CareFlow AI — Voice AI Medical Receptionist
A security-first voice AI receptionist for medical clinics — booking, canceling, and rescheduling appointments through natural conversation, with the LLM treated as an untrusted client at every step.
- Architected a security-first design where all identity verification and authorization run server-side in FastAPI — no booking, cancellation, or reschedule can execute without a backend-validated session.
- Built a real-time voice pipeline in LiveKit (Deepgram STT, GPT-4o-mini, OpenAI TTS), validated by 29 automated tests covering identity, tool-calling, and booking flows.
- Designed a RAG-based FAQ system on Supabase pgvector for clinic policy Q&A, with a similarity threshold tuned to prevent hallucinated answers on out-of-scope questions.
- Ran an OWASP LLM Top 10 red-team evaluation against the tool layer — prompt-injection and authorization-bypass vectors — with all findings remediated before deployment.