Know what's in your products. Not just what's on the label.
A privacy-first product safety app that combines health profiles, barcode and OCR scanning, and personalized verdicts in one mobile workflow.
Achaia is a privacy-first mobile app that helps you understand what's really in the products you use every day. Scan a barcode, snap a photo of the ingredients, or type them in manually — Achaia cross-references everything against your personal medical profile to tell you whether a product is safe, questionable, or should be avoided entirely.
|
 |
| Scan by barcode or OCR | Get a plain-language safety explanation |
Ingredient lists are long, confusing, and full of scientific names. If you have allergies, chronic conditions, or take medications, a single wrong purchase can have serious consequences. Most people rely on guesswork.
Achaia combines medical knowledge, AI-powered analysis, and real-world product data to give you a clear, personalized safety verdict — in seconds.
 |
|
|
| 1. Build your profile | 2. Scan the product | 3. Review the risk breakdown |
- Build Your Profile — Tell us about your allergies, chronic conditions, and medications. Everything stays encrypted on your device.
- Scan a Product — Use your camera to scan a barcode or take a photo of the ingredient list. You can also type ingredients manually.
- Get Your Verdict — Instantly see a color-coded safety report, with clear explanations of what to avoid and why.
| Feature | Description |
|---|---|
| 📷 Barcode & OCR Scanning | Scan product barcodes (via OpenFoodFacts) or photograph ingredient lists with OCR. |
| ✍️ Manual Entry | Type or paste ingredients when scanning isn't an option. |
| 🧠 AI-Powered Explanations | GPT-powered, human-readable explanations of why a product may be unsafe for you. |
| 🎨 Color-Coded Reports | Green (safe), Yellow (caution), Red (avoid) — with cited medical sources. |
| 👨⚕️ Clinician Review | Flag complex results for review by healthcare professionals. |
| 📄 PDF Export | Generate shareable reports for your doctor or pharmacist. |
| 🔒 Local-First Encryption | Your medical data stays on your device. AES-256 encrypted. Zero-knowledge architecture. |
| 👪 Family Profiles | Manage safety profiles for up to 5 family members (Premium). |
| 🌍 Nigeria-First | Seeded with Nigerian products, NDPR compliant, with planned Yoruba/Igbo/Hausa support. |
| 🏥 Enterprise Ready | White-label options, API access, custom safety rules, and SLA-backed support. |
Achaia is built as a set of containerized microservices behind a FastAPI gateway, with a React Native mobile client.
| Layer | Technology |
|---|---|
| Mobile | React Native (Expo ~54), TypeScript, NativeWind (Tailwind), Zustand |
| API | FastAPI (Python 3.11+), Pydantic, SQLAlchemy, Alembic |
| AI | OpenAI GPT, HuggingFace FLAN-T5, Redis caching |
| Database | PostgreSQL 15+ (encrypted at rest via AES-256-GCM) |
| Cache | Redis 7+ |
| OCR | Google Cloud Vision + Tesseract fallback |
| Auth | Firebase Auth, JWT tokens, RBAC |
| Storage | AWS S3 / GCS (encrypted) |
| Monitoring | Prometheus, Grafana, Sentry, OpenTelemetry, Loki |
| CI/CD | GitHub Actions (multi-workflow: backend, client, AI, dev & prod) |
| Infra | Docker, Docker Compose, Terraform (AWS/GCP) |
App/Achaia/
├── backend/ # FastAPI backend (port 8000)
│ ├── app/
│ │ ├── api/v1/ # REST endpoints (auth, scan, products, admin, subscription)
│ │ ├── core/ # Config, security, database, encryption, RBAC
│ │ ├── services/ # Rule engine, OCR, AI client, PDF export, ingredient normalizer
│ │ ├── models/ # SQLAlchemy models
│ │ └── schemas/ # Pydantic schemas
│ ├── alembic/ # Database migrations
│ ├── tests/ # Backend test suite
│ └── data/ # Safety rules, allergen database, Nigerian product seed
│
├── AI/ # AI microservice (port 8001)
│ ├── app/
│ │ ├── api/v1/ # Explanation & product endpoints
│ │ └── services/ # LLM classifiers, explanation generator, agent tools
│ └── tests/ # AI service test suite
│
├── client/ # React Native mobile app (Expo)
│ ├── src/
│ │ ├── screens/ # Auth, Profile, Scanner, Results, Settings
│ │ ├── components/ # Reusable UI components
│ │ ├── navigation/ # React Navigation setup
│ │ ├── services/ # API client, local storage
│ │ └── store/ # Zustand state management
│ └── app.json
│
