Table of Contents
- What IntakeIQ Does and the Problem It Solves
- Core Mission, Vision, and Positioning
- How the Product Works and Key Features
- Ideal Customers and Market Segments
- Unique Differentiators and Competitive Advantages
- Competitor Landscape
- Current Stage, Funding Status, and Business Model
- Product Roadmap and What Is Being Built
- Go-to-Market Strategy
- Key Messaging, Language, Tone, and Communication Style
- Financials, Metrics, and Traction Data
- Team, Founders, and Key Stakeholders
- Investor/Client/Stakeholder-Facing Materials
- Partnerships, Customers, and Pilots
- Technical Architecture, Systems, and Infrastructure
- Goals, OKRs, and Success Metrics
- Risks, Challenges, and Open Questions
- Additional Material
1. What IntakeIQ Does and the Problem It Solves
The Problem
The dental industry is trapped in a paper-and-clipboard intake workflow that has barely changed in decades. The current state:
- 82% of dental practices still use paper intake forms. Patients arrive, sit in a waiting room, fill out 4-8 pages of medical history, insurance, and consent forms by hand. Staff then manually re-enter this data into the Practice Management System (PMS).
- Average intake time: 15-20 minutes per patient. This is wasted time for both the patient and the front desk staff.
- Insurance verification is manual and slow. Front desk staff call insurance companies or log into verification portals. Errors in member IDs, group numbers, and coverage types lead to claim denials.
- Claim denial rates average 5-12% at most practices, often caused by bad insurance data captured during intake.
- No clinical intelligence at check-in. Medical history flags (blood thinners, allergies, pregnancy, heart conditions) are buried in paper forms and often missed until the patient is already in the chair.
- HIPAA compliance is inconsistent. Paper forms are a security liability. PHI sits in open clipboard trays. There is no audit trail for who accessed what.
What IntakeIQ Does
IntakeIQ is an AI-powered dental intake automation platform that replaces the entire clipboard-to-chair workflow with a digital, intelligent, mobile-first experience.
The patient receives a link (via SMS, email, or QR code) before their appointment. They complete a conversational intake form on their phone in approximately 3-5 minutes. They photograph their insurance card, and AI extracts the insurance data via OCR. Their medical history is analyzed for clinical flags (drug interactions, conditions requiring precaution). A digital consent with e-signature is captured. By the time the patient arrives, the practice has a complete, verified, chair-ready patient profile.
Tagline: Intelligent Intake. Effortless Care.
2. Core Mission, Vision, and Positioning
Mission
Eliminate the clipboard from every dental practice in America by making patient intake intelligent, instant, and invisible.
Vision
Become the standard-of-care intake platform for the entire dental industry -- the layer between the patient and the practice that ensures every visit starts with complete, verified, clinically-reviewed information.
Positioning
IntakeIQ is positioned as the only AI-native, dental-specific intake automation platform. It occupies a unique quadrant in the competitive landscape:
- AI-native (not traditional/template-based forms)
- Dental-specific (not a generic healthcare or medical platform adapted for dental)
No competitor currently occupies this same intersection. Phreesia is AI-capable but medical-first. NexHealth is modern but not AI-native. Dentrix and Open Dental are dental-specific but traditional.
Brand Identity
- Name: IntakeIQ (never "Intake IQ" or "intakeiq")
- Category: AI-Powered Dental Intake Automation Platform
- Naming Rules (Non-Negotiable):
- Never "dental form software" -- it is an AI-powered intake automation platform
- Never just "intake tool" -- always "IntakeIQ" or "the IntakeIQ platform"
- Always hyphenate "AI-powered" when used as an adjective
Brand Palette (Clinical + Premium)
| Role | Color | Hex |
|---|---|---|
| Primary | Deep Teal | #0A6E7A |
| Secondary | Navy | #0D1B2A |
| Accent | Soft Gold | #D4A843 |
| Success | Emerald | #2E8B6E |
| Light | Off-white | #F7F9FC |
| Muted | Slate | #64748B |
| Gradient | Teal-to-Navy | linear-gradient(135deg, #0A6E7A, #0D1B2A) |
Font Stack
-apple-system, BlinkMacSystemFont, 'Segoe UI', Helvetica, Arial, sans-serif
3. How the Product Works and Key Features
Patient Intake Flow (7 Steps)
- Welcome -- Warm greeting, sets expectation ("about 5 minutes").
- Privacy Notice -- HIPAA privacy disclosure with expandable details. Patient acknowledges data collection. Explains AES-256-GCM encryption, access controls, no data selling, patient rights, and HIPAA compliance.
- Personal Information -- Conversational chat-style UI. Bot asks questions one at a time: first name, last name, email, phone, date of birth, reason for visit. Patient types answers in a chat bubble interface with typing indicators and smooth animations.
