Health Dash
Chart your own pathology results from My Health Record PDFs, with a local vision model doing the reading and a CSP that makes uploading your data impossible.
Australia's My Health Record offers consumers no bulk export and no self-serve API. What you can get is one rendered PDF at a time with the structured layer stripped. This app rasterises each page, shows it to a local vision model, verifies every number against the page's own text layer, and charts trends over time. No account, no server, no cloud.
Privacy as a test, not a promise
The policy is default-src 'self' with connections limited to the app itself and two localhost Ollama origins. The privacy test suite parses the policy out of the built bundle and asserts that every connection source is localhost, that no wildcard scheme has crept in, that no external script or style is referenced, and that the Ollama endpoint is still a hard-coded constant. The verification script builds first, because the claim is about shipped artefacts. A loosened directive becomes a failing test rather than an invisible regression.
Extraction that argues with itself honestly
The grounding module states what it proves, that the number exists on the page, and what it does not, that it was attached to the right analyte. The client module explains that the endpoint is hard-coded because a configurable one would be an exfiltration path the policy could not close. Scanned pages with no text layer are kept but marked unverified rather than silently trusted. The README states the scope plainly: diagnoses, medications and exports are not built yet. This is the extraction slice.