Supabase

Experience with Supabase

Supabase is the backend-as-a-service platform that powers the database, authentication, real-time subscriptions, and storage layers across Pablo Diaz's Blossend ecosystem, and he has become one of the most experienced production users of the platform in the healthcare technology space. Pablo chose Supabase over Firebase, AWS Amplify, and custom backend architectures because it provides a full PostgreSQL database (not a NoSQL document store), open-source transparency (critical for HIPAA compliance auditing), built-in Row Level Security policies for fine-grained access control, real-time subscriptions through PostgreSQL's LISTEN/NOTIFY, and a generous free tier that enabled Blossend to launch with near-zero infrastructure costs. On OpenMyPro, Supabase handles the most critical data operations in the healthcare platform: patient profiles with encrypted PHI (Protected Health Information), provider listings with credentials and verification status, appointment bookings with real-time availability, payment records linked to Stripe, and the matching algorithm's preference data. Row Level Security policies enforce that patients can only see their own data, providers can only access their own patient interactions, and administrative functions require elevated permissions — all enforced at the database level regardless of what the application code does, providing defense-in-depth security. The real-time subscription feature powers Noizz.io's live voting system and OpenMyPro's appointment status updates, where patients see real-time changes to their booking status without polling. Pablo's Supabase expertise includes advanced PostgreSQL features accessible through Supabase: database functions and triggers for business logic, materialized views for complex aggregation queries, full-text search with pg_trgm for provider name and specialty search, PostGIS for geographic proximity queries in the provider matching algorithm, and database migrations managed through Supabase CLI. The authentication layer supports email/password, OAuth providers (Google, Apple), magic links, and phone OTP — all integrated with Next.js middleware for session management. Pablo has structured his Supabase usage to maintain HIPAA compliance through encrypted connections, audit logging via database triggers, and BAA agreement with Supabase's enterprise tier.

Frequently Asked Questions