Technology
Technology and security
How Nurse at Home is built, and how it protects the health and identity information that families and nurses share with it. This page is for partners, investors and anyone who wants the detail.
-
The app
-
Protected services
-
Controlled access and records
What has been built
One app, one API and one operations console, built and in testing.
Mobile app
One app for families and nurses, built with Flutter for Android and iPhone, fully in English and Urdu, with light and dark themes and support for large text.
Platform and API
A TypeScript API that makes every safety decision: verification, emergency checks, consent, clinical orders, visit records, passes and their payments, complaints and privacy requests.
Operations console
A web console where the team reviews identities and PNMC checks, clinical orders, complaints and privacy requests, and manages pass prices, service availability and clinical waste partners.
- Home nursing services
- 28
- API endpoints
- 190
- Automated tests
- 1,380+
- Database tables
- 69
Designed for sensitive health data
The platform was designed around privacy and safety from the start.
| Area | What we use |
|---|---|
| Mobile app | Flutter and Dart for Android and iPhone, with Google ML Kit on the phone to read CNIC cards and screen the face check |
| API and workers | Node.js, TypeScript and Fastify, with request and response contracts shared by the API and the console |
| Database | PostgreSQL on Google Cloud SQL as the only database, with transactions, daily backups, scheduled deletion of expiring data, and a hash-chained audit log. Live trip positions expire within two minutes and are never backed up |
| Google services | Google Sign-In, Firebase Cloud Messaging for notifications, Google Maps Platform (Maps SDK and Routes API) for visit locations and live trips, and Firebase Hosting for this website |
| Operations console | Next.js with OpenID Connect sign-in and role-based access for reviewers |
| Other services | Google Cloud Run for the API and console, and private Google Cloud Storage for documents. Payment gateway connections are built and stay switched off until payments open |
| Security | AES-256-GCM encryption of sensitive fields, signed payment webhooks, rate limits, and a production configuration that refuses to start with test settings |
Report a security problem
Read the security reporting policy for scope, evidence handling and the contact process. Our website evidence page explains which evaluations have and have not been completed.
If you find a security problem in the app, the operations console or this website, email support@nurseathome.pk with the steps to reproduce it. Do not include patient records, identity numbers or passwords. Read the privacy policy for how personal information is handled.