Nestly

Around any neurodivergent child orbits a small constellation of adults — parents, a teacher, a special-ed coordinator, an occupational therapist, sometimes a speech therapist, sometimes a pediatrician. Each holds a fragment of the picture. Each communicates with the others through email, WhatsApp groups, paper reports, and PDFs sent across three apps. The child is the only stakeholder without a voice in any of those threads.

The brief was to give the child a single record that the adults around them could co-edit responsibly. Not a chat app. Not a CRM. Closer to a shared dossier where each role has structured permissions, every change is auditable, and the child's data belongs unambiguously to the parent.

The architecture had to survive contact with the most fragmented stakeholder in the system: the school. Which means it had to work without IT support, without single sign-on, without anyone reading documentation.

We designed the role model before designing a single screen. Five roles — parent (owner), teacher, school coordinator, therapist, doctor — with different default permissions on a shared ChildRecord that contains profile, learning plans, behavioural observations, medical notes, and milestones. Parent can see everything; teachers see only what they're explicitly granted; therapists see what's relevant to their intervention. Audit log on every read and write.

The data model places the child as the root, not the user. Every view scopes by ChildRecord, every entity belongs to a child, and parent transfer (e.g. divorce, guardianship change) is a single supported operation rather than an afterthought.

On the UX side, the design constraint was 'works in 90 seconds for a tired parent'. Inviting a teacher takes one form. Receiving an invite takes one click. Adding a behavioural note takes a sentence and a tag. Everyone's mental model is 'this is the child's notebook' — not 'this is a SaaS dashboard'.

Each ChildRecord is its own tenant unit. Every query scopes by child_id with a row-level guard checked at the ORM layer; no business code can accidentally cross children. Postgres + Drizzle handles the schema; tRPC types every API surface end-to-end; Auth.js handles invitations via magic-link.

The interesting work was in the *consent model*. Therapists and teachers can be granted read or write access to specific record sections (e.g. behavioural notes only, not medical). Grants are time-boxed (e.g. 'this school year') and visible to the parent on a single screen. Revoking access wipes the cached views; nothing lingers.

Notifications use email rather than push because the audience checks email professionally — and we explicitly did not build a feed or 'engagement' surface. The product wants to be opened, used briefly, and closed. Not scrolled.