VisitNote is an AI scribe for practitioners. It records a session, transcribes it, and writes a tidy, structured note in about a minute — so the practitioner doesn't type it up afterwards. The audio is deleted within seconds of being transcribed and the note is never stored by the app.
The primary vertical is a UK health & wellbeing coach: press record → talk through the session → press stop → the structured note arrives by email, ready to paste into the client record. The same engine also runs a Polish paediatrician vertical (a W/B/O/P — SOAP — visit note), which is what makes the architecture interesting: one codebase, multiple verticals, selected by a single profile.
Status: pilot-stage product (thin-slice). This repository is a curated portfolio snapshot of a project that continues to evolve in a private development repository.
📸 Screenshots / demo of the recording flow will be added here.
This is a health-adjacent product, so the design is driven as much by compliance and cost safety as by features:
- Privacy by construction. The audio is held in RAM only, never written to disk, and discarded the moment it becomes text. The generated note is streamed through and never persisted — the database stores only non-content metadata (timings, stage reached, size buckets). Logs are sanitised: no transcript, no note content, no recipient address ever reaches a log line.
- A "first names only" protocol, plus a PII filter as defence-in-depth. Practitioners are asked to use first names only. On top of that, a per-vertical PII filter redacts anything that slips through: name blocklists, phone numbers, emails, dates, Polish PESEL, and UK NHS numbers validated by their modulo-11 checksum (to avoid false positives on bare 10-digit runs).
- Hard cost caps. Every paid call (OpenAI Whisper, Claude) sits behind a rate limiter and a per-request timeout, so a runaway or abusive client cannot blow through the monthly budget caps that gate the pilot.
- Long recordings, safely. Sessions up to ~75 minutes are recorded in rotating segments and transcribed as an N-segment pipeline with a dynamic timeout — instead of one oversized upload that would hit platform limits.
| Decision | Choice |
|---|---|
| Shape | Single-deployable monolith (Next.js App Router on Vercel) |
| Transcription | OpenAI Whisper |
| Note generation | Claude via OpenRouter (not the vendor SDK directly) |
| Data isolation | Postgres (Supabase) with row-level security |
| Auth | Secret per-user URL token → hashed; cookie session, 90-day sliding window |
| Cost control | Prompt caching + per-endpoint rate limiting + hard timeouts |
| Audio | Ephemeral, in-memory only, deleted immediately after transcription |
TypeScript · Next.js 16 / React 19 · Drizzle ORM + Postgres (Supabase) · OpenAI (Whisper) · Claude via OpenRouter · nodemailer (Gmail SMTP) · zod · pino · Vitest · Biome · Tailwind CSS.
| Path | Responsibility |
|---|---|
app/ |
Next.js App Router — pages (record, settings, privacy) and API routes (transcribe, generate-note, sessions, settings, health) |
lib/ai/ |
Whisper transcription, Claude/OpenRouter client, PII filter, error mapping |
lib/profiles/ |
Multi-vertical profiles (uk-wellness, pl-pediatric) + shared types |
lib/audio/ |
In-browser recorder + ephemeral audio handling |
lib/auth/ |
Token hashing, cookie sessions, middleware |
lib/db/ |
Drizzle schema and session-metadata helpers |
lib/email/ |
Note delivery over SMTP |
lib/rate-limit/, lib/sessions/, lib/ui/ |
Cost guards, pipeline state machine, UI helpers |
components/ |
Recorder UI, pipeline view, screens |
drizzle/ |
SQL migrations |
scripts/ |
Operational scripts (env check, session inspection) |
docs/ |
English coach's guide (product handbook) |
# Requires Node.js 22.11+ and pnpm 9+
pnpm install
# Configure environment (copy the template and fill in your own values)
cp .env.example .env
# key values: DATABASE_URL, OPENAI_API_KEY, OPENROUTER_API_KEY,
# SESSION_COOKIE_SECRET, VISITNOTE_PROFILE (uk-wellness | pl-pediatric)
pnpm db:push # apply the schema to your Postgres instance
pnpm dev # start the dev serverExternal services required to run end-to-end: a Postgres database (Supabase free tier is enough), an OpenAI API key (Whisper) and an OpenRouter API key (Claude). Optional Gmail SMTP credentials enable email delivery; without them the app logs the delivery instead of sending.
pnpm test # Vitest unit/integration suite (27 test files)
pnpm typecheck # tsc --noEmit
pnpm lint # BiomeCI runs on GitHub Actions (.github/workflows/ci.yml).
Released under the MIT License © 2026 Dariusz Poślad.