Capture readings from patient-owned medical devices without uploading the source image by default.

Healthcare apps want a complete view of the patient: wearable activity, medical records, home-device readings, notes, and AI-generated guidance. Each new connection can make the experience more seamless. It can also move sensitive data across another vendor, storage layer, retention policy, and regulatory boundary.

“Encrypted in transit” is a transport control, not a complete privacy strategy. A founder still needs answers to harder questions: Did the image need to leave the phone? Is the raw image retained? Can a processor use it for model improvement? What happens when consent changes? Which party owns deletion?

The customer problem is simpler

A patient already owns a working device. A camera-based input path can reduce dependence on a particular Bluetooth model, a new account, or a manual multi-field form. The business opportunity is to broaden useful coverage progressively—without treating every camera frame as cloud data or assuming every device is already supported.

For a founder, healthcare product leader, or CTO, the investment case is broader than model capability. A carefully validated capture workflow could expand product coverage while preserving direct integrations where they remain the better choice.

The intended architecture assigns work according to sensitivity and capability. Device-side processing would handle capture, device classification, value extraction, unit normalization, timestamp detection, confidence scoring, and optional redaction. The app would present the structured result for human confirmation before anything is submitted.

React Native orchestrates the boundary—it does not hide it

In this design, React Native would coordinate camera state, wearable ingestion, consent, lifecycle, offline queues, error recovery, and the review UI. Native modules would own model execution and platform-specific resources. A typed boundary would return a versioned structured result to JavaScript, where runtime validation could reject malformed or unsupported payloads before persistence or backend submission.

Cloud-assisted inference and services may remain valuable for longitudinal analysis, clinician collaboration, advanced reasoning, and workflows that require shared state. In the proposed hybrid architecture, the backend should receive only the minimum user-confirmed fields needed for that job—not the source image simply because uploading is convenient.

The planned mobile flow is intentionally short. The user would scan the display, see what the model understood, review and correct every extracted field, and approve the submission. On-device processing is intended to produce the first useful result without waiting for an upload or a stable connection.

1

Frame the device

Visual guidance helps the user align glare-prone LCD and LED displays.

2

Understand locally

The supported local extraction pipeline would identify device category, readings, units, and any visible measurement time.

3

Review every field

Low-confidence or inconsistent fields require recapture or explicit confirmation instead of silent acceptance.

4

Submit intentionally

Only the user-confirmed structured payload would enter the app's controlled backend workflow.

If a measurement time is visible, the planned workflow would extract it and label the source as device_display. Otherwise, it would use capture time and record capture_time. That provenance would prevent a convenient fallback from masquerading as an exact clinical timestamp.

A confidence score represents how certain the extraction system is that it correctly interpreted the visible display. It does not establish whether the medical device itself is accurate, or whether a measurement is clinically normal, safe, or appropriate. Those are separate questions outside the extraction layer.

The system should preserve what it can actually see rather than silently changing a medically unusual value because it appears statistically unlikely. Every extracted field must remain reviewable and correctable before submission. Format validation and clinical interpretation must remain separate concerns.

Encryption is required, but minimization is the stronger starting point. If raw camera imagery is not necessary outside the device, the safest retention period is zero and the safest third-party permission is none.

Threats worth designing for

Prompt injection does not apply in the same way to every extraction pipeline. Constrained OCR followed by deterministic parsing does not interpret visible text as instructions, although it still needs robust parsing and input validation. When a multimodal generative model interprets an image, however, every visible word must be treated as untrusted input. Text in the image must never override system instructions, the extraction schema, allowed fields, or permitted backend actions.

Other risks include screen captures in logs, analytics events containing health values, model files replaced at runtime, replayed submissions, stale consent, debug builds with broader storage, and unbounded offline queues. Schema validation reduces malformed-data risk but is only one control within a broader design that also needs signed model assets, least-privilege permissions, log redaction, protected local storage, authenticated requests, replay resistance, and testable deletion behaviour.

That position may reduce hesitation for patients and strengthen conversations with hospitals, insurers, and enterprise buyers—but only after the implemented extraction, telemetry, fallback, and support paths have been verified to honour it.

A production implementation may use a bundled model, a securely delivered model, deterministic vision or OCR components, or a constrained hybrid pipeline. The choice should depend on supported devices and measured reliability; remote model delivery is an operational option, not a default requirement.

These are proposed acceptance metrics, not measured production results. A founder-level scorecard should evaluate the complete workflow across a documented matrix of device classes, display technologies, lighting conditions, unit formats, operating systems, and target phones.

No accuracy, latency, privacy, or cost result should be presented publicly until it has been measured against a documented device matrix and test protocol.

A leader's job is not to maximize local inference at any cost. It is to place each capability where customer value, privacy risk, reliability, operating cost, and team complexity balance correctly.