forulus

A zero-knowledge, local-first medical data vault. forulus leverages Gemini AI to securely synthesize clinical briefings and empower absolute patient data sovereignty on the edge.

Comment

Welcome to forulus—your health data passport

NOTICE

I'll be presenting forulus at the IEEE Symposium on Privacy Expectations (ISoPE) 2026 in October. The abstract summarizing the project was peer reviewed and accepted for presentation at the event.

Inspiration

The current paradigm of digital health forces patients to surrender their medical data to centralized servers, risking catastrophic breaches and loss of sovereignty. Witnessing this structural flaw—and the archaic alternative of carrying physical CDs of X-rays between specialists—inspired the creation of forulus. The vision was to build an enterprise-grade, zero-knowledge medical data vault that bridges the gap between absolute patient data sovereignty and high-velocity clinical nursing workflows.

What it does

forulus is an AI-assisted, privacy-preserving software architecture designed for decentralized medical data management. It provides patients with a local-first vault to store sensitive diagnostic images, lab results, and health logs. When a practitioner requests data, forulus acts as a secure cryptographic relay, allowing doctors to seamlessly view records and AI-generated clinical briefing sheets in a stateless Practitioner Portal.

How we built it

The platform relies on a dual-layer AI architecture orchestrated alongside a robust local-first database, utilizing the full Google Cloud and Gemini stack.

  • Local-First Storage: Data is stored locally using IndexedDB (via Dexie.js), saving large binary payloads (like 15MB MRIs) as native Blob objects rather than serialized strings. We utilized transactional bulkPut operations to enforce strict relational batching.
  • Dual-Layer AI Generation: We engineered a pipeline that strictly minimizes token overhead while enforcing absolute privacy.
    • Edge Pre-Processing: We leverage Chrome's window.ai (Gemini Nano) to locally condense verbose symptom logs directly on the device.
    • Cloud Processing: Anonymized data is securely relayed to Google Cloud Functions, strictly running the gemini-3.5-flash-lite model. To suppress hallucinations and enforce deterministic clinical outputs, we heavily restrict the model's temperature parameter (\(T = 0.2\)) in the standard softmax probability function: $$P(x_i) = \frac{\exp(x_i / T)}{\sum_j \exp(x_j / T)}$$ Additionally, we completely bypass GCP Context Caching to guarantee zero-state retention of sensitive clinical logic on Google's servers.
  • Cryptographic "Dumb Relay": To share data seamlessly, we implemented an End-to-End Encrypted (E2EE) pipeline using Firestore. The patient's device generates an ephemeral symmetric key \(K_{AES}\) to encrypt the massive medical payload \(M\), creating ciphertext \(C_{payload}\). This key is then locked using the practitioner's public RSA key \(K_{pub}\), producing the envelope \(C_{key}\): $$C_{payload} = \text{AES-GCM}(K_{AES}, M)$$ $$C_{key} = \text{RSA-OAEP}(K_{pub}, K_{AES})$$ Firestore simply acts as the untrusted relay, passing the opaque envelope to the practitioner's command center.
  • AI-Native Automation: Using Google Antigravity 2.0, we orchestrated multi-agent AI systems to automate our software development workflows, dramatically accelerating the deployment of our React components and Firebase infrastructure.

Challenges we ran into

Maintaining zero-knowledge principles while working with cloud-based generative AI was a massive technical hurdle. One critical challenge involved multi-modal processing (vision) for large medical scans, which initially led to heavy token bloat and GCP quota exhaustion. We overcame this by implementing a "metadata-default" protocol—stripping base64 binary data by default and only injecting heavy payloads into the Gemini context window if explicitly requested via the UI selection mechanism.

Another challenge was integrating SaaS billing without exposing decryption keys. We successfully decoupled identity from telemetry by processing Lemon Squeezy webhooks to assign Firebase Custom Claims (e.g., Premium tiers) in the cloud, leaving the backend completely blind to the user's localized IndexedDB payloads.

What we learned

We learned that enforcing absolute data privacy does not have to come at the cost of clinical efficiency. By strategically shifting the heavy computational lifting to the edge (via Gemini Nano) and stripping Patient Identifiable Information (PII) before network transmission, we proved that it is possible to synthesize highly professional, actionable clinical briefing sheets entirely within a zero-knowledge framework.

What's next for forulus

The immediate roadmap involves implementing out-of-band key handshakes (via QR codes or WebRTC) to prevent Man-In-The-Middle attacks during the relay phase, as well as integrating native DICOM parsing for advanced window-leveling in our medical image viewer. Ultimately, forulus will expand its AI-native operations to bridge the interoperability gap, transforming AI-synthesized briefings into HL7 FHIR-compliant payloads for frictionless integration with legacy Electronic Health Record (EHR) systems.

We envision forulus becoming the gold standard for direct communication between patients and healthcare professionals.

Built With

Share this project:

Updates