NeoLife

Context

Telehealth brands that sell compounded medications — TRT, HRT, hair, skin, LDN — hit a structural wall. Shopify and its payment processors won't legally hold PHI or process a prescription charge, and the dominant pharmacy-intake system, LifeFile, is a 2006-era, Basic-Auth, one-credential-per-pharmacy portal with no storefront connector and no routing abstraction. The compliant architecture is a HIPAA middleware layer that owns the PHI, the provider gate and the BAA, sitting between non-PHI commerce and the pharmacy.

NeoLife is that layer. It normalises an order — arriving from a Shopify webhook, an embedded intake widget, a clinic console, or an AI agent over MCP — into one canonical model; holds it until a licensed provider approves it; and dispatches it exactly once to the right pharmacy behind a pharmacy-agnostic adapter, with configurable multi-pharmacy routing and failover. The wedge is deliberately narrow: be the neutral routing-and-fulfillment rail the funded incumbents structurally can't offer a brand — never steering, never taking a spread on the drug.

What I built

• A Turborepo / pnpm monorepo — a NestJS API plus four Next.js product apps (clinic console, ops & pharmacy console, patient portal, investor data room), a standalone marketing site, and eleven shared packages.
• A global guard + interceptor chain on every route: rate-limit → JWT auth → deny-by-default permissions → idempotency → append-only audit, with a hard provider-approval guard so no code path can submit an unapproved clinical order.
• An order state machine with atomic single-dispatch — a compare-and-swap claim into a transient submitting state means a concurrent retry or redelivered webhook is an idempotent no-op, so a patient never gets a second physical order.
• A pharmacy-agnostic adapter interface (Mock / LifeFile / Empower) with signed inbound webhooks, and a pure routing resolver with per-product, per-category, rule-based and manual modes plus auto / manual / single-source failover.
• A developer platform: machine API keys, a generated OpenAPI 3.1 spec, Node and Python SDKs, a CLI, and an MCP server that exposes the fulfillment rail as safe agent tools.
• A deterministic, versioned intake/eligibility engine that emits a tamper-evident compliance certificate, plus a Claude-backed drafting loop that falls back to a deterministic stub when no key is set.

How it's built

A Turborepo + pnpm monorepo (Node 20, TypeScript strict). The backend is NestJS on Express: bootstrap hardening fails fast in production if security-critical config is left at dev defaults, applies helmet, an explicit CORS allowlist and single-hop trust-proxy, enables raw-body for Shopify HMAC verification, and serves generated OpenAPI 3.1. All state is PostgreSQL via Prisma with transparent AES-256-GCM PHI encryption, multi-tenant scoping, and restrict-on-delete relations that keep the PHI and audit chain intact. Contracts are shared Zod schemas.

The order pipeline converges every source — chat, upload, connector, MCP, Shopify — onto one canonical order and its state machine, with an atomic compare-and-swap claim guaranteeing exactly-once dispatch and rollback-on-failure re-entry for failover. AI is Claude via the Anthropic API for extraction, drafting and the agent loop, with deterministic stubs when unkeyed — so the whole loop runs locally with no external credentials (mock pharmacy + stub AI). Compliance is enforced structurally, not by convention: deny-by-default permissions, an append-only audit log with a PHI-accessed flag, per-webhook signature guards, and a demo/live master switch a production build refuses to start in demo mode.

Outcome

The platform is built and tested end to end and runs locally with no external credentials — mock pharmacy plus stub AI — spanning multi-pharmacy adapters and routing, provider-approval-gated ordering, intake/compliance/certificates, a full developer platform (API keys, OpenAPI, SDKs, CLI, MCP), two-sided billing, magic-link SSO, an investor data room and a live marketing site. What it demonstrates is less any single feature than a coherent, compliance-first system design — safety and idempotency enforced in the guard chain and the state machine rather than left to callers, and a vendor abstraction clean enough that adding a pharmacy is a new adapter and a factory case, nothing above it changing.