- Insurance Card Capture -- Patient photographs front and back of insurance card. AI OCR extracts carrier, member ID, group number, subscriber name, coverage type, copay, deductible, and annual maximum. Patient can verify/edit extracted data. Option to skip.
- Medical History -- Toggle-based form for 10 medical conditions (heart disease, diabetes, high blood pressure, bleeding disorder, blood thinners, asthma, epilepsy, hepatitis, HIV, joint replacement). Free-text for medications and allergies. Pregnancy toggle. AI Alert appears when flagged conditions are detected -- notifies patient that information will be flagged for provider review.
- Consent & Signature -- Full informed consent text (8 sections covering examination, treatment, medications, risks, alternatives, photographs, treatment changes, financial responsibility). Agreement checkbox. Canvas-based digital signature pad (mouse and touch). Confetti animation on submission.
- Complete -- Animated checkmark. Summary of submitted information. "Time saved" badge showing estimated minutes saved vs. traditional intake. Option to view full submission summary. Start Over button (demo mode).
Office Dashboard
The practice-facing dashboard includes:
- Sidebar Navigation: Dashboard, Patients, Intake Sessions, Insurance, Forms, ROI, Settings
- Stats Cards: Completed today (with trends), average intake time, pending review count, verification rate
- Session Queue: Today's intake sessions table with patient name, appointment time, type (new/returning), intake status (pending/in progress/completed/reviewed), and insurance verification status. Mobile-responsive card layout.
- Patient Table: Searchable, sortable patient list with name, DOB, phone, email, last visit, insurance carrier, and status (active/inactive/new). Pagination.
- QR Code Generator: Generate unique QR codes for patients to scan at check-in. Optional label (e.g., "Front Desk", "Waiting Room"). Download as PNG, print, or copy link. Uses
qrcode.reactlibrary.
Key Features Summary
| Feature | Description |
|---|---|
| Smart Intake Forms | Conversational, mobile-first, adaptive forms |
| Insurance Card OCR | Photo capture with AI data extraction |
| Real-Time Verification | Insurance verified before patient arrives |
| AI Medical History | Drug interactions and clinical risks flagged automatically |
| Office Dashboard | Daily patient queue, intake status, verifications at a glance |
| PMS Auto-Sync | Bi-directional sync with Open Dental, Dentrix, and others |
| QR Code Check-In | Generate/print QR codes for walk-in intake |
| E-Signatures | Canvas-based digital consent signatures |
| Multi-Language Support | Planned for intake forms |
| HIPAA Compliance | Encryption, audit logs, access controls, session timeouts |
ROI Calculator
Built-in interactive ROI calculator on both the marketing site and the app:
- Inputs: New patients per week, staff hourly rate, current intake time, claim denial rate
- Outputs: Time saved (hours/year), labor savings, denial reduction (recovered revenue), IntakeIQ cost, net annual savings, monthly savings, payback period, ROI percentage
- Assumptions: IntakeIQ reduces intake time to 3.5 minutes, reduces denial rate to 3%, average claim value $285, $279/mo Professional plan
4. Ideal Customers and Market Segments
Total Addressable Market
| Metric | Value |
|---|---|
| Active Dentists (US) | 200,000+ |
| Dental Practices (US) | 120,000+ |
| Dental Software TAM | $15.6B |
| Still Using Paper Intake | 82% |
Ideal Customer Profile (ICP)
Primary: Independent Dental Practices and Small Groups (1-5 locations)
- Practice size: 1-10 providers
- 100-400 new patients per month
- Currently using paper intake or basic digital forms from their PMS
- Pain points: intake bottleneck, insurance verification delays, staff burnout, claim denials
- Decision makers: Practice owner/dentist, office manager
- Budget: $199-$279/month
- Buying triggers: new PMS implementation, staff turnover, insurance denial spike, patient experience complaints
Secondary: Emerging DSOs (Dental Service Organizations, 10-50 locations)
- Seeking standardization across locations
- Value efficiency metrics and ROI reporting
- Longer sales cycle but higher contract value
- Enterprise features: multi-location dashboard, multi-PMS sync, SSO/SAML, custom workflows, SLA
- Budget: $349+/month per location
Tertiary: Large DSOs (100+ locations)
- Volume pricing, custom integrations
- Require demonstrated ROI from pilot programs
Key Decision Maker Titles
- Practice Owner / Partner Dentist
- Office Manager / Practice Administrator
- Operations Director (DSOs)
- Chief Operating Officer (DSOs)
- IT Director (larger organizations)
Disqualification Signals
- Practice closing or in financial distress
- Already committed to competitor with long-term contract
- Fully satisfied with current paper workflow (no pain)
- No PMS / using extremely niche PMS with no integration path
5. Unique Differentiators and Competitive Advantages
The "Only" Statements
- Only AI-native dental intake platform. Not a generic form builder with dental templates -- built from the ground up with AI at the core (Claude API for medical history analysis, AWS Textract for OCR).
