Front-desk AI for clinics that can't leak patient data
Challenge: A single-doctor clinic wants quick answers to operational, population-level questions about its patient records — "are we seeing a lot of similar cases lately?", "who hasn't been in for a year?" — without anyone learning to write database queries. But wiring an LLM straight to patient data is exactly the risk a clinic can't take: a cleverly worded prompt could make the model dump every record or run a destructive query. For privacy-sensitive data, "it usually behaves" is not good enough.
Solution: A front-desk assistant that surfaces patterns across patient records in plain language — while being structurally incapable of leaking data or running its own SQL. The agent never touches the database. Between it and the data sits a governed tool layer (the MCP Toolbox for Databases pattern): a fixed set of pre-written, parameterized queries that are the only actions the agent can take.
Groups recent presenting complaints into clusters of similar symptoms — an early-outbreak signal that surfaces a grouping nobody explicitly searched for.
Shows whether a condition (e.g. suspected dengue) is becoming more common across recent months, returning the monthly shape for the agent to explain.
Segments the whole patient base by visit frequency and average spend — High-frequency, Regular, Occasional groups — at summary level only.
Lists patients not seen in over a year — a recall list returning name and last-visit date only, never clinical notes.
Flags patients visiting unusually often, and the top presenting complaints in a given month to catch any unusual spike.
No-show rate by weekday and busiest-day analysis — operational patterns for staffing and scheduling decisions.
Gemini Flash reasons about which approved tool to call and explains the result in plain language. Its intelligence goes into understanding the question — never into writing SQL.
Four governance layers: the toolset is the agent's entire universe (no execute_sql), the SQL is fixed with only values bound, toolset scoping controls access, and the database user is read-only.
Vector embeddings on case notes power "find cases that resemble this one" and symptom clustering — meaning-based matching, not just keywords.
The live conversational layer uses your own free Gemini key, held in your browser only. Nothing is hard-coded or committed; the data layer and guardrails cost nothing to run.
tools.yamlWHERE, change a LIMIT, or inject a UNIONmode=ro; writes are physically impossible even if every layer above were bypassedThe interactive demo loads the real synthetic SQLite database in the browser via sql.js and runs the same fixed, parameterized queries client-side. No server, no key, nothing to install — it works on free static hosting.
tools.yaml deploys to the official MCP Toolbox for Databases binary on Cloud Run for a real enterprise database (Cloud SQL / AlloyDB)