├── .github/workflows/ # CI/CD pipelines for backend, client, AI (dev & prod)
├── Makefile # Convenience commands for Docker, tests, DB operations
└── LICENSE # GPL v3
- Node.js 18+ & npm
- Python 3.11+
- PostgreSQL 15+
- Redis 7+
- Docker & Docker Compose
- Google Cloud Vision API key (for OCR)
- Firebase project (for auth)
- OpenAI API key (for AI explanations)
git clone https://github.com/Zoro-chi/Achaia.git
cd App/Achaia
# First-time setup
make setup
# Start all services
make up
# Check health
make healthServices available at:
- Backend API: http://localhost:8000
- API Docs: http://localhost:8000/api/docs
- AI Service: http://localhost:8001
- Prometheus: http://localhost:9090
- Grafana: http://localhost:3000
# Backend
cd backend
python -m venv venv && source venv/bin/activate
pip install -r requirements.txt
cp .env.example .env # Edit with your config
python scripts/setup_security.py # Generate encryption keys
alembic upgrade head
uvicorn app.main:app --reload --port 8000
# AI Service (separate terminal)
cd AI
python -m venv venv && source venv/bin/activate
pip install -r requirements.txt
cp .env.example .env # Add your OpenAI/HuggingFace keys
uvicorn app.main:app --reload --port 8001
# Mobile App (separate terminal)
cd client
npm install
npx expo startKey variables for backend/.env:
DATABASE_URL=postgresql://user:password@localhost:5432/achaia
REDIS_URL=redis://localhost:6379
SECRET_KEY=<generated-by-setup-script>
ENCRYPTION_KEY=<generated-by-setup-script>
GOOGLE_CLOUD_VISION_API_KEY=your-api-key
OPENFOODFACTS_USER_AGENT=Achaia/1.0
FIREBASE_CONFIG=firebase-config.json
AI_SERVICE_URL=http://localhost:8001
AI_SERVICE_API_KEY=your-shared-secretAchaia is built from the ground up with data privacy as a core principle, not an afterthought.
- Local-First Storage — Medical profiles stay on-device by default (via SQLCipher / Realm)
- Zero-Knowledge Architecture — The server cannot decrypt your medical data
- AES-256-GCM Encryption — All sensitive data encrypted at rest and in transit
- Minimal Data Transmission — Only scan results sent to server, not full profiles
| Regulation | Region | Status |
|---|---|---|
| NDPR | Nigeria | ✅ |
| HIPAA | USA | ✅ |
| GDPR | EU | ✅ |
- TLS 1.3 for all communications (HSTS enforced)
- JWT authentication with refresh token rotation
- PIN / Biometric app lock
- Bcrypt password hashing
- Role-based access control (User, Clinician, Admin)
- Comprehensive audit logging
- Prepared SQL statements (injection prevention)
- Security headers (CSP, XSS protection, clickjacking prevention)
- Regular ZAP security scanning in CI/CD
Achaia's AI microservice provides intelligent, context-aware product safety analysis:
- Personalized Explanations — Tailors safety explanations based on your specific allergies, conditions, and medications
- Multi-Provider Support — Primary: OpenAI GPT, Fallback: HuggingFace FLAN-T5
- Smart Caching — Redis-based caching reduces API costs by up to 70%
- Agent-Based Classification — LLM agents can classify products and ingredients autonomously
- Nigerian Product Knowledge — Fine-tuned awareness of local products and ingredients
The result screen is designed to show three layers at once: the verdict, the exact ingredient-level warning, and a human-readable explanation of what the risk means for that profile.
|
 |
|
| Clear verdict and risk score | Ingredient-level warning details | Plain-language AI explanation |
- Prometheus — Custom metrics for HTTP requests, scan latency, DB queries
- Grafana — Pre-built dashboards for service health
- Sentry — Real-time error tracking and performance monitoring
- OpenTelemetry — Distributed tracing across services
- Loki — Centralized log aggregation
Automated pipelines via GitHub Actions:
| Workflow | Trigger | What It Does |
|---|---|---|
backend-dev.yml / -prod.yml |
Push / Tag | Lint → Test → Build → Deploy backend |
client-dev.yml / -prod.yml |
Push / Tag | Lint → Test → Build Expo → Deploy client |
ai-dev.yml / -prod.yml |
Push / Tag | Lint → Test → Build → Deploy AI service |
zap-scan.yml |
Schedule | Weekly OWASP ZAP security scan of the API |
This is currently a solo-developer MVP project. Contributions will be opened after the initial pilot launch.
Achaia is open source under the GNU General Public License v3.0.
Built for safer, healthier product choices.