A Privacy-Centric Mobile Application for Secure Patient Data Management
MedSecure is a privacy-first mobile health application that lets patients securely store, manage, and share their Electronic Health Records (EHRs) within the Internet of Healthcare Things (IoHT). It combines strong encryption, multi-factor authentication, role-based access control, and AI-assisted document digitisation to give patients full control over their medical data while remaining compliant with HIPAA and GDPR.
🎓 Built as a final-year dissertation project at the University of Greater Manchester by Mudassar Qayyum (Student ID: 2325216), supervised by Aamir Abbas.
- Overview
- Key Features
- Screenshots
- Tech Stack
- Architecture
- Getting Started
- Security & Compliance
- Evaluation Results
- Limitations
- Roadmap
- Contributing
- License
- Acknowledgements
The growing adoption of connected medical devices and digital health records has introduced serious concerns around data privacy, security breaches, and regulatory compliance. Many existing mobile health apps lack robust privacy mechanisms, leaving sensitive patient data exposed to unauthorised access and third-party misuse.
MedSecure addresses these gaps by putting the patient at the centre of data control. Patients can digitise paper records, decide exactly who can view them, set time-limited permissions, and track every access through a real-time audit trail — all backed by industry-standard encryption.
- Patients often carry physical copies of medical reports that can be lost, damaged, or accessed by unauthorised people.
- Existing health portals rarely give patients meaningful, granular control over their own data.
- Weak encryption and authentication remain a leading cause of healthcare data breaches.
| Feature | Description |
|---|---|
| 📷 OCR Document Digitisation | Scan physical health documents and convert them into secure digital records via an OCR pipeline. |
| 🤖 AI Health Insights | Rule-based analysis surfaces simplified, actionable summaries (e.g. flagged readings) from uploaded records. |
| 🔑 Consent & Privacy Management | Patients grant, revoke, and time-limit access per provider and per record type. |
| 🛡️ Role-Based Access Control (RBAC) | Permissions enforced by role (patient / doctor / admin) so users only see what they're authorised to. |
| 🔐 AES-256 Encryption | All records encrypted at rest in the database; TLS/HTTPS protects data in transit. |
| ✅ Multi-Factor Authentication (MFA) | OTP-based verification to ensure only legitimate users access sensitive records. |
| 📜 Audit Logging & Traceability | Time-stamped logs of every upload, deletion, permission change, and login. |
Replace the placeholders below with real screenshots or GIFs. Drop image files into a
docs/screenshots/folder in the repo and update the paths.
| Screen | Description |
|---|---|
| 📷 Upload | Capture or pick a document, add metadata, and save it encrypted. |
| 📂 My Records | Browse digitised records grouped by date and title. |
| 🔑 Consent Dashboard | Grant, revoke, and time-limit access per provider. |
| 📜 Audit Logs | Real-time, time-stamped view of who accessed what. |
Add a short walkthrough GIF here, e.g.
docs/demo.gif
Built on the MERN stack with supporting tooling:
- Frontend: React Native (Expo) — component-based, reusable mobile UI
- Backend: Node.js + Express.js — RESTful APIs, auth, encryption, AI inference logic
- Database: MongoDB (MongoDB Atlas for cloud simulation) — flexible, document-based storage for unstructured medical content
- OCR: OpenAI API for document text extraction
- Security: AES-256 encryption, TLS/HTTPS, OTP-based MFA, RBAC, token-based sessions
- DevOps: Docker & Docker Compose for containerised, reproducible environments
- Analytics: Power BI & RStudio for usage monitoring and evaluation dashboards
MedSecure follows a layered, modular architecture inspired by microservices principles, separating concerns across three layers:
┌─────────────────────────────────────────────┐
│ Presentation Layer (React Native) │
│ • Document upload panel (OCR) │
│ • Consent dashboard │
│ • AI insights view • Audit log viewer │
├─────────────────────────────────────────────┤
│ Business Logic Layer (Node.js / Express) │
│ • RESTful APIs • Auth & MFA │
│ • AES-256 encryption • RBAC enforcement │
│ • AI inference • Audit logging │
├─────────────────────────────────────────────┤
│ Data Layer (MongoDB) │
│ • Encrypted records • Access metadata │
│ • Permission history • Audit trails │
└─────────────────────────────────────────────┘
Frontend, backend, and database are decoupled so each component can be developed, tested, and upgraded independently.
