Healthcare SaaS Developer — HIPAA Compliance Review & Code Cleanup (Lovable-Built App)

I am a licensed therapist building a web app that helps therapists and clients be more connected with homework throughout the week. The app was built using Lovable (an AI app builder) and I need an experienced healthcare developer to review what was built, clean it up, fix any security gaps, and confirm it meets HIPAA technical requirements. This is a startup-stage project. I am the sole founder. I need someone who can communicate clearly with a non-technical person and explain what they find and why it matters. What I Need You To Do: Review all code generated by Lovable and identify security vulnerabilities Confirm or fix data encryption at rest and in transit Review every third-party service or vendor the app connects to and flag any that would require a Business Associate Agreement (BAA) Confirm that client-entered content (homework reflections) cannot be accessed by any unauthorized party Ensure the therapist and client login system is secure and roles are properly separated Confirm that the permanent crisis support button on all client-facing screens cannot be removed, bypassed, or overridden Provide a short written summary of what you found, what you fixed, and what still needs attention What This App Does NOT Do: No billing or insurance No video or scheduling No AI responding to client content No users under 18 What I'm Looking For in You: Demonstrated experience building or auditing HIPAA-compliant SaaS applications Familiarity with BAA requirements and which vendors (cloud hosts, email services, AI APIs) typically require them Experience with web apps built on modern frameworks (React, Next.js, or similar) Ability to explain technical findings in plain English Bonus: experience with mental health, therapy, or healthcare technology specifically To Apply, Please Answer These Three Questions: 1. Describe a HIPAA-compliant project you have worked on. What was the app, what did you build or audit, and what vendors required BAAs? 2. What is your process for reviewing code built by an AI tool like Lovable or Bolt? 3. What is one common HIPAA technical safeguard that early-stage health app developers frequently miss? Applications that do not answer all three questions will not be considered. This app handles real therapy client data. I take privacy and safety seriously and I am looking for someone who does too, not just someone who can write compliant-sounding documentation. Please only apply if you have genuine healthcare tech experience.