pregnant must take a pregnancy test every single month, and then pick up the prescription within a strict 7-day window.

Until now, those monthly tests had to happen at a clinic. Picture a college sophomore who drives to her dermatologist every month, sits in a waiting room, and misses class. One month her car breaks down, she misses the window, and her treatment stalls. Many patients simply give up.

The rules are changing. On February 9, 2026, the FDA approved changes to iPLEDGE that dermatologists had been lobbying for years:

patients may take their monthly pregnancy test at home during and after treatment, if their prescriber allows it (the first, pre-treatment test must still happen in a clinic);
a patient who misses the 7-day pickup window can retest right away, instead of being locked out for 19 days;
for patients who cannot get pregnant, monthly counseling paperwork is dropped.

The formal rollout was moved to November 15, 2026, so the iPLEDGE computer system can be tested. But the FDA has allowed at-home testing under "enforcement discretion" since 2023, so clinics can rely on home tests today.

Here's the catch. The FDA says prescribers who rely on home tests must take steps to minimize patients falsifying the results, and it doesn't say how. Every dermatology practice in the country is now responsible for an anti-fraud process that doesn't exist yet.

We built that process!! YAY

What it does

PledgeCheck turns an at-home pregnancy test into a fraud-resistant, auditable record that a dermatologist can approve in one tap.

The end-to-end workflow

End-to-end user flow

The patient requests a refill from their patient dashboard.
The clinic approves it, and PledgeCheck emails the patient a one-time link. It works once, expires in 24 hours, and is never stored in readable form.
The patient opens the link and taps Start. A 40-minute session begins, and only now is a 4-character one-time challenge code revealed.
The patient writes the code on the test in clear letters, takes the test, and photographs it. It's live camera only: photos can't be uploaded from the gallery. Voice guidance in English and Spanish is available to walk them through every step, for patients that need it.
The photo goes through fraud checks and two independent readers (Grok and OpenCV - details below).
The dermatologist sees one card per test: the photo, both readings, any fraud warnings, and the patient's timeline. They approve or reject in one tap. Software never approves anything on its own.
Approval opens the 7-day pickup window, and the patient can fill the prescription.
Every action is recorded in a tamper-evident audit log, whose fingerprint is regularly stamped onto the Solana blockchain, so no one can quietly rewrite history. Not even us!

A drug-maker dashboard shows only anonymous weekly totals, such as tests verified and days from test to fill, with no patient-level data.

The security checks (the heart of the project we're super proud of!)

Every check below stops a different way of cheating:

Cheating attempt	What stops it
Sharing or reusing someone's link	One-time link: works once, expires in 24 hours, one 40-minute session
Guessing a link	Each link contains a 256-bit random token, about $2^{256}$ possibilities. Guessing one is effectively impossible
Sending an old photo, or last month's test	Challenge code: the code didn't exist until the patient tapped Start, so an older photo can't contain it
Uploading an edited or downloaded image	Camera-only capture: no file uploads, and the server records its own timestamp
Resubmitting the same photo (even cropped or brightened)	Photo fingerprint (details below)
A misread or doctored test	Two independent readers must agree, or a human reviews it
Editing records after the fact	Hash-chained audit log + Solana anchor

The challenge code. Codes use 4 characters from a 31-character alphabet (we removed look-alikes like 0/O and 1/I/L, which are easy to misread in handwriting). That gives $31^4 = 923{,}521$ possible codes, and a patient can't know theirs until the session starts.

The photo fingerprint. Each photo is turned into a 64-bit "perceptual hash", a fingerprint of what the image looks like. Small edits barely change it. If a new photo's fingerprint differs from any earlier photo's in fewer than 8 of its 64 bits,

$$d_{\text{Hamming}}(p_{\text{new}}, p_{\text{old}}) < 8,$$

we treat it as the same photo and block it, across every clinic.

Two readers, on purpose.

Grok (AI vision) reads the result and the handwritten code.
OpenCV (classic image processing, no AI) measures the test lines pixel by pixel.

AI can be confidently wrong, and it can even be tricked by text written in the photo. A second method that works completely differently is unlikely to make the same mistake. If the two disagree, or if either is less than 85% confident, the test goes to the doctor for a closer look.

