ClearInsight AI

A dental healthcare startup in the US engaged me through Shidul from August 2023 to June 2026, as the software engineer and architect in a four-person team: the client as product owner and manager, an RPA and plugin solutions engineer who built the data extraction plugins for practice management systems, and marketing and customer relations. I owned architecture, backend development, identity and security, cloud infrastructure and release automation.

The platform is a Django application written in Python with PostgreSQL and JavaScript, running on Django Channels so the same service handles HTTP and WebSockets, served by Uvicorn. Django REST Framework exposes the APIs for referral routing, patient records, document exchange and practice administration, and Redis carries the real-time layer.

It is containerized with Docker for reproducible builds across local and Azure environments, and runs on Azure services including App Service, Front Door, Azure Database for PostgreSQL, Blob and Queue Storage, Key Vault and Document Intelligence. A separate, staff-only admin application works on the same database.

Referrals and treatment rooms

A doctor creates a referral to another doctor on the platform or to a specialist outside it, sets the order of treatments and assembles a treatment team across specialties and offices. Accepting a referral opens a treatment room, where the team keeps the treatment plan, shares documents and images, and talks in real time.

Around that sit the pieces a practice needs: availability and appointments, direct messages between doctors, in-app notifications, and connections between doctors in different practices.

Document intelligence

Referral intake starts from the patient’s documents. When a doctor uploads them, a custom Azure Document Intelligence model extracts the patient’s name, date of birth, email and phone, each with a confidence score, and the fields stream back to the open referral form over a WebSocket for the doctor to confirm.

Admin application

Staff run the platform from a separate admin application that only ClearInsight staff can sign in to. It creates each user in Entra External ID through Microsoft Graph and in the platform database in one step, releases features and controls which subscription plans expose them, and reads sign-in audit logs.

It also takes in referrals addressed to offices that are not on ClearInsight yet: the referral is held, staff contact the office and send a time-limited sign-up invite, and the referral appears on the office’s dashboard once it signs up. The same application hosts the REST API that CI-Assistant connectors call: JWT access and refresh tokens, the package catalogue and SAS-signed package links.

Key decisions

Security and identity

People sign in through Azure AD B2C and Microsoft Entra External ID over OAuth 2.0 and OpenID Connect, using MSAL, and sessions are secured with JWT. Role based access control enforces least privilege across referring dentists, specialists and practice administrators, and which features each account can use follows its subscription plan.

The platform was built to HIPAA requirements: TLS in transit, encryption at rest, an authorization check on every patient data operation, and an audit trail recording who accessed or changed each record. Patient consent and new doctors’ onboarding both use time-limited, single-use tokens; consent can also be requested through an encrypted QR code. Secrets come from Azure Key Vault, and session and CSRF cookies are secure-only.

Pick a role below to follow the sign-in path: the token carries the role, the policy decides, and the audit log records the decision.

{
  "iss": "https://example.ciamlogin.com",
  "aud": "example-api",
  "sub": "example-user",
  "roles": ["practice-administrator"],
  "exp": 1767225600
}

Delivery and operations

pytest unit and integration tests cover authentication, RBAC enforcement and referral state transitions. Structured logging, Azure Application Insights metrics and alerting trace request failures, authentication errors and WebSocket connection health, and logs are also shipped through Azure Queue Storage. Docker Compose runs the application, PostgreSQL and Redis locally; GitHub Actions and Azure DevOps pipelines take a commit to a deployed environment on Azure App Service. In total I provisioned and operated nine Azure services to production standards.

Referral status and notifications update live over WebSockets using Django Channels and Redis. Separate WebSocket consumers handle team chat, direct messages, document extraction and connector sessions. I verified the real-time layer at more than 100 concurrent connections with Apache JMeter and Azure Load Testing.

Result

The client ceased operations before commercial launch, so there are no customer or usage numbers to report, and none are claimed here. What was verified: the real-time layer under load at more than 100 concurrent connections, and nine Azure services provisioned and operated. The platform still runs as a live demonstration, and it became the foundation for SC-Oracare, which kept its referral core and grew around it.

Demo

The sign-in demo in Security and identity steps through the permission model with each role. The referral platform itself lives on in SC-Oracare: open the SC-Oracare live demo (opens in new tab), which runs on synthetic data on a free tier, so the first load can take up to a minute.