31 Roadmap

This page collects candidate work for HealthBook AI (internal code name: BabyCare). Each item comes from a limitation documented in Limitations or from notes and comments in the code, such as "enable only after device testing" or "require a pose model that this build does not ship". Nothing here is a commitment. There are no dates, no priorities are promised, and any item may be dropped. Every candidate must keep the product's safety rules intact: prescribed ≠ scheduled ≠ given, OCR extracted ≠ clinically verified, stool-image interpretation is observational only, and AI never prescribes or changes doses.

How items are framed

Field	Meaning
Source	the limitation or code comment that motivates the item
Candidate	a possible direction, not a design decision
Constraint	the safety or privacy rule the change must keep

Hosting, scaling and operations

Candidate	Source	Constraint
Switch the rate limiter to the existing database-backed store (BABYCARE_RATE_LIMIT_STORE=db), or a shared cache, before running more than one instance	in-memory, per-process limiter in api/guardrails.py	keep auth routes at 30 requests a minute and never log request bodies
Move large export and share-ZIP generation to a background job with a short-lived private result	synchronous in-memory rendering in api/export_pdf.py and api/share.py	results stay private, no-store and audited; nothing reaches a public URL
Scheduled, encrypted backups that keep the application key separate	"no automatic backups" note in scripts/cloud_backup.py	restore still only writes into an empty database
Health and wake-up handling for clients (warm-up pings, clearer retry UX)	sleeping free instance in render.yaml, web/doctor.js	no clinical content in health or scheduler endpoints

Accounts and security hardening

Candidate	Source	Constraint
Email ownership verification at sign-up and a generic registration response	register returns 409 Email already registered	match the non-enumerating behaviour of api/password_reset.py
Optional second factor and a per-device session list with "sign out other devices"	14-day sessions and only logout in api/main.py	session tokens stay hashed at rest
Account recovery that does not depend only on mailbox access	email reset is the only recovery path	no recovery path may bypass profile isolation
Key rotation tooling for the Fernet application key	api/crypto.py refuses to create a replacement key	never silently create a new key next to unreadable records
Constant-time comparison for camera worker keys	plain hash comparison in worker_camera	keys stay hash-only at rest
Keep the doctor token out of request paths (for example, a header exchange after the page loads)	token in /api/share/public/{token} paths	token stays hash-only at rest; links stay noindex and no-store

Documents, OCR and exports

Candidate	Source	Constraint
Make HEIC truly optional on the stool-photo path (fall back to a plain image-dimension read when pillow_heif is missing)	_dimensions in api/care_api.py imports pillow_heif unconditionally	the original bytes are never modified
Use the premium renderer for share-package summaries (wire up build_share_summary_pdf) so Unicode text is preserved	_latin() in api/share.py; unused function in api/export_pdf.py	keep every provenance label and package-file reference
Embed explicitly selected stool photographs in the export appendix, or remove the note that says they follow	api/export_pdf.py note versus _append_sources	photos only when the caregiver explicitly ticks them; the disclaimer is shown with them
Replace R{document id} references in full exports with package-relative references	api/export_model.py	references must still resolve to the exact original page
Better handwriting support through an opt-in, consented vision provider	api/providers.py, api/history_api.py handwriting rule	the output stays an unverified transcription until a human verifies it; no dose is derived from handwriting
Standards-based interoperability export	no FHIR or HL7 output exists in the code	statuses copied, never inferred

Daily Health and stool photos

Candidate	Source	Constraint
Offline queue for the web client, reusing client_key idempotency	the offline queue exists only in mobile/DailyCareScreen.tsx	replays must stay idempotent
Tool to re-bucket local_date after a profile timezone change, with history kept	local_date is computed at write time	corrections go through record_revisions; nothing is deleted
Scheduled cleanup of expired stool-intake cards	lazy _expire_intakes	blobs deleted, actions audited
A better image model for colour and consistency suggestions	heuristics in api/care_vision.py and api/stool_intake.py	FORBIDDEN_WORDS enforcement and the fixed disclaimer stay; suggestions are never saved without confirmation
Growth percentiles from a validated standard	"validated pediatric standards are not implemented"	label the standard; never imply a diagnosis

Notifications

Candidate	Source	Constraint
Documented EAS project setup and device test checklist before enabling BABYCARE_PUSH_ENABLED	mobile/App.tsx, render.yaml comment	push text stays the fixed generic sentence; a notification is never proof a dose was given

Home camera

Candidate	Source	Constraint
An optional local pose model so that posture classes can be emitted	MotionAnalyser docstring in api/camera.py	runs on the home worker; posture events below 0.6 confidence stay rejected; caregiver review still required
Make the activity analysis mode differ from motion	the worker uses the same analyser for both	movement and presence metadata only
Local clip recording plus an enforced retention sweep	record_clips and retention_days have no writer or sweeper	clips stay local unless cloud_upload_allowed; audio stays off
Run Test connection and Preview from the local worker instead of the API host	probes run on the API host in api/camera_api.py	raw video stays on the home network by default

Out of scope by design

Some things will stay out regardless of demand: AI prescribing or changing doses, diagnosing from stool images or camera feeds, treating reminders or acknowledgements as administration, and inventing clinical thresholds. Thresholds remain clinician-provided values the caregiver types in.

Implementation

This page is derived from Limitations and the modules cited there: api/guardrails.py, api/main.py, api/crypto.py, api/care_api.py, api/share.py, api/export_pdf.py, api/export_model.py, api/camera.py, api/camera_api.py, api/camera_worker.py, mobile/App.tsx, mobile/DailyCareScreen.tsx and render.yaml.

Related pages

Limitations · Design Decisions · Security and Privacy Model · Deployment and CI/CD · Home