A privacy-first health PWA with consent-scoped sharing
Deep domain modelling, an import path off a competitor's export format, and partner sharing where every category is a separate consent enforced in the database.
- sharing consent
- Per-category
- import formats parsed
- 2
- on every read path
- RLS
The problem
Health data is the case where getting access control almost right is the same as getting it wrong. A partner-sharing feature meant one user's rows being readable by another, which is exactly the thing row-level security exists to make impossible by accident.
Adoption depended on people bringing years of history with them from an incumbent app, whose export format is inconsistent and comes in two entirely different shapes.
What we built
Sharing as a symmetric pair of rows
Accepting an invite atomically inserts a connection in both directions and marks the invite used. That symmetry keeps the security policies simple (a partner read is just a check for an existing connection), while each side independently controls which categories are shared. Either party can disconnect, which deletes both rows.
Consent per category, not per relationship
Each shared category is its own flag on the connection row owned by the data owner, and every policy checks the flag relevant to the data being read. Sharing one thing never implies sharing another.
Two parsers, one pipeline
The incumbent's emailed text export and various JSON shapes feed a single preview builder, with format detected from content and extension. Nothing is written until the user sees a preview of what will be imported, and existing days are never overwritten: only new dates are added.
An insight engine over the whole history
Cycle statistics, a symptom-against-phase heatmap and plain-language pattern observations computed from the full record rather than a recent window, alongside forecasting from a trailing average.
The outcome
A sharing model where the failure mode is showing too little rather than too much, and where revocation is immediate on both sides.
Years of history importable in one pass, non-destructively, with a preview before commitment.
Installable on both mobile platforms with an offline shell, and a theme system that flips the entire palette through CSS variables with no flash on load.
Built with
- Next.js
- Supabase
- PostgreSQL
- Row-level security
- Tailwind CSS
- PWA
- TypeScript
Page copy drafted with AI assistance. Skofi is accountable for it. Editorial policy
Have something shaped like this?
If any part of the above resembles a problem you are living with, a short call is the fastest way to find out whether it is the same problem underneath.
What happens on the call
- 15 minutes, no deck
- We map the process on the call
- A written scope, or an honest no