Gut Health SaaS Platform Development

A clinic needed software for practitioners to run 12-week gut-health programmes with their own clients. Think of it as a small SaaS: each practitioner gets their own space, their own clients, their own data, and nobody can see anyone else's.

The app is Next.js 15 (App Router) with React 19 and TypeScript, on Supabase/PostgreSQL. Multi-tenancy is enforced in the database itself with row-level security across 22 migrations, not just in application code - so a bug in a route can't leak one practitioner's clients to another.

The interesting part is the AI. There's an assistant ("Sage") built on the Anthropic Claude API with an OpenAI fallback path behind a provider abstraction layer, so the platform can switch models without a redeploy. It does structured extraction with tool use, reads uploaded lab reports with vision models, and runs AI safety guardrails - a red-flag scanner that catches anything needing a real clinician, with a dedicated safety test suite.

The billing model is unusual and I'm proud of it: each practitioner brings their own API key, encrypted at rest, so usage bills to their account rather than the platform's. That meant building careful failure handling — if one practitioner's key runs out of credit, her clients fall back to the platform key rather than going down, and she gets told exactly why in her settings.

Infrastructure and DevOps:

I migrated the whole thing off Vercel onto self-hosted Hetzner Cloud, which cut hosting cost substantially and removed a vendor billing dependency. It runs on Caddy with automatic Let's Encrypt TLS, systemd, and a zero-downtime deploy pipeline: builds go to a staging directory, swap in only on success, health-check, and roll back automatically — both the build and the git checkout — if the new release doesn't answer. A broken commit physically cannot take the site down.

I also handle the security posture: Hetzner cloud firewalls, Tailscale zero-trust networking for the development box (zero public inbound ports), SSH key management, and credential rotation.

Reliability:

6,900+ tests in Vitest, running in about 35 seconds, plus GitHub Actions CI. I've done live incident response on this system too — including tracing a silent schema-versus-code drift that was quietly misrouting API billing for two days with no error in any log, then shipping the fix and the logging that would have caught it on day one.

Other integrations: Zoom OAuth 2.0 (confidential flow + PKCE), Resend for transactional email, PostHog analytics, Grafana/Loki for logs.

Health-data handling: encryption at rest for sensitive credentials, HMAC-signed sessions, role-based access control, explicit consent capture, privacy policy and account-deletion flows, and least-privilege service access - architected so a formal HIPAA compliance programme is a documentation and BAA exercise, not a rebuild.

Screenshots: