🩺 Allyve Wellness AI — HIPAA-Compliant Backend

Production-grade backend for the Allyve maternal health monitoring platform. Built with Express, TypeScript, PostgreSQL, and full HIPAA technical safeguards.

Quick Start

Prerequisites

• Node.js ≥ 18
• PostgreSQL ≥ 15
• OpenSSL (for generating keys)

1. Install dependencies

npm install

2. Configure environment

cp .env.example .env

Generate your secrets:

# Encryption key (AES-256 — 32 bytes)
openssl rand -hex 32

# JWT secret
openssl rand -base64 64

# Session secret
openssl rand -base64 32

Paste these into your .env file.

3. Create the database

createdb allyve_wellness

4. Run migrations

npm run migrate

5. Seed demo data (optional)

npm run seed

Demo login: [email protected] / SecureDemo123!

6. Start the server

npm run dev

Server starts at http://localhost:3001. API docs at http://localhost:3001/api/v1.

Architecture

src/
├── config/         # Environment config, database connection
├── middleware/      # Auth (JWT), security (Helmet, CORS, rate limiting)
├── migrations/     # Database schema, seed data
├── routes/         # API endpoints (auth, health, appointments, sharing, audit)
├── services/       # Core logic (auth, encryption, audit trail)
├── utils/          # Logger (HIPAA-compliant, no PHI in logs)
└── server.ts       # Express app entry point

HIPAA Safeguards

| Safeguard | Implementation | |---|---| | Encryption at rest | AES-256-GCM on all PHI fields | | Encryption in transit | HSTS, TLS required in production | | Authentication | JWT + bcrypt (12 rounds) + account lockout | | Access control | RBAC (patient/provider/admin) + ownership checks | | Audit trail | Immutable PostgreSQL table with DB-level triggers | | Session management | 15-min timeout, sliding window, revocation | | Input validation | Zod schemas on every endpoint | | Rate limiting | 100 req/15min general, 10/15min for auth |

See docs/HIPAA_COMPLIANCE.md for the full compliance reference.

Connecting the Frontend

Copy docs/frontend-api-client.ts into your Lovable frontend at src/services/api.ts.

Add to your frontend .env:

VITE_API_URL=http://localhost:3001/api/v1

Then update your components to import from services/api instead of data/mockData.

API Endpoints

| Method | Endpoint | Auth | Description | |---|---|---|---| | POST | /auth/register | ✗ | Create account | | POST | /auth/login | ✗ | Login → JWT tokens | | POST | /auth/refresh | ✗ | Refresh access token | | POST | /auth/logout | ✓ | Logout + revoke session | | GET | /auth/me | ✓ | Current user profile | | GET | /health/metrics | ✓ | List health metrics | | POST | /health/metrics | ✓ | Record health metric | | GET | /health/symptoms | ✓ | List symptoms | | POST | /health/symptoms | ✓ | Record symptom | | GET | /health/mood | ✓ | List mood entries | | POST | /health/mood | ✓ | Record mood | | GET | /health/journal | ✓ | List journal entries | | POST | /health/journal | ✓ | Record journal entry | | GET | /health/cardiovascular-risk | ✓ | Latest CV risk | | GET | /appointments | ✓ | List appointments | | POST | /appointments | ✓ | Create appointment | | PUT | /appointments/:id | ✓ | Update appointment | | DELETE | /appointments/:id | ✓ | Soft-delete appointment | | GET | /share | ✓ | List shared data | | POST | /share | ✓ | Share data + consent | | POST | /share/:id/revoke | ✓ | Revoke sharing | | GET | /audit/logs | ✓ admin | Query audit trail |

License

Proprietary — Allyve Wellness AI