Neurotech · Health data · My own product
Brain maps from raw EEG in the cloud, with HIPAA safeguards designed in from the first commit.
A cloud brain-mapping (qEEG) and reporting platform for neurofeedback practitioners. Upload a recording, get research-grade measures and a brain-map report to share with the client. It's my own product: I designed and built all of it, entirely separately from client work. No client's code, data or IP is in it.
- Client
- LumenMind
- Role
- Founder and engineer
- Period
- 2025 – present
- Focus
- My own product, built end to end
- diagnostic claims, by design
- 0diagnostic claims, by design
- audit log of every access to patient data, kept six years
- Lockedaudit log of every access to patient data, kept six years
The problem
Most tools in this space are desktop software. Recordings sit on individual laptops, reports are put together by hand, and it's hard to say who has looked at a client's data.
Brain recordings and client details are protected health information, and the product had to be useful without drifting into medical-device territory, which would bring regulatory obligations a small company can't carry.
What I built
- 01
Scope written down first
A product-scope document that keeps LumenMind an assessment and training tool, not a diagnostic one. It drives everything downstream, from report wording to which features get built.
- 02
Signal pipeline
Turns uploaded EEG recordings into research-grade measures (band power, asymmetry, connectivity) and compares them against normative data.
- 03
Reports practitioners stand behind
Automated brain-map reports to share with clients. The interpretation is written by the practitioner, not generated by AI, and every report says it isn't a medical diagnosis.
- 04
HIPAA by design
Patient data kept only in services covered by a business associate agreement, access limited by role, and every access to patient data logged to an archive that can't be altered or deleted for six years.
- 05
Cloud that scales with the work
Processing runs on Google Cloud as queued background jobs, so a batch of recordings never slows the app down, with the whole setup defined as code.
The result
- A complete platform, from recording upload to finished report.
- The compliance and scope decisions are made and documented up front, so onboarding a clinic doesn't start with a security review it can't pass.
