Continuum
One record across every doctor, and the harms none of them could see.
HealthTech track, IIITDM Kancheepuram 24-hour Web Hackathon: "Lost in Transit: fragmented medical records."
The problem
A patient with diabetes, high blood pressure and a thyroid condition sees five doctors and three labs over two years, in two cities. Each doctor sees only their own prescriptions. The history lives in a plastic folder and on WhatsApp, so:
- Recall fails. Patients can't reliably say what they take, at what dose, or what an old report said.
- Tests are repeated. A new doctor reorders an HbA1c done three weeks ago at another lab.
- Harms fall between doctors.
- One doctor's drug causes ankle swelling, and a second doctor treats the swelling with another drug. This is a prescribing cascade.
- A painkiller from an orthopaedist meets a BP drug and a diuretic from two other doctors. This is the "triple whammy" for the kidneys.
- No single doctor holds enough of the record to see either problem.
- Sharing is all or nothing. Records leave as photos that can never be taken back, and the patient can't see who looked.
The solution
Continuum is a patient-owned, consent-based longitudinal record.
-
Ingest anything. A phone photo or PDF of a prescription, lab report or discharge summary is read by Claude (vision and native PDF input) into structured data:
- brand names like Glycomet or Telma are mapped to generics, drug classes and ATC codes;
- lab tests are mapped to LOINC with unit conversion;
- every field gets a confidence score.
The patient checks every field next to the original before anything enters the record. Low-confidence fields are highlighted, and so are name mismatches and duplicate uploads.
-
One verified timeline. Medications are merged into courses across prescribers. Labs become trends, and visits, conditions and allergies are kept together. Every fact links to its source document.
-
The Blind Spot Engine (our USP). Deterministic, referenced rules read the unified record across providers:
- 12 prescribing cascades
- 11 drug→lab effects
- 32 drug–drug interactions, including the triple whammy
- drug–condition conflicts
- duplicate therapy
- allergy cross-reactivity
- repeated tests within their clinical validity window, with the ₹ cost
- refill gaps
Each alert shows its evidence chain, the doctors involved and a literature reference. The AI never raises an alert. It only extracts and summarises, so every flag is explainable and covered by unit tests.
-
The medication map. Every medicine course is a bar from start to stop, colour-coded by what it treats, with lab draws and visits beneath. Each Blind Spot is drawn as a connector between the records from different doctors that it joins.
-
Consent that can be taken back.
- A doctor requests access by Health ID. The patient approves, narrows (by category, specialty lens or date) or denies.
- Access is time-bound and revocable instantly. A revoked doctor's view disappears live.
- The patient can also create share links and QR codes, and give a caregiver access.
- Every view lands in an append-only access log that only the patient can read.
-
Emergencies.
- A printable, offline-capable QR emergency card carries blood group, allergies, critical medicines and an emergency contact. Every scan notifies the patient.
- If the patient allowed it, a registered doctor can get 1-hour break-glass access by stating the emergency. It is logged and the patient is notified.
-
Architecture
Browser (patient / doctor / lab / public token pages, light + dark theme)
│ Next.js 16 App Router: server components, server actions, route handlers
│ proxy.ts: session refresh + role routing (patient | doctor | lab)
├── Supabase Postgres ── Row Level Security on every clinical table (can_read(patient, category))
│ ── Realtime: notifications, access requests, grants, alerts (polling fallback)
├── Supabase Storage ── private "documents" bucket, 60-second signed URLs after an access check
├── Supabase Auth ── email + password, role in app_metadata
├── Claude (OpenRouter or Anthropic API) ── extraction (structured output, Zod-validated) and cited summaries
└── lib/engine (pure TypeScript, deterministic, unit-tested) + lib/kb (curated clinical knowledge)
- Single gate for doctors:
lib/access.ts → getDoctorAccess() returns the active grant's scope or throws. RLS repeats the same check inside the database, so a UI bug cannot leak rows.
- Tokens: share links and emergency cards use a random 32-byte token. It is stored as a SHA-256 hash, plus an AES-GCM copy so the patient can re-show the QR. URLs never contain personal data, and token routes are rate-limited.
- Same-origin relay: browser traffic to Supabase goes through
/sb/* (a Next.js rewrite). Some Indian ISPs DNS-block *.supabase.co, and the relay keeps the app working for patients and judges on those networks.
Key folders
| Path | What it is |
|---|
lib/engine/ | Blind Spot Engine: cascades, drug→lab, interactions, duplicates, allergies, tests, refills, reconciliation |
lib/kb/ | Knowledge base: ~90 drugs (Indian brands → generic → class → ATC), rules with references, 32 lab tests (LOINC, ranges, validity, ₹), specialty lenses, therapeutic groups |
lib/ingest/, lib/ai/ | Extraction schema, normalisation (units, dates, fuzzy drug match), Claude calls |
lib/data/ | Record loading, scoping, derived views, medication map, emergency data |
app/ | Pages (patient, doctor, lab, public /s and /e token pages) and API routes |
supabase/migrations/0001_init.sql | Schema, RLS policies, storage bucket, realtime publication |
lib/seed/ + scripts/seed.ts | Synthetic patients, generated prescription and lab PDFs, demo accounts |
Run it locally
Requirements: Node 20+ (tested on Node 26), a Supabase project, and an OpenRouter or Anthropic API key.
npm install
cp .env.example .env.local # then fill in the values (see below)
-
Supabase. Open your project's SQL Editor and run supabase/migrations/0001_init.sql. It creates the tables, RLS policies, the private documents bucket and the realtime publication.
