My Elara

The platform

My Elara is a multi-tenant SaaS platform for mental-health practices, connecting clinicians, clients, and practice admins in one HIPAA-compliant system. Clinicians run their entire practice in it: caseloads, session scheduling with audio recording and transcription, clinical notes, templated assessments and homework with attachments, habit and milestone tracking, secure messaging, and continuing-education records.

Clients get an AI-assisted, CBT-style self-reflection loop. Text or audio journal entries are analyzed for emotional content, scored into a 0–100 Cognitive Balance Score, and rolled into long-term progress charts. A structured reframing system has the AI extract the anatomy of a negative thought while the client rebuilds it themselves using character strengths — the AI never hands over a finished "better thought", which keeps the therapeutic work human while still producing measurable before-and-after data.

Data boundaries mirror clinical practice: when a client transfers between clinicians, their cognitive and progress data moves with them, while private session notes stay with the originating clinician.

HIPAA compliance by architecture

Compliance is built into the architecture rather than bolted on, with safeguards mapped to the specific HIPAA Security Rule requirements they implement:

• Access control — JWT auth with Argon2 password hashing, Google OAuth SSO, and role-based guards across super-admin, admin, clinician, and client roles
• Tenant isolation — a tenant-aware data layer automatically injects and validates practice scoping on every read and write
• Audit controls — a global interceptor logs actor, IP, resource, and before/after values for every operation, with a dedicated admin audit-log viewer
• Encryption — TLS throughout, server-side encryption on all stored files, and time-limited scoped presigned URLs for uploads
• Consent management — per-client HIPAA, treatment, telehealth, and communication consents, each individually timestamped
• PHI-aware AI usage — pluggable model providers so protected health information only routes to BAA-covered vendors

AI integration

• Provider-agnostic abstraction: Claude, OpenAI, Gemini, or OpenRouter selected per environment, with responses normalized to strict typed shapes
• Emotion and cognitive analysis pipeline classifying thought patterns and recurring themes from a fixed clinical vocabulary
• Per-client monthly token budgets with pre-analysis estimation, usage tracking, and prompt-version traceability
• Audio pipeline: presigned uploads to S3, transcription workflow, then the same analysis pipeline as text entries

Engineering

• TypeScript monorepo (npm workspaces + Turborepo): NestJS API, Next.js web app, and shared packages
• NestJS 11 backend with ~24 feature modules; Prisma 6 over PostgreSQL with ~60 tenant-scoped models
• Next.js 16 App Router + React 19 frontend: Tailwind CSS, Radix UI, TanStack Query, Zustand, Recharts
• Stripe subscription billing; deployed on Railway with AWS S3 storage and idempotent, production-safe migrations