- Only platform that combines intake + OCR + eligibility + AI medical analysis in a single product. Competitors require 3-4 separate vendors.
- Only conversational intake experience for dental. Chat-style, one-question-at-a-time interface. Not a static form with 40 fields on one page.
- Only platform that provides AI-powered clinical flags before the patient reaches the chair. Flags drug interactions, conditions requiring precaution, and allergy alerts.
- Dental-native, not medical-adapted. Understands CDT codes, dental-specific insurance structures, frequency limitations, and dental clinical workflows.
Key Moat Components
- Data flywheel: More patients processed = better OCR accuracy, better flag detection, better insurance matching
- PMS integration depth: Bi-directional sync with Open Dental (open API), Dentrix, Eaglesoft
- Workflow lock-in: Once integrated into the practice's daily workflow, switching costs are high
- Clinical trust: AI flags build trust with providers over time as accuracy is validated
The Gap IntakeIQ Fills
Today, a practice using best-of-breed tools needs: Dentrix (PMS) + NexHealth (forms) + Vyne Dental (verification) + Weave (communications). Four vendors, four logins, four invoices, zero AI. IntakeIQ consolidates the intake-to-chair workflow into a single AI-native platform that integrates with the existing PMS.
6. Competitor Landscape
Market Map (4 Categories)
| Category | Players | IntakeIQ Relationship |
|---|---|---|
| Practice Management Systems (PMS) | Dentrix (35% share), Eaglesoft, Open Dental, tab32 | IntakeIQ integrates with these -- replaces their intake module, not the PMS |
| Patient Engagement | NexHealth ($100M+ raised), Weave (NYSE: WEAV, ~$1.2B), Solutionreach, RevenueWell | Compete on forms, but forms are a secondary feature for them |
| Insurance Verification | Vyne Dental, Dental Intelligence, clearinghouse-native tools | Point solutions with no intake link |
| Communications & VoIP | Weave, Podium, Birdeye | Bolt-on forms, not AI-powered |
Key Competitor Profiles
Dentrix / Dentrix Ascend (Henry Schein, NASDAQ: HSIC)
- $400-$700/mo + per-provider fees
- 35% PMS market share
- eClipboard: tablet-based, in-office only, no AI, no OCR, no SMS delivery
- IntakeIQ pitch: "We integrate with Dentrix. We replace eClipboard, not Dentrix."
NexHealth (Andreessen Horowitz backed, $100M+ raised)
- $350-$550/mo
- Modern UX, strong API, good PMS integrations
- Not AI-native. Template-based forms. No OCR, no eligibility, no medical history AI.
- IntakeIQ pitch: "NexHealth does 10 things okay. We do one thing -- intake -- better than anyone."
Yapi ($250-$400/mo)
- Dental-specific, paperless forms, in-office kiosk mode
- No AI, no OCR, no eligibility. Static templates only.
Weave (NYSE: WEAV, ~$1.2B market cap)
- $400-$750/mo
- Communications-first (VoIP, text, email). Forms are secondary.
- No AI intake, no OCR, no eligibility. Higher price.
Phreesia (acquired by TPG Capital, ~$2.3B)
- $500+/mo
- Deep medical intake expertise, enterprise-grade
- Built for medical, not dental. Expensive. Overkill for solo practices.
Open Dental ($179/mo)
- Open-source, most integration-friendly PMS
- eClipboard is basic, in-office only. Best integration target for IntakeIQ.
Feature Comparison Matrix (14 Features)
IntakeIQ has full support across all 14 intake-critical features. No competitor matches:
- Conversational/Adaptive Forms: Only IntakeIQ and partially Phreesia
- Insurance Card OCR: Only IntakeIQ and partially Phreesia
- AI Medical History Analysis: Only IntakeIQ
- Real-Time Eligibility: IntakeIQ + Phreesia (full), Dentrix (partial)
- Multi-Language: IntakeIQ + Phreesia (full), NexHealth (partial)
- Dental-Native Design: IntakeIQ + Dentrix + Yapi + Open Dental + tab32
Positioning Map
| Generic Healthcare | Dental-Specific | |
|---|---|---|
| AI-Native | Phreesia | IntakeIQ |
| Traditional | Weave, NexHealth | Dentrix, Yapi, Open Dental, tab32 |
IntakeIQ occupies the upper-right quadrant alone.
7. Current Stage, Funding Status, and Business Model
Current Stage
- Stage: Pre-revenue MVP / early product build
- Product Status: Functional prototype with working intake flow, dashboard, and API routes. Database schema implemented with Prisma + SQLite (dev). Demo mode with realistic seed data.