-
Environment (.env.local):
| Variable | Where to find it |
|---|
NEXT_PUBLIC_SUPABASE_URL | Project Settings → Data API → Project URL (just https://<ref>.supabase.co) |
NEXT_PUBLIC_SUPABASE_ANON_KEY | Project Settings → API Keys → publishable (or legacy anon) key |
SUPABASE_SERVICE_ROLE_KEY | Project Settings → API Keys → secret (or legacy service_role) key. Server only |
OPENROUTER_API_KEY | openrouter.ai → Keys. When set, all AI calls go through OpenRouter |
OPENROUTER_MODEL | defaults to anthropic/claude-sonnet-5.5 (any vision model with structured outputs works) |
ANTHROPIC_API_KEY | alternative to OpenRouter: console.anthropic.com → API Keys |
EXTRACTION_MODEL | Anthropic model when using the Anthropic key; defaults to claude-opus-5-5 |
DEMO_PASSWORD | password for the seeded demo accounts |
NEXT_PUBLIC_APP_URL | public URL used in QR codes and share links |
-
Seed the demo data and start the app:
npm run seed
npm run dev
If your ISP blocks supabase.co (the connection fails with ECONNREFUSED to 127.0.0.1), prefix both commands with NODE_OPTIONS="--require ./scripts/doh-preload.cjs". That resolves Supabase hosts over DNS-over-HTTPS, for local development only.
-
Run the tests: npm test. The engine and normaliser tests cover every rule type with positive and negative cases.
Demo logins (password = DEMO_PASSWORD): [email protected], [email protected], [email protected], [email protected], [email protected]. The home page's demo buttons sign in for you. demo-docs/live-upload-dr-iyer-prescription.pdf is the prescription we upload live in the demo, and it triggers a new Blind Spot.
Deploy (Vercel)
- Import the GitHub repository in Vercel (framework: Next.js).
- Add the same environment variables. Set
NEXT_PUBLIC_APP_URL to the Vercel URL.
- Deploy, then open
/ and use a demo login. /api/demo/reset re-seeds the demo accounts.
Safety and privacy
- The AI extracts and summarises. It never diagnoses, and alerts are worded "worth reviewing", never "stop this drug".
- The patient confirms every extracted field before it enters the record, and the original document is always attached.
- Doctors see only patients who granted them access, only within that grant's scope and expiry. Medicines and allergies are always included for safety.
- The append-only access log covers views, document opens, emergency scans, break-glass access and exports.
- All patient data in this repository and the demo is synthetic.
Libraries and APIs used (disclosure)
- Framework and UI:
- Next.js 16 (App Router), React 19, TypeScript
- Tailwind CSS v4
- lucide-react (icons), Recharts (lab trends), qrcode.react, sonner (toasts)
- Hanken Grotesk and Noto Sans Devanagari/Tamil via
next/font
- Backend: Supabase (Postgres, Row Level Security, Auth, Storage, Realtime) via
@supabase/ssr and @supabase/supabase-js.
- AI: Claude via OpenRouter (OpenAI-compatible API) or the Anthropic API (
@anthropic-ai/sdk), for document extraction (vision and PDF input, structured output) and cited summaries. Every response is validated with Zod before use.
- Utilities: Zod (validation), fuse.js (fuzzy drug-name matching), date-fns, clsx, tailwind-merge, class-variance-authority, server-only.
- Dev: Vitest, tsx, dotenv, pdf-lib (generates the synthetic demo PDFs), ESLint.
- Design process: the UI direction was developed with the Impeccable design skill (audit, direction, craft review).
Clinical knowledge references
Every rule in lib/kb/rules.ts carries a ref field. Sources include:
- Savage RD et al., JAMA Intern Med 2020: the calcium-channel blocker → diuretic cascade.
- Gurwitz JH et al., JAMA 1994: NSAIDs → antihypertensive therapy.
- Lapi F et al., BMJ 2013: "triple whammy" acute kidney injury.
- de Jager J et al., BMJ 2010: metformin and vitamin B12.
- Clinical guidelines:
- KDIGO AKI 2012 and CKD 2024;
- NICE NG203 and NG136;
- BNF interaction guidance.
- Product labelling for individual drugs.
Rules surface patterns for clinical review. They are not a substitute for clinical judgement.
Team
Mohit Kumar (with Claude as a pair-programmer).
