One laboratory cannot see another
Every row belongs to a laboratory, and the database refuses a read or a write that crosses that line — row-level security in Postgres, not a filter the application remembers to apply. Two laboratories share one deployment and never meet.
Tenancy and RLS →A specimen, end to end
Ordered, collected, accessioned, labelled, benched, entered, reviewed and released — with an append-only chain of custody, and an amendment that keeps the original readable rather than overwriting it.
User guide →Honest about what it is
HIPAA-conscious, never “HIPAA-compliant” — no software can be. Waves 0 to 3 are built; billing, quality control, scheduling, portals and interoperability are not, and the roadmap says so rather than implying otherwise.
What is not built →LabFlow is designed, built, and maintained by Ahsan Mahmood — full-stack engineer specialising in React, Capacitor, and Firebase. See the Author page for contact, portfolio, and how to support the project.