Senior Software Engineer

The system

iCanHeal is a patient-facing healthcare platform — appointments, records, clinician messaging, and the billing that sits behind all of it. I own the backend: the API surface both clients depend on, the permission model that decides who may read what, and the infrastructure it runs on.

The team is ten people across backend, mobile and QA. My week is roughly half architecture and review, half writing the parts nobody else should have to. About 140 endpoints, 90k patient records, and a two-week release train that has not slipped since March.

What was hard

Permissions that survive contact with reality. Healthcare access is not a matrix you draw once. A clinician can see a record because they are the treating physician, or because they are covering a shift, or because the patient granted access. Moving from per-view checks to a single policy layer took most of a quarter and removed an entire class of bug.

Leading while still shipping. Ten people generate more review than I expected. I now protect two mornings a week for my own work and treat the rest as interruptible. Before that, my branches were the oldest on the board.

On-call for something that matters. Nobody is harmed when a portfolio site is down. The calculus is different here, and it changed how we migrate: expand-contract only, never a destructive step in the same release.

What I would do differently

I let the API grow before versioning it. Retrofitting /v1 across 140 endpoints with two live clients cost a month I would rather have spent elsewhere. Version from the first endpoint — it is free at the start and expensive at every other point.