- What is built: Full patient intake flow (7 steps with animations), office dashboard prototype, API routes for patients/sessions/insurance/ROI, QR code generator, ROI calculator, HIPAA security middleware, PHI encryption library, audit logging framework, input sanitization, session timeout handling.
- What is NOT yet built: Authentication (TODO in middleware), production database persistence (API routes have TODO comments), actual AWS Textract OCR integration (using simulator), real insurance eligibility verification, PMS integrations, SMS/email delivery, Stripe billing, multi-language support.
Business Model: SaaS Subscription
| Plan | Monthly Price | Target |
|---|---|---|
| Starter | $199/mo | Solo practices, digital intake + SMS + e-signatures + basic analytics, up to 100 patients/mo |
| Professional (Most Popular) | $279/mo | Growing practices, everything in Starter + OCR + eligibility + AI medical analysis + PMS sync + unlimited patients |
| Enterprise | $349+/mo | Multi-location / DSOs, everything in Professional + multi-location + multi-PMS + dedicated success manager + custom API + SSO/SAML + SLA |
Founding Cohort
The database schema includes a founding_cohort plan tier, suggesting a special early-adopter pricing or access tier.
Add-On Revenue Streams (Planned)
Based on the pricing sheet structure:
- Premium integrations
- Custom workflows
- API access for enterprise
- Additional locations pricing
All plans include a 30-day free pilot. No credit card required.
8. Product Roadmap and What Is Being Built
Current State (MVP)
The application is built as a Next.js 16 web application with:
- Patient-facing conversational intake flow (fully functional UI)
- Practice-facing dashboard (demo data, not yet connected to live database)
- API routes (scaffolded with input validation, audit logging, but most using TODO placeholders for database persistence)
- HIPAA-compliant security middleware
- PHI encryption utilities
- Database schema (Prisma + SQLite for development)
- Static HTML deliverables for marketing/investor materials
Near-Term Roadmap (Inferred from TODOs and Architecture)
- Authentication System -- JWT/session-based auth with role-based access control (OWNER, ADMIN, DENTIST, HYGIENIST, FRONT_DESK). Currently commented out in middleware.
- Database Persistence -- Connect API routes to Prisma ORM for actual data storage. Migrate from SQLite to PostgreSQL for production.
- Real OCR Integration -- Replace simulated OCR with AWS Textract. Encrypt images with AES-256-GCM, upload to HIPAA-eligible S3, process, and delete.
- Insurance Eligibility Verification -- Integrate with Vyne Dental or similar clearinghouse API for real-time eligibility checks.
- PMS Integrations -- Open Dental API (first target, open API), then Dentrix and Eaglesoft.
- SMS/Email Delivery -- Twilio integration for sending intake links to patients before appointments.
- Stripe Billing -- Payment processing for subscription plans.
- Production Deployment -- AWS HIPAA-eligible infrastructure, KMS for key management, CloudWatch for audit logs.
Long-Term Features (Referenced in Marketing)
- Multi-language intake forms
- AI-powered clinical summaries
- Patient payment estimation
- Multi-location management and reporting
- Custom intake form builder
- Telehealth integration
- Advanced analytics and insights
9. Go-to-Market Strategy
Three-Phase Distribution Model
Phase 1: State Dental Associations (Months 1-6)
- Partner with state dental associations as an endorsed vendor
- Leverage newsletters, CE programs, annual meetings, vendor directories
- Target: 500+ practices through association channels
- These organizations are the most trusted voices for independent practices
Phase 2: DSO Expansion (Months 4-12)
- Sell into emerging DSOs (10-50 locations)
- Prove ROI with pilot programs, then expand
- Volume pricing and enterprise features drive this channel
- Target: large DSOs (100+ locations) after proving with smaller groups
Phase 3: ADA Endorsement & National Scale (Months 12-24)
- Pursue ADA Seal of Acceptance or formal endorsement
- SmileCon keynote positioning
- Requires demonstrated clinical workflow improvement data and HIPAA audit trail
- Unlocks access to full 200K+ dentist market
Target Conferences (12 High-Impact Events)
| Conference | When | Attendees | Booth Cost |
|---|---|---|---|
| SmileCon (ADA Annual) | Oct 2026 | 30,000+ | $15K-$50K |
| Plus 11 additional dental industry conferences selected for ICP alignment | |||
Sales Motion
- 30-day free pilot as the primary conversion mechanism
- Live demo (built into the product website)
- Interactive ROI calculator as lead qualification tool
- No credit card required for pilot
- Competitive battlecards prepared for Dentrix, NexHealth, Yapi, Weave, Phreesia, Open Dental
Sales Playbook (Built)
A full sales playbook document exists covering:
- 4 ICP segments with detailed profiles
- "Always Say / Never Say" messaging rules
- Discovery questions and demo scripts
- Competitive battlecards per competitor
- Objection handling
- Pilot-to-close conversion framework
- LinkedIn outreach scripts
10. Key Messaging, Language, Tone, and Communication Style
Core Messages
- "Dental intake, reimagined."
