← All entries

Dev Log

Build notes from the Jefe ecosystem

JefeHealth: A Privacy-First Therapy Assistant, Built in One Session

The Therapist's Architect March 28, 2026

New project from zero: JefeHealth is a privacy-first therapy and wellness personal assistant. It pairs local LLM inference with evidence-based therapeutic frameworks, a curated document corpus, encrypted storage, and a deterministic safety scanner that runs before the model ever sees a message. About 11,000 lines of code and content shipped in the first session — backend, web UI, RAG pipeline, therapy corpus, and encryption layer.

Why Build This

Mental health tools shouldn't require sending your deepest thoughts to someone else's server. JefeHealth keeps everything local: conversations are encrypted at rest with SQLCipher, LLM inference runs on a local Ollama instance, and the RAG corpus lives in a local ChromaDB collection. No cloud APIs, no telemetry, no data leaving the network. The target audience is people who want structured therapeutic techniques (journaling prompts, cognitive reframing, distress tolerance skills) without the barrier of finding a therapist for every rough Tuesday — while always making it clear this is an AI tool, not a replacement for licensed care.

Four Therapeutic Frameworks

Each therapy session selects a framework that shapes the AI's approach. CBT (Cognitive Behavioral Therapy) focuses on identifying distorted thought patterns and testing them against evidence. DBT (Dialectical Behavior Therapy) emphasizes distress tolerance, emotional regulation, and mindfulness — particularly useful during acute episodes. ACT (Acceptance and Commitment Therapy) works on psychological flexibility and values-driven action. A general supportive mode handles everything else: venting, journaling, or just needing someone to listen. Each framework has its own system prompt, response patterns, and suggested exercises drawn from the RAG corpus.

The Safety Scanner

Before any message reaches the LLM, a deterministic keyword scanner checks for crisis indicators — suicidal ideation, self-harm language, immediate danger signals. This is not delegated to the model. It's a hardcoded pattern matcher that cannot be prompt-injected, hallucinated past, or fine-tuned away. When triggered, the response includes crisis hotline numbers and clear guidance to contact emergency services. Every AI response also carries a disclaimer that this is not a licensed therapist.

RAG-Powered Therapy Corpus

A curated collection of 44 therapy documents — CBT worksheets, DBT skills handouts, ACT exercises, neurodiversity-affirming autism resources, and childhood trauma recovery materials — is indexed into ChromaDB with sentence-transformer embeddings. When a user describes what they're working through, the retrieval layer pulls relevant techniques and exercises into the LLM context. This grounds responses in established therapeutic literature rather than letting the model improvise clinical advice.

Privacy Architecture

The database is SQLCipher-encrypted (the app refuses to start without an encryption key). Session tokens are hashed before storage. Message content never appears in logs — only record IDs. A dual-key escrow system allows admin recovery of user data in emergencies (locked account, lost credentials), but every recovery action is audit-logged with timestamps and justification. The goal is "private by default, recoverable when necessary, auditable always."

Neurodiversity and Trauma Focus

The corpus includes neurodiversity-affirming resources specifically for autism — not the compliance-focused variety, but materials that treat autistic traits as differences to understand rather than deficits to correct. The childhood trauma recovery section covers complex PTSD, attachment repair, and somatic awareness. These aren't afterthoughts bolted onto a generic chatbot; they're first-class therapeutic tracks with dedicated documents and retrieval context.

What Shipped

ComponentDetails
BackendFastAPI with 13 API endpoints, auth, session management, streaming chat
Web UICalm, therapy-appropriate design — no flashy branding, just a safe space
FrameworksCBT, DBT, ACT, and general supportive mode
RAG corpus44 curated therapy documents indexed in ChromaDB
SafetyDeterministic crisis scanner, AI disclaimers on every response
EncryptionSQLCipher DB, hashed tokens, envelope encryption for messages
Mood trackingMood logging with history, trends, and session correlation
Total code~11,000 lines (Python + HTML/CSS/JS + therapy content)

What's Next

  • Deploy to the GPU server for end-to-end testing with the full-size model
  • End-to-end integration tests covering the full chat pipeline
  • Voice integration — spoken input for sessions where typing feels like too much
  • Session summaries and theme extraction across multiple conversations
  • Multi-user access with privacy boundaries between household members