When a new doctor asked "what medications has she been on, and when did the seizures start?", I could answer — but only because I had spent hours the night before going through binders. That felt wrong.

So I built OpenAvisio.

What it does​

OpenAvisio is a self-hosted health data vault. You upload medical documents — PDFs, photos of letters, scan results — and the AI-powered processing pipeline takes over. It reads the document, extracts structured data (diagnoses, medications, lab values, measurements, recommendations), and files everything into the patient record automatically.

On top of that:

• Incident tracking — log seizures, falls, or allergic reactions with suspected triggers and context. The onset date of any incident type is always derivable from the first recorded event, no separate field needed.
• Health log — daily observations: mood, pain level, sleep quality, medication compliance.
• Calendar — appointments and health events on a timeline, including events proposed automatically from uploaded documents.
• AI Health Assistant — ask questions in plain language across all clinical data and documents. "What did the neurologist recommend in March?" or "How many seizures were there last year?"
• Multi-caregiver access — both parents, a grandparent, a nurse, a therapist — each gets their own login, all seeing the same patient record.
• FHIR R4 export — your data stays yours. Export the full record at any time as a standard FHIR bundle.

How it works technically​

The stack is intentionally boring: FastAPI backend, Next.js frontend, PostgreSQL with pgvector for semantic search, Celery for background processing.

The AI runs locally by default via Ollama, which means patient data never leaves your infrastructure. If you want more extraction quality and are comfortable with a EU-based processor, you can point it at Mistral AI instead — but even then, embeddings and vision OCR stay local.

Document files are encrypted at rest with envelope encryption: a random per-document key wrapped under a KEK you control. Rotating the KEK re-wraps the document keys without touching the files.

Authentication is password + optional passkey. Sessions are short-lived JWTs. All mutations are audit-logged.

Why self-hosted?​

Health data is special-category data under GDPR Article 9. I did not want to run a service where other people's children's seizure histories sit on my server. Self-hosting means the family, the care home, or the clinic is the data controller — not me.

OpenAvisio is licensed under AGPL-3.0 for self-hosted use. A Commercial license removes the patient and user limits for organisations that need it.

Try it​

The source is on Codeberg. Feedback, issues, and pull requests are welcome.