- "AI-powered intake automation that gets patients chair-ready in minutes -- not hours."
- "Zero clipboard. Zero re-entry. Zero hassle."
- "Intelligent Intake. Effortless Care." (tagline)
Always Say
- "IntakeIQ" or "the IntakeIQ platform" (never just "intake tool")
- "AI-powered" (always hyphenated when adjective)
- "Chair-ready" (key value prop)
- "30-day free pilot" (primary CTA)
- "We integrate with [PMS name]" (not replace)
- "HIPAA-compliant"
Never Say
- "Dental form software"
- "Just an intake tool"
- "We replace your PMS"
- "Intake IQ" or "intakeiq" (wrong casing)
Tone
- Professional but warm. Clinical credibility without being cold.
- Confident, not aggressive. Know the value, don't oversell.
- Empathetic to practice pain. Understand the daily grind of front desk staff.
- Specific. Use numbers (3.2 min avg intake, 94% verification rate, ~18 min saved per patient).
Key Proof Points (Demo Data)
- Average intake time with IntakeIQ: 3.2 minutes
- Average intake time without: 15-18 minutes
- Insurance verification rate: 94%
- Practices using IntakeIQ + Dentrix report 70% reduction in intake time
- 30% no-show reduction (calculated in ROI model)
11. Financials, Metrics, and Traction Data
Revenue Model
| Plan | Monthly | Annual |
|---|---|---|
| Starter | $199 | $2,388 |
| Professional | $279 | $3,348 |
| Enterprise | $349+ | $4,188+ |
ROI Model for Typical Practice
(15 new patients/week, $22/hr staff, 18 min current intake, 10% denial rate)
Based on the built-in ROI calculator:
- Time saved: hundreds of hours/year
- Labor savings: thousands/year
- Denial reduction: significant recovered revenue
- Payback period: weeks, not months
- ROI: multiple hundred percent
Traction
- Pre-revenue. No disclosed customer count, ARR, or pilot metrics at this stage.
- Product is in MVP/prototype phase with functional demo.
12. Team, Founders, and Key Stakeholders
Founder
Peter Ferrante is building IntakeIQ alongside Perri Corsello. Also simultaneously building:
- FusionAIrre (AI assurance platform)
- Mediterranean's Edge (e-commerce brand)
- Measurement Maven (data analytics consultancy)
- A.X.I.S. (autonomous execution intelligence system)
Working from macOS using Claude Code CLI as primary development tool. Non-developer background -- relies on AI-assisted development.
No additional team members disclosed.
13. Investor/Client/Stakeholder-Facing Materials
All deliverables are standalone HTML files with inline CSS, responsive design, print stylesheets, and the IntakeIQ brand palette. Located in /Users/peterferrante/Documents/AXIS/projects/dental-intake/docs/:
| Document | File | Purpose |
|---|---|---|
| Executive Summary | executive-summary.html | One-page investor overview, print-ready |
| Business Plan | business-plan.html | Full business plan with market data, financials, timeline |
| Investor Pitch Deck | pitch-deck.html | 11+ slide interactive presentation |
| Go-to-Market Guide | go-to-market-guide.html | Conference targets, sales phases, channel strategy |
| Competitive Analysis | competitive-analysis.html | Market map, 7 competitor profiles, feature matrix, battlecards |
| Product Overview | product-overview.html | Feature details, patient journey, integrations, ROI |
| Pricing Sheet | pricing-sheet.html | 3-tier pricing, add-ons, ROI data, FAQ |
| Sales Playbook | sales-playbook.html | ICPs, sequences, objections, discovery, demo, LinkedIn scripts |
| Compliance Guide | compliance-guide.html | HIPAA technical safeguards, data flow, audit, BAA info |
Additional Marketing Assets (In-App)
| Asset | Location | Purpose |
|---|---|---|
| Landing Page | app/landing-page.html | Static marketing landing page |
| Office Dashboard Demo | app/web-app.html | Interactive dashboard prototype |
| Patient Intake Demo | app/demo-intake.html | Mobile-frame intake flow demo |
14. Partnerships, Customers, and Pilots
No disclosed partnerships, customers, or active pilots at this stage.
