Clinic knowledge base
Front desk knowledge base for an eye clinic: six months of training turned into one search. Wichita Family Vision, an independent optometry practice in Wichita, Kansas.
- Supabase
- PostgreSQL with row-level security
- Google OAuth
- Vanilla JS PWA
- Vercel
- GitHub Actions
- DOMPurify
- Claude Code
Compliance. Built for a HIPAA-covered clinic with zero patient data in it by design: protocols and prices only, sign-in locked to the clinic's domain, a business associate agreement in force with the practice.
My role. I built it: the content model from the clinic's front-desk documents, the 35 pages and 4 decision tools, in-app editing with revision history, and the tests. A second engineer ran the pre-merge security review and the deployment.
- Who uses it
- The front desk and 2 office managers, daily since August 2026.
- Architecture
- Static PWA on Vercel reading page content, prices, and revisions from Supabase over the REST API. Editors are a Postgres table; RLS gives everyone read and 2 named emails write. Rendering sanitizes at read time, not only at save, so a REST write can never reach a reader unfiltered.
- Where it runs
- Vercel (app), Supabase free tier (content, auth, revisions), Google Workspace sign-in locked to the clinic's domain. Installed as a PWA on the front desk iPad and PCs.
- Tests and evals
- 21 regression tests plus a DOM-free sync-logic suite (31 assertions) covering restore, refresh, and the offline editor guard. Every test was written from a bug we actually hit.
- Cost and latency
- $0 a month to host. The clinic pays a small monthly retainer for the editing feature and a pass-through for the database tier.
- Guardrails
- A pre-merge security review caught 2 cross-site-scripting holes: page HTML was sanitized on save but not on render, and the editor parsed pasted HTML into the live DOM before cleaning it. Both fixed by sanitizing at render, failing closed. Monthly JSON export is the backup because the free tier keeps none.
- The tradeoff we chose
- Why this way and not the other
We built a plain PWA with search instead of the AI assistant layer the first scope had. Search on 35 well-structured pages answers the front desk's question faster than a chat box, costs nothing to run, and never invents a rule. The assistant is on the roadmap only if search ever fails a real staff question.
- Code
- github.com/alecstephens3-stack/supabase-team-knowledge-base
The pattern, rebuilt without any clinic content: RLS, domain-gated auth, revision history, sanitizer, offline sync.