The tamper-evident audit log. Every action (link issued, session started, photo received, fraud rejection, approval) becomes an entry whose fingerprint includes the entry before it:

$$h_n = \text{SHA-256}\big(h_{n-1} \,|\, \text{entry}_n\big)$$

Change any old entry, and every fingerprint after it stops matching. Someone with full database access could still rewrite all the fingerprints. So every 10 events, and on demand, we publish the latest fingerprint to the Solana blockchain, a public record that nobody (including us) can edit. The Verify button recomputes the whole log and compares it with Solana: green if nothing changed, red (pointing to the altered entry) if anything did.

What we're careful to say: the Solana anchor proves the record wasn't changed afterwards. It doesn't prove a photo was real; the fraud checks do that. And only a fingerprint goes on the blockchain, never any patient information.

Privacy by design.

Photos are deleted after review; only the fingerprint is kept.
Email addresses are never written to the audit log.
Emails have a neutral subject line ("Your PledgeCheck link"), so nothing sensitive shows up on a lock screen.

How we built it

PledgeCheck architecture

Part	Technology	Why
Web app (patient, clinic and drug-maker screens)	Next.js, React, TypeScript, Tailwind, shadcn/ui, hosted on Vercel	One codebase for every screen; the patient flow works in any phone browser, no app install
Database, logins and access rules	Supabase (Postgres)	Each clinic can only ever see its own patients, enforced inside the database itself
AI reader	Grok vision (xAI)	Reads the test result and the handwritten challenge code
Second reader + photo fingerprint	Python, OpenCV on a Vultr server	Independent, non-AI line reading, plus the reuse fingerprint
Tamper-proof anchor	Solana (devnet)	A public, uneditable timestamp of our audit log's fingerprint
Voice guidance	ElevenLabs	Pre-recorded English and Spanish instructions, so the patient never waits on a live AI call
Email	Resend	Sends the one-time link from our own domain, [email protected]
Anonymous analytics	Tiger Data (TimescaleDB)	Weekly totals for drug makers, kept separate from patient data
Domain	.Tech	pledgecheck.tech for the app, api.pledgecheck.tech for the image service

Testing. More than 450 automated tests cover the web app, plus a database test suite (78 checks for access rules and the audit log) and the image service's own tests. We also ran end-to-end tests against a real local database, which issue a link, start a session, and independently re-verify every audit fingerprint.

Real-world check. We bought pregnancy tests and photographed them: negatives without code, negatives with code, an unused test, and a random object. On those photos, Grok read every result and every handwritten code correctly. That's a small sample, not an accuracy claim.

Sponsor tracks

Impiricus. PledgeCheck is built for clinicians first. It solves a brand-new FDA requirement that makes dermatologists responsible for preventing misread and faked at-home pregnancy tests, and turns it into a one-tap approval with an audit-ready record. It opens a new way to engage healthcare providers without adding to their workload, and it's a platform: iPLEDGE is the first of many FDA drug-safety programs with the same monitoring needs. Identity verification with Persona, which Impiricus already uses, slots into our design at the start of each test.

A Marina's Mission (Social Good). Monthly clinic visits are a real barrier: missed classes, lost work, long drives, and treatment that stalls when a patient can't make it in. PledgeCheck lets patients test at home safely, so more people can finish a treatment that changes their lives.

Tiger Data. Our drug-maker dashboard reads from a separate Tiger Data warehouse that holds only anonymous events (tests verified, days from test to pickup), never patient IDs. Small counts are hidden to protect privacy.

Solana. Every clinic action goes into a tamper-evident audit log, and we anchor its fingerprint on Solana devnet. The Verify button checks the log against the blockchain, so any edit, even by an insider, is caught. Only a hash goes on-chain, never patient data.

Vultr. Our image service runs on Vultr. It fingerprints every photo to block reused images, and adds a second, non-AI reading of the test lines as a cross-check.

Grok (SpaceXAI). Grok vision is our primary reader: it reads the test result and the patient's handwritten challenge code from the photo, the core check that the photo was taken during this session.

Challenges we ran into

The audit log that froze the whole app. At one point every audit write hung, and the database logged about 100 errors per second. Our database function signalled a conflict with an error code that means "temporary problem, just retry", so the system retried the same doomed request forever until it ran out of connections. We switched to an error code that tells the app to re-read the latest entry first, the only way a retry can succeed, and removed a lock that had made the jam worse.

Analytics that could have broken patient care. While writing a test, we found that a single wrong analytics setting would have made every clinical approval fail. We rebuilt it so analytics can fail quietly without ever blocking a doctor's decision.

The computer-vision reader meets real photos. OpenCV looked fine on clean test images, but on our real photos it got 4 of 6 wrong. A hand holding the test merged with the test itself, and the pink cap looked like two result lines. Because it's uncalibrated, it's capped at low confidence, so every one of those cases safely went to the doctor. But it showed us that real-world photos are the hardest part.