Target Integration Partners
| Partner | Type | Priority |
|---|---|---|
| Open Dental | PMS (open API) | First target |
| Dentrix / Dentrix Ascend | PMS | High priority |
| Eaglesoft | PMS | Medium priority |
| Vyne Dental | Insurance verification | High priority |
| Stripe | Payment processing | Required for launch |
| Twilio | SMS delivery | Required for launch |
| AWS (HIPAA-eligible) | Infrastructure | Required for launch |
| Anthropic (Claude API) | AI | Core dependency |
15. Technical Architecture, Systems, and Infrastructure
Technology Stack
| Layer | Technology |
|---|---|
| Framework | Next.js 16+ (App Router) |
| Language | TypeScript |
| UI | React 19, Tailwind CSS 3.4, Framer Motion 12 |
| Database (Dev) | SQLite via better-sqlite3 + Prisma adapter |
| Database (Prod) | PostgreSQL (planned) |
| ORM | Prisma 7.6 with generated client |
| Validation | Zod 4 |
| Auth | NextAuth (planned, not yet implemented) |
| Password Hashing | bcryptjs |
| QR Codes | qrcode.react |
| Data Fetching | SWR |
| Unique IDs | uuid |
| AI | Claude API (Anthropic) -- planned |
| OCR | AWS Textract -- planned (currently simulated) |
| SMS | Twilio -- planned |
| Payments | Stripe -- planned |
| Infrastructure | AWS HIPAA-eligible -- planned |
Database Schema (6 Models + Audit Log)
Practice -- Multi-tenant root entity. Fields: name, phone, email, address (JSON), timezone, logo, plan (founding_cohort/starter/professional/enterprise), settings (JSON).
User -- Practice staff. Fields: email (unique), passwordHash, firstName, lastName, role (OWNER/ADMIN/DENTIST/HYGIENIST/FRONT_DESK), avatarUrl, isActive, lastLoginAt. Cascading delete from practice.
Patient -- PHI fields encrypted at application layer (firstName, lastName, email, phone, dateOfBirth). Additional: gender, address (JSON encrypted), emergencyContact (JSON encrypted).
Form -- Customizable intake forms. Fields definition stored as JSON array of FormField objects (type: text/email/phone/date/select/textarea/toggle/signature).
IntakeSession -- Core workflow entity. Links practice, patient, and form. Tracks status (PENDING/IN_PROGRESS/COMPLETED/REVIEWED/EXPIRED), currentStep, responses (JSON blob), flags (JSON array), appointmentDate, timestamps, reviewer.
InsuranceVerification -- One-to-one with IntakeSession. Tracks carrier, memberId (encrypted), groupNumber (encrypted), subscriberName (encrypted), coverageType, copay, deductible, annualMax, card image URLs, verification status.
AuditLog -- Append-only HIPAA compliance table. Fields: timestamp, action, resourceType, resourceId, userId, userRole, practiceId, ipAddress, userAgent, success, details (JSON). Indexed on practiceId, userId, action, timestamp. Must be retained for 7 years minimum.
Database Indexes
Optimized for common query patterns:
users.email-- unique indexusers.practiceId,patients.practiceId,forms.practiceId,intake_sessions.practiceId-- multi-tenant scopingintake_sessions.patientId,intake_sessions.status-- session lookupsinsurance_verifications.sessionId-- unique 1:1 relationshipaudit_logs.practiceId,audit_logs.userId,audit_logs.action,audit_logs.timestamp-- compliance queries
API Routes
| Endpoint | Method | Purpose | Auth Required |
|---|---|---|---|
/api/intake-sessions | POST | Create new intake session (QR code / manual) | No (patient-facing) |
/api/intake-sessions | GET | List sessions for practice | Yes (TODO) |
/api/patients | POST | Create patient from intake submission | No (patient-facing) |
/api/patients | GET | List patients for practice | Yes (TODO) |
/api/insurance/ocr | POST | Process insurance card image | No (patient-facing) |
/api/roi | POST | Calculate ROI (no PHI) | No (public) |
HIPAA Technical Safeguards
Encryption
- At Rest: AES-256-GCM encryption for all PHI fields. Uses Node.js native
cryptomodule. - Key Management: Base64-encoded 32-byte key via
PHI_ENCRYPTION_KEYenvironment variable. Production target: AWS KMS. - Encrypted Fields: Patient: firstName, lastName, email, phone, dateOfBirth, SSN. Insurance: memberId, groupNumber, subscriberName.
- Format: Base64-encoded packed buffer: IV (12 bytes) + AuthTag (16 bytes) + Ciphertext.
- In Transit: TLS 1.3 enforced via HSTS header (1 year, includeSubDomains, preload).
Security Middleware
Applied to all routes via Next.js middleware:
- Strict-Transport-Security (HSTS)
- X-Content-Type-Options: nosniff
- X-Frame-Options: DENY (SAMEORIGIN for /demo routes)
- X-XSS-Protection: 1; mode=block
- Referrer-Policy: strict-origin-when-cross-origin
- Permissions-Policy: camera=(self), microphone=(), geolocation=(), payment=()
- Content-Security-Policy with restrictive directives
- Cache-Control: no-store for /app, /intake, /api routes (never cache PHI)
- X-Session-Timeout: 900 (15 minutes for /app routes)
Audit Logging
- Comprehensive audit actions covering: PHI access (view/create/update/delete patient), intake sessions (start/submit/review), insurance operations, authentication events, data operations (export/print/download), consent events, admin operations, and system events (key rotation, backup, breach detection).
