Lumera

In short

Lumera is a mobile-first PWA for keeping track of the menstrual cycle, ovulation and pregnancy tests, medication, notes and reminders in one calendar. Predictions are always shown as predictions and as a range, kept apart from real entries. The app does not diagnose and is not a method of contraception. The project is in development; a test version runs at staging.gevher.site.

Starting point

Cycle, tests and medication often end up in different apps or notes, and many cycle apps mix predictions with real data or ask for an account early on. What was needed was a simple app that clearly separates entries from estimates and treats health data with restraint.

My role

Research, product and UX specification, prototype, frontend, API and deployment, all implemented by me as a personal product project.

Solution

An installable PWA (Vite, vanilla JavaScript and CSS) with Today, Calendar, Analysis and Profile sections and a short onboarding. Users choose which modules are visible (period, ovulation test, medication, basal body temperature, cervical mucus). The app works without an account; an optional account runs on a lean PHP API with MariaDB. Health entries are not sent to the server.

Technologies

• Vite
• JavaScript
• CSS
• PWA
• Service Worker
• PHP 8.1
• MariaDB
• Hostinger

Key functionality

• Today view with cycle day, week strip, estimated next period and data confidence with a "How was this calculated?" explanation
• Calendar with month and week views; predictions dashed, real entries filled
• Logging of periods, LH and pregnancy tests, basal body temperature, symptoms and notes
• Medication and supplements with a schedule and "taken / skipped / snoozed" status
• Selectable modules and three themes (pink, baby blue, dark)
• Use without an account or with an optional account (register, log in, log out, delete account)
• Installable as a PWA, offline start via service worker

Security & performance

• Health entries currently stay on the device and are not sent to the server
• Password hashing with Argon2id (where available), HttpOnly/Secure/SameSite=Strict session cookie and session ID regeneration
• CSRF token and Origin check, prepared statements, rate limits for login, registration and account deletion
• IP addresses and emails stored only as HMAC hashes for rate limiting; configuration outside the web root
• Test version set to noindex, no external CDNs

Outcome

• Test version at staging.gevher.site with onboarding, all main views and the account system
• The health data shown is demo data; the prediction algorithm, encrypted sync and push notifications are still to come

Not released yet. User numbers are not stated.