Sensera: A Privacy-First, Office-First, Personal Health Record Architecture with Consent-Scoped Clinical Access as a Serverless Clinical-Document, Machine-Learning Pipeline

We present Sensera, a production mobile health-records system built around three design lenses that are usually in tension: privacy, offline-first availability, and scalability at near-zero marginal cost. Sensera comprises a live patient application and a companion clinician application that share a single backend. Its central architectural decision is a split data plane: high-risk document bytes (scans, PDFs) never leave the patient's own Google Drive under an app-scoped OAuth grant; structured clinical data, metadata, and 1024-dimensional document embeddings live in a single Row-Level-Security (RLS) protected PostgreSQL instance; and all GPU-heavy machine learning runs on a serverless, scale-to-zero worker that is stateless and decoupled from the client. Uploaded documents are turned into searchable knowledge by an asynchronous pipeline that performs optical character recognition (Surya), schema-constrained structured extraction (Qwen2.5-3B-Instruct), and dense multilingual sentence embedding (BGE-M3), with results written back through a service role and surfaced to the client through a simple polled state machine. Cross-account data sharing—both patient-to-family and patient-to-clinician—is expressed uniformly as consent-scoped RLS: a SECURITY DEFINER access predicate gates additive, permissive read policies, so revocation is immediate and requires no polling. The clinician application layers a patient-initiated, time-boxed, revocable one-time-passcode (OTP) handshake on top of this spine, giving a doctor read access to exactly one patient's record for a bounded window. We describe the architecture, data model, offline-first client, ML pipeline, consent mechanism, and the security and compliance posture (including India's Digital Personal Data Protection Act), and we report the zero-cost infrastructure envelope together with the scale seams that carry the system past it. We conclude with the roadmap for a PHR-leveraged teleconsultation product in which a clinician joins a call already briefed by an automatically assembled, source-cited summary of the patient's own longitudinal record.