CareAi is a GDPR-compliant mobile therapy platform for European users, pairing real-time video with live multilingual transcription, socket-driven EMDR sessions, and AI-assisted summaries in one secure app.
CareAi connects therapists with patients through video consultations, chat, AI-assisted analysis, and interactive EMDR in one mobile experience. Because it was built for European users, performance, privacy, and GDPR compliance were part of the core engineering work from day one — not a layer added at the end.
How a session runs in real time
Two channels carry a live session: Agora for media and transcription, and Socket.IO for the therapist-controlled EMDR state. They run side by side inside the same call.
Real-time EMDR from the therapist dashboard
EMDR — Eye Movement Desensitization and Reprocessing — guides patients through specific visual and auditory patterns to help process trauma, and it had to be fully interactive from the therapist side.
The app already relied on socket-based communication for real-time features, so EMDR leveraged that. On the therapist's web dashboard, a slider or buttons control the animation — dot direction, color, speed, sound, and background. Each change is sent as a JSON payload over the socket. The patient, connected in the same video session, receives it instantly and updates the EMDR state in real time — showing, hiding, or changing patterns mid-session as if therapist and patient were in the same room.
Live video and multilingual transcription
Video was the backbone of the app, and the requirement was not just stable streaming but speech-to-text transcripts for English and French. I built an Agora agent that joins the call, captures live audio, and sends the transcription to S3 for storage and real-time display. After some trial and error it ran smoothly, giving therapists live transcripts they could reference mid-session.
Summaries built from real session context
I built an AI assistant that uses previous session context and the live transcription from the call. It summarizes key points, highlights potential concerns, and makes sessions easier to review later. The goal was never to replace therapist judgment — it was to cut manual note-taking and keep important context from getting lost.
Agora for video plus STT
Building the real-time media layer from scratch
Why: Agora provided reliable video infrastructure and speech-to-text support out of the box, so the work could focus on the transcription agent and session logic instead of media plumbing.
GDPR and data security
CareAi was built primarily for European users, so handling sensitive medical data was non-negotiable. Data is encrypted at rest and in transit. Patient identifiers are replaced with aliases, so even if internal records were exposed, direct patient identity would not be leaked.
GDPR shaped how every feature was designed — from chat to transcription storage. It slowed the early work down, but it was the right call for a medical product.
The iOS build blocker
Everything worked in simulators, but the App Store build exposed a different problem: AgoraRTC bitcode errors on iOS.
The common forum fixes for stripping bitcode did not work in our Expo setup. Debugging on an M1 Mac, I found the reason: the script was modifying the local ios/ folder, which Expo regenerates and ignores during the real build. Moving the fix into a post-build Expo script — run after pod install — stripped bitcode from the AgoraRTC framework automatically, and the build went through.
A post-build Expo script that strips AgoraRTC bitcode after pod install
Patching the local ios/ folder, which Expo regenerates and ignores
Why: Expo owns the native project generation, so any manual edit to ios/ is discarded at build time — the fix has to run inside Expo's own build lifecycle to survive.
Release engineering issues like this tend to hide between tools, generated folders, and build-time assumptions. Getting them stable is what turned CareAi from a working prototype into something ready for client testing — much of the real delivery risk sat outside feature code, spread across real-time media, sockets, privacy controls, cloud storage, and App Store build behavior.
What I'd watch in production
The app shipped for client testing, so these are not measured results — they are the first signals I'd instrument if I owned this longer-term:
- Agora call quality — call-drop and reconnect rates, since a dropped call interrupts an active therapy session.
- Transcription latency and accuracy per language — English vs. French, since the transcript feeds both the therapist view and the AI summaries.
- EMDR socket desync — whether the patient's EMDR state ever drifts from what the therapist dashboard sent, and how fast it recovers.
- S3 encryption and access auditing — who and what touches stored transcripts, given the medical data involved.
- GDPR data lifecycle — retention windows and right-to-erasure requests handled cleanly across transcripts, chat, and session records.
Key results
- Real-time EMDR fully controlled from the therapist dashboard over sockets
- Multilingual (EN/FR) live transcription integrated via Agora STT
- AI assistant for session summaries built from real session context
- GDPR-compliant handling of sensitive medical data — encrypted, aliased identifiers
- iOS AgoraRTC bitcode blocker resolved with a post-build Expo script
- Deployed to both the App Store and Play Store for client testing