PythonSQLiteLLM extraction

Family health records

A patient-companion system for a family: photograph a bill or a lab report, and it files itself.

It starts with a photograph.

A bill or a lab report arrives as a photo in a Telegram chat, which is where the family already is. Nothing to install, no account to remember, no forms.
The document reads itself into fields.

A vision model pulls out the provider, the date and every line item, and writes them to SQLite. Corrections are kept as hints, so the same misreading does not happen twice.
The dashboard is the answer, not a report.

Doses due today, bills filed this year, the lab reports still waiting on a human. One page, behind Cloudflare Access, on any phone in the family.

01 Built a production family patient-companion system — Claude vision-model extraction of bills and lab reports into SQLite, a Telegram bot interface, and a live web dashboard at medcare.bryantan.au secured behind Cloudflare Access OTP
02 Found and fixed a two-layer XSS hole — template autoescaping silently disabled by a file-extension mismatch, plus 21 client-side sinks rendering extracted document text unescaped — then added a coverage guard so it cannot reopen.
03 Caught a unit-normalisation defect merging incompatible lab units into one series, affecting 21 of 95 shared markers and rendering a haemoglobin reading an order of magnitude wrong across two labs.
04 Built a safety-gate classifier preventing an AI medical assistant from making causal drug-outcome inferences, closing a gap found in live user testing

Interface recreated with invented data — no production screenshot is published. Private system; walkthrough and code review available on request.

It starts with a photograph.