Welcome back to the dev log! If you read my Sprint Zero post, you know my capstone partner, Collin, and I set out to build a full-stack AI platform using an asynchronous, horizontally split workflow. As we transitioned from initial scoping into Month 2 of our build, our concept matured into MedReach AI—a specialized B2B healthcare SaaS platform designed for mid-size pharmaceutical and medical device companies.
However, as we dove into our software architecture review this week, we hit a massive strategic crossroads that forced us to completely refactor our engineering roadmap and Jira backlog.
The Problem: The Insecure "Marketing Automation" Trap
Originally, we visualized MedReach AI as an AI-driven marketing campaign generator that happened to clean Healthcare Professional (HCP) databases. But after evaluating industry pain points, we realized we were solving the wrong problem first.
In the pharmaceutical and medical device sectors, marketing teams don't struggle to generate email copy; they struggle with dirty, unvalidated, and legally hazardous data. Up to 30% of standard HCP databases are riddled with outdated contacts, retired physicians, and unvalidated National Provider Identifier (NPI) numbers. Running automated campaigns on bad data doesn't just waste budget—it creates massive legal exposure under federal regulations like the Physician Payments Sunshine Act and FDA off-label promotion guidelines.
Furthermore, enterprise platforms that actually solve this (like Veeva or IQVIA) cost upwards of $500,000 annually, pricing out two- to three-person marketing teams. From an engineering perspective, treating data cleaning as a simple preprocessing step for a marketing tool was a recipe for disaster. It meant we were treating security, multi-tenant data isolation, and role-based access control (RBAC) as secondary features. In healthcare SaaS, if you bolt on security at the end, your platform is inherently broken.
Caption: Restructuring our Jira backlog into three distinct functional milestones: Data Management, Data Intelligence, and Visualization & Export.
The Solution: A "Data Intelligence First" Architecture
To fix this, Collin and I leaned heavily into our Agile framework and initiated a comprehensive architecture pivot. We repositioned MedReach AI entirely around Data Intelligence, treating campaign generation simply as one of several downstream outputs of a clean, standardized dataset.
To execute this without losing sprint velocity, we made three critical architectural decisions this week:
1. Shifting RBAC and Security to the MVP Blocker
We completely reorganized our 54-task Jira backlog into three new phased milestones: Phase A (Data Management MVP), Phase B (Data Intelligence Alpha), and Phase C (Visualization & Export Beta).
Crucially, we pulled our Firebase Authentication JWT middleware, Firestore database-level multi-tenant security rules, and full-stack RBAC (Admin, Editor, Viewer roles) out of future sprints and pushed them directly into Phase A. Why? Because no file upload or cleaning pipeline should ever be tested without strict tenant isolation already enforcing database boundaries.
2. Killing the Paid API (Why Local Open-Source Wins)
In an era where every startup simply wraps the OpenAI or Anthropic API, we made a deliberate engineering choice: we are using zero paid external LLM APIs.
Instead, our FastAPI backend orchestrates self-hosted Meta Llama 3 8B and Mistral 7B models running locally on an on-premise Ollama runtime. In healthcare, clients are legally and commercially terrified of transmitting Protected Health Information (PHI) or proprietary HCP lists to third-party AI vendors. By keeping 100% of our AI inference inside our own platform infrastructure, we eliminate per-call API costs at scale and turn data privacy into our primary B2B selling point.
Caption: MedReach AI's system architecture, highlighting our self-hosted AI runtime and isolated Firestore multi-tenant data layer.
3. Layering the Tech Stack for Asynchronous Speed
By stabilizing our Phase A core this week, Collin and I can safely maintain our horizontal split. While Collin builds out the React 18 / Tailwind CSS drag-and-drop upload zones and natural language query interfaces on the frontend, I am building the backend Python pipelines. I'm currently integrating Microsoft Presidio for automated PII/PHI detection, scikit-learn for Isolation Forest anomaly detection, and asynchronous HTTP clients to validate provider records against the public CMS NPI Registry in real time.
What This Means for My Journey
As someone aspiring to step into an AI Solutions Program Director or Product Manager role, this week was a masterclass in product framing and technical risk management. It reaffirmed a core lesson: good software architecture isn't just about writing clean code; it's about aligning your database schemas and sprint backlogs with the actual commercial and regulatory realities of your industry.
With our roadmap refactored, our Jira board aligned with our design documentation, and our security gates locked in place, we are ready to build the core cleaning engine.
Next stop: getting our pandas chunked CSV ingestion pipeline and Presidio anonymizers communicating smoothly. Stay tuned for Sprint 2!
Top comments (0)