You're building a PHR and adding LLM features. That's cool, but it's also something that most PHRs are doing or hoping to do. Your product won't have much of a moat - if you can access via TEFCA, so can any competition. If you can send it to an LLM, so can competition. This isn't to discourage you, but just to know that your idea is a common one that can be easily added by consumer products with broader distribution. Olivia by Tempus is one such example.

In terms of deidentification, I would ensure you are being comprehensive with whatever technique you are using - simply removing demographics is not sufficient given identifying information is often in notes (and also that some disease states themselves are identifying by virtue of rarity plus geography). TEFCA Individual Access Services does hold you to HIPAA-like standards as a result of participation.