- Structured JSON log format (
_type: "HIPAA_AUDIT_LOG") for ingestion by CloudWatch, Datadog, etc. - Currently logging to console; production target: persistent append-only store.
- Includes IP address, user agent, user ID, role, practice ID, and success/failure for every event.
Session Timeout
- Client-side session timeout hook (
useSessionTimeout) with 15-minute default per HIPAA. - Throttled activity detection (30-second debounce) on mousedown, mousemove, keypress, scroll, touchstart, click.
- Warning callback 2 minutes before timeout.
Input Sanitization
- HTML tag stripping and dangerous character removal for all text inputs.
- Email validation and normalization.
- Phone number sanitization (digits only, US format).
- Date of birth validation (not future, not before 1900).
- Recursive object sanitization for nested data.
- Required field validation.
Additional HIPAA Measures
- Insurance card images: validated file type (JPEG/PNG/WebP/HEIC) and size (max 10MB). Production: encrypt, upload to HIPAA-eligible S3, process, delete immediately.
- PHI-safe error messages -- never expose internal details in API responses.
- Role-based access control planned (OWNER, ADMIN, DENTIST, HYGIENIST, FRONT_DESK roles defined).
- BAAs required with all subprocessors.
- SOC 2 Type II target.
Project Structure
dental-intake/
CLAUDE.md # Project rules and brand config
docs/ # All business deliverables (HTML)
app/ # Next.js application
package.json
.env.example
prisma/
schema.prisma # Database schema (6 models + audit log)
seed.ts # Demo data seeder
migrations/ # SQLite migration SQL
src/
middleware.ts # HIPAA security headers + auth gate
types/index.ts # Core TypeScript types and enums
generated/prisma/ # Prisma generated client
lib/
db.ts # Prisma client singleton
encryption.ts # AES-256-GCM PHI encryption
audit-log.ts # HIPAA audit logging
sanitize.ts # Input sanitization and validation
session-timeout.ts # Client-side HIPAA session timeout
ocr-simulator.ts # Mock OCR (dev only)
demo-data.ts # Comprehensive demo dataset
hooks/
useIntakeFlow.ts # Intake step state machine (useReducer)
useDemoMode.ts # Demo mode detection and data
app/
layout.tsx # Root layout (Geist fonts)
api/
intake-sessions/route.ts # Create/list intake sessions
patients/route.ts # Create/list patients (with encryption)
insurance/ocr/route.ts # Insurance card OCR processing
roi/route.ts # ROI calculator (public endpoint)
components/
intake/
IntakeFlow.tsx # Main intake orchestrator
ConversationalStep.tsx # Chat-style form UI
InsuranceCardCapture.tsx # Insurance card upload + OCR
MedicalHistoryForm.tsx # Medical history toggles + AI alert
ConsentStep.tsx # Consent text + signature canvas
IntakeComplete.tsx # Completion screen + summary
PrivacyNotice.tsx # HIPAA privacy disclosure
dashboard/
AppSidebar.tsx # Dashboard navigation sidebar
StatsCards.tsx # KPI stat cards
SessionQueue.tsx # Today's intake session queue
PatientTable.tsx # Patient list with search
QRCodeGenerator.tsx # QR code generation + download + print
marketing/
Hero.tsx # Landing page hero section
FeatureGrid.tsx # Feature showcase grid
PricingTable.tsx # 3-tier pricing display
DemoEmbed.tsx # Interactive demo iframe embed
CTASection.tsx # Call-to-action section
roi/
ROICalculator.tsx # Interactive ROI calculator
Environment Variables
DATABASE_URL # PostgreSQL connection (production)
PHI_ENCRYPTION_KEY # 32-byte base64 AES-256 key
NEXTAUTH_SECRET # Auth session secret
NEXTAUTH_URL # Auth callback URL
ANTHROPIC_API_KEY # Claude AI
AWS_ACCESS_KEY_ID # AWS services
AWS_SECRET_ACCESS_KEY
AWS_REGION # us-east-1
AWS_KMS_KEY_ID # Encryption key management
AWS_S3_BUCKET # Insurance card images
STRIPE_SECRET_KEY # Billing
STRIPE_WEBHOOK_SECRET
TWILIO_ACCOUNT_SID # SMS
TWILIO_AUTH_TOKEN
TWILIO_PHONE_NUMBER
APP_URL
NODE_ENV
SESSION_TIMEOUT_MINUTES # Default: 15
AUDIT_LOG_DESTINATION # console | cloudwatch | database
Seed Data
The database seeder creates a realistic demo environment:
- 1 practice: "Bright Smile Dental" (San Francisco, founding_cohort plan)
- 4 users: Dr. Sarah Chen (OWNER), Marcus Williams (ADMIN), Jessica Rivera (FRONT_DESK), James Park (DENTIST)
- 8 patients with full demographic data
- 8 intake sessions in various states (completed, in-progress, pending)
- 3 insurance verifications (verified, verified, pending)
- 3 audit log entries
- Login credentials:
sarah.chen@brightsmile.com/intakeiq2026
16. Goals, OKRs, and Success Metrics
Product Metrics (Target)
| Metric | Target |