⚠️ This is a research prototype. Set up a.envfile with your own secrets (DB URI, JWT secret, OpenAI API key) before running.
- Node.js (LTS recommended)
- npm or yarn
- MongoDB (local or Atlas)
- Expo CLI for the mobile client
- Docker (optional, for containerised setup)
# Clone the repository
git clone https://github.com/Mudassarqayyum/medsecure.git
cd medsecure
# --- Backend ---
cd backend
npm install
cp .env.example .env # then fill in your secrets
npm start
# --- Frontend (in a new terminal) ---
cd frontend
npm install
npx expo startCreate a .env file in the backend directory:
MONGO_URI=your_mongodb_connection_string
JWT_SECRET=your_jwt_secret
OPENAI_API_KEY=your_openai_api_key
ENCRYPTION_KEY=your_aes_256_keydocker-compose up --buildMedSecure was designed around international healthcare data-protection standards:
- AES-256 encryption for all data at rest
- TLS/HTTPS for all client–server communication
- Multi-Factor Authentication via OTP verification
- Role-Based Access Control to limit data exposure
- Token-based sessions with automatic expiration to mitigate session hijacking
- Audit logs supporting HIPAA and GDPR requirements (data minimisation, informed consent, right to access)
A pilot usability study with 15 purposively selected participants produced the following results:
| Metric | Result |
|---|---|
| Overall task success rate | 93% |
| Average task completion time | < 3 min |
| Ease of use (1–5) | 4.4 |
| Privacy satisfaction (1–5) | 4.2 |
| Felt in control of their data | 83% |
| Preferred over traditional portals | 87% |
| Feature | Success Rate | Avg. Time (min) | Ease of Use | Privacy Satisfaction |
|---|---|---|---|---|
| OCR Upload | 93% | 3.1 | 4.3 | 4.0 |
| Consent Dashboard | 95% | 2.4 | 4.5 | 4.6 |
| Audit Logs | 89% | 2.8 | 4.1 | 4.4 |
| AI Summary | 91% | 2.9 | 4.2 | 4.1 |
Qualitative feedback consistently highlighted three themes: user control, system clarity, and data transparency.
- Tested with simulated patient data rather than real medical records (for privacy/ethics compliance).
- The AI module is rule-based, not an adaptive machine-learning model.
- OCR accuracy degrades in low-light conditions or with poorly scanned documents.
- Occasional OTP delays observed in low-bandwidth conditions.
- Deployed via local Docker emulation — no live hospital network or EHR integration tested yet.
- Replace rule-based AI with ML/NLP models for personalised, context-aware insights
- Improve OCR with preprocessing (noise reduction, contrast, orientation) and handwriting recognition
- Integrate with national health systems and EHR platforms
- Add blockchain-based audit trails for tamper-proof data history
- Expand usability testing to a larger, more diverse participant pool
- Conduct longitudinal studies on engagement and health outcomes
Contributions, issues, and feature requests are welcome! Since this began as a dissertation prototype, contributions that improve security, OCR accuracy, or the AI module are especially valued.
- Fork the repository
- Create a branch for your feature or fix
git checkout -b feature/your-feature-name
- Commit your changes with a clear message
git commit -m "Add: brief description of your change" - Push to your fork
git push origin feature/your-feature-name
- Open a Pull Request describing what you changed and why
- Keep security and privacy front of mind — never commit secrets, API keys, or real patient data.
- Follow the existing code style and add comments where logic isn't obvious.
- Open an issue first for large changes so we can discuss the approach.
- Test your changes before submitting.
Found a bug or have an idea? Open an issue.
This project was developed for academic purposes. Please contact the author before reuse or distribution.
- Supervisor: Aamir Abbas
- Instructor: Dr Thaier Hamid
- Institution: University of Greater Manchester
- The open-source community behind MongoDB, React Native, Node.js, and OpenAI
Bridging usability, security, and regulatory compliance for patient-controlled digital healthcare.