ReportX

ReportX is the MedTech stream project under Deakin's InnovAIte AI Prototyping Lab. It turns lab and pathology reports into plain-language explanations so patients and caregivers can prepare better questions for clinicians. Outputs are educational only: every explanation carries a non-diagnostic disclaimer, and the MVP path logs metadata without request bodies.

What it does

• Accepts lab reports as PDF, image (PNG/JPEG), or pasted text
• Parses test name, value, unit, and reference range into editable table rows; flags low/high values when ranges exist
• Runs OCR (Tesseract) when a PDF has no text layer or the input is an image
• Sends the parsed table to an LLM for a summary, per-test notes, flags, next steps, and a safety disclaimer; falls back to deterministic JSON if the model is unavailable
• Translates the explanation into other languages while keeping numerals and units unchanged (RTL support partially pending)
• Lets authenticated patients keep report history, share with clinicians under consent rules (scope, expiry, revoke), and receive in-app notifications for share and thread events

Tech stack and how it works

Monorepo with a Next.js frontend and a FastAPI backend, run locally with Docker Compose (postgres, backend, frontend).

Pipeline

1. Ingest - User uploads files or pastes text to /parse.
2. Parse - Backend extracts rows with PyMuPDF (and OCR when needed), applies range/unit heuristics, returns ParsedRow objects.
3. Review - Frontend shows an editable table so OCR/parse mistakes can be fixed before explanation.
4. Interpret - Backend calls OpenAI with a strict JSON schema, one repair attempt, then a safe fallback.
5. Share / notify (authenticated path) - Reports and consents live in PostgreSQL. Patients grant clinician access with scope and expiry; audit events record create, view, revoke, and expiry; notifications surface share and thread activity in the UI.

backend/     FastAPI, SQLAlchemy, Alembic, parser, LLM, auth, sharing, notifications
frontend/    Next.js 14 App Router, React 18, Chart.js
docs/        SRS, security assessment, feature specs
docker-compose.yml

Stack

• Frontend: TypeScript, Next.js 14, React 18, Chart.js, Vitest
• Backend: Python 3.11+, FastAPI, Pydantic, SQLAlchemy, Alembic, asyncpg
• AI / OCR: OpenAI API, PyMuPDF, Tesseract, Pillow
• Auth: JWT access/refresh tokens, passlib bcrypt
• Data: PostgreSQL 16 (Docker); SQLite used in tests only
• Ops: Docker Compose, request IDs (X-Request-ID), APScheduler for expired-share cleanup

Project link: github.com/InnovAIte-Deakin/AI-Prototyping-Lab---MedTech-Stream

My contribution

Authentication and session UI (T3 / FR8)

• Built the frontend auth flow: register, login, logout, and session persistence in localStorage
• Added AuthProvider / useAuth with role support (patient, caregiver, clinician), token expiry checks, and protected routes via ProtectedView
• Wired Header login/register vs email/role/logout states and protected /parse and related routes
• On the backend, added bcrypt password hashing/verification and tightened auth error handling and unauthenticated redirects
• Merged PR: Frontend setup (#10)

Report history and sharing preferences (T4)

• Added patient-scoped report history (list + detail pages) and sharing preference controls (clinician recipient, scope, expiry)
• Connected the parse/explain flow so completed parses and interpretations land in the user's report history
• Added frontend tests for history scoping, detail rendering, and sharing controls

Consent-driven sharing, expiry, revocation, and audit (FR9)

• Backend work for clinician-recipient validation, create/revoke shares, patient-scope vs report-scope precedence, and clinician shared-report listing with dedupe
• Audit events for share created, revoked, viewed, and expired, plus patient-facing audit retrieval with ownership checks
• Scheduled cleanup for expired shares and startup Alembic migration application
• Integration-test harness covering sharing, revocation, expiry, cleanup, and clinician listing
• Merged PR: Consent-Driven Sharing, Expiry, Revocation, and Audit-Log Backend (#14)
• Follow-up fix: force UTC when parsing audit timestamps

In-app notifications (T18)

• Spec/plan docs, API envelope contract, and TDD coverage (failing tests first) for notification list, unread count, mark-read, and mark-all-read
• Backend emission for share and thread events, plus notifications when a share expires
• Frontend: notification bell with unread badge, slide-in drawer, /notifications page, React context store, and deep links into report/thread views
• Merged PR: Feat/T18 In App Notification (#22)

Security assessment

• Wrote a red-team style security assessment covering auth/session, RBAC, consent scope enforcement, uploads/OCR, LLM calls, logging, CORS, and persistence behavior
• Documented severity, reproduction notes, and remediation for findings such as summary-only share scope not fully enforced and large JSON parse payloads
• Merged PR: feat(security): add comprehensive security assessment report (#27)

Other repo work

• Helped land early backend setup and codebase-context merges (#8, #9)
• Applied Alembic migrations on app startup and improved parse error handling during report feature work