|---|---|
| Average intake completion time | < 5 minutes |
| Insurance OCR accuracy | > 95% |
| Insurance eligibility auto-verification rate | > 90% |
| Patient intake completion rate | > 85% |
| Clinical flag detection accuracy | > 98% |
| System uptime | 99.9% |
Business Metrics (Target)
| Metric | Target |
|---|---|
| Pilot-to-paid conversion | > 60% |
| Monthly churn rate | < 3% |
| Net Revenue Retention | > 120% |
| Time to first value (pilot) | < 7 days |
Launch Milestones (Inferred)
- Complete authentication system
- Connect API routes to database
- Integrate real OCR (AWS Textract)
- First PMS integration (Open Dental)
- Deploy to HIPAA-eligible AWS infrastructure
- Launch 30-day free pilot program
- First 10 paying customers
- State dental association partnership
- SOC 2 Type II certification
17. Risks, Challenges, and Open Questions
Technical Risks
- Authentication not implemented. The middleware has auth checks commented out with TODO markers. This is the most critical gap before any real-world use.
- API routes not persisting to database. Most POST/GET handlers have TODO comments where database calls should be. The data layer is scaffolded but not connected.
- OCR is simulated. The insurance card OCR returns random presets. AWS Textract integration is planned but not built.
- Single developer. Peter is building multiple companies simultaneously. Velocity and bus factor are concerns.
- SQLite in development, PostgreSQL in production. Migration path exists via Prisma but needs testing.
Business Risks
- Pre-revenue with no customers. No validation of product-market fit beyond demo and business planning.
- Crowded market. Well-funded competitors (NexHealth $100M+, Weave $1.2B market cap, Phreesia $2.3B acquisition). Differentiation is clear but must be defended.
- PMS integration complexity. Dentrix and Eaglesoft have proprietary APIs that require partnerships or reverse engineering. Open Dental is the only truly open option.
- HIPAA compliance cost. Full compliance requires BAAs, SOC 2 audit, HIPAA-eligible infrastructure, and ongoing monitoring. Significant upfront cost for a bootstrapped startup.
- Sales cycle for DSOs. Enterprise sales require dedicated sales team, longer cycles, and proof-of-concept deployments.
Open Questions
- What is the funding strategy? Bootstrapped, angel, seed, or venture?
- When is the target launch date for the pilot program?
- Is there a landing page or waitlist collecting leads?
- What is the pricing validation -- have potential customers been shown the $199-$349 range?
- Who is handling HIPAA compliance review and BAA generation?
- What is the AI model being used for medical history analysis -- Claude, fine-tuned model, or rule-based?
- Is there a mobile app planned or is the product web-only?
- What is the data retention and deletion policy for PHI?
18. Additional Material
Document Standards
All HTML deliverables follow these rules:
- Standalone HTML files with all CSS inline (no external dependencies)
- CSS custom properties for theming
- Print stylesheets with
@pagesizing for letter format - Responsive design (mobile-first)
- System font stack
- IntakeIQ brand palette applied consistently
Demo Mode Architecture
The application supports a useDemoMode hook that detects /demo/* routes and provides pre-populated demo data (8 patients, 6 sessions, 3 verifications, 1 form schema) without requiring database access. This allows the entire application to function as a self-contained demo.
Intake Flow State Machine
The intake flow uses a useReducer-based state machine with 7 actions:
NEXT_STEP/PREV_STEP-- linear step progression through the 7 intake stepsSET_RESPONSE/SET_RESPONSES-- accumulate form responsesSET_INSURANCE_DATA-- store OCR/manual insurance dataSET_SIGNATURE-- store e-signature data URLSET_CONSENT-- track consent acceptanceRESET-- return to initial state (demo restart)
State tracks: currentStep, responses (Record), insuranceData, signature, isComplete, startTime, consentAccepted. Progress percentage is derived from step index.
CLAUDE.md Configuration
The project root CLAUDE.md serves as the authoritative brand and technical configuration:
- Brand name, tagline, palette, naming rules
- Document standards (HTML, CSS variables, responsive, print)
- Tech stack declarations
- HIPAA requirements (encryption standards, BAAs, audit logging, RBAC, SOC 2 target)
Powered by A.X.I.S. Pre-Alpha — I still have my training wheels on, so tell me how I'm doing