A server that stays silent. When our image server was unreachable, requests didn't fail; they hung, which could have stalled a patient's upload. The lesson: every outside service needs a time limit.

Identity verification without a company. The ID provider our sponsor uses requires a registered business and tax ID, which a student team doesn't have, and the alternatives we tried had no free tier.

Three people, one night. We each built our part on separate branches and merged them into one working app, keeping each other's code working along the way.

Honest limitations

We'd rather tell you what PledgeCheck can't do yet:

We can't prove who took the test. The challenge code proves when the photo was taken, not whose test it is. Someone else could take the test and write the code on it. This is an open limitation with no known solution without violating patient's privacy. However, we do our best to minimize fraud.
We can't tell what went on the stick. A test dipped in water shows a normal-looking negative. (That's exactly how we made our own demo negatives!) No photo-based system can detect this.
The OpenCV reader isn't calibrated yet. It needs dozens of labeled photos across lighting conditions and test brands. Until then, its confidence is capped, so it only adds caution, never speed.
Our Grok testing is a small sample: six photos of one brand of test.
No government ID check yet. Impiricus already uses Persona for identity verification, so an ID + selfie check before each session fits naturally into their roadmap. We designed the Start step to plug it in, storing only a scrambled fingerprint of the identity, never the ID itself. We couldn't access it this weekend (it's business-only and paid), and Stripe Identity had no free tier either.
No connection to the real iPLEDGE system, which has no public API. The clinic still enters the verified result into iPLEDGE; PledgeCheck produces the trustworthy record behind it.
Demo data only. Every patient is synthetic. Real use would need a HIPAA compliance review, business agreements with every vendor, and a security audit.
It needs a smartphone with a working camera and internet connection. Patients without one still need the clinic.
Our timing rules (like the 7-day window) follow published summaries of the FDA changes and need checking against the official iPLEDGE prescriber guide before real use.

What we learned

Every outside service will eventually fail, so plan for it. Analytics, email, the image server and the AI reader all "fail soft": they add a warning for the doctor instead of blocking a patient.
Two different methods beat one clever one. The most reliable safety feature was requiring an AI and a non-AI reader to agree.

What's next for PledgeCheck

Government ID + selfie check at Start, through Persona, matching Impiricus's existing stack.
Calibrate the OpenCV reader on real photos from clinics, across test brands and lighting, and add an on-screen framing guide for the camera.
Automatic photo-quality warnings (blurry, too dark) so patients can retake before sending.
Audit PDF export for FDA and program inspections, including the Solana proof.
Reminders before a patient's testing or pickup window closes.
Confirm every rule against the official iPLEDGE guide ahead of the November 15, 2026 rollout.
A platform for more drug-safety programs: iPLEDGE is one of many FDA safety programs with similar monitoring needs.
Pilot conversations with dermatology practices.

Sources

U.S. Food and Drug Administration. iPLEDGE Risk Evaluation and Mitigation Strategy (REMS) (content current as of June 16, 2026).
- February 9, 2026 approval of the modifications: https://www.fda.gov/drugs/postmarket-drug-safety-information-patients-and-providers/ipledge-risk-evaluation-and-mitigation-strategy-rems#292026
- June 16, 2026 implementation delay to November 15, 2026: https://www.fda.gov/drugs/postmarket-drug-safety-information-patients-and-providers/ipledge-risk-evaluation-and-mitigation-strategy-rems#06162026
- October 13, 2023 enforcement discretion for at-home testing: https://www.fda.gov/drugs/postmarket-drug-safety-information-patients-and-providers/ipledge-risk-evaluation-and-mitigation-strategy-rems#10132023
Medscape. FDA Delays iPLEDGE Modifications Until November 2026 (June 18, 2026). https://www.medscape.com/viewarticle/fda-delays-ipledge-modifications-until-november-2026-2026a1000kjo

AI use disclosure

In the product: Grok (xAI) reads test photos and handwritten codes. ElevenLabs generated the voice guidance clips.
In development: we used AI coding assistants to help write code and tests, plan, add comments and debug. The team designed the system, the security checks and the workflow; reviewed and tested every change; bought and photographed real tests; and made every product decision.

Built with

nextjs react typescript tailwindcss shadcn-ui supabase postgresql vercel python opencv vultr grok xai elevenlabs solana resend tiger-data timescaledb pnpm