All work

Product

Clinic Management System

The clinic's schedule, records and payments in one place.

A management system for psychology and health clinics in Brazil. It coordinates professionals, rooms and appointments alongside patient records and payments, within the constraints of the client's shared hosting.

Paid product · contact for access

Available in Brazilian Portuguese. Built for clinic workflows in Brazil.

Interested? Let's talk

A schedule shared by people and rooms

An appointment needs both a professional and a room. The shared calendar brings those resources together, with conflict checks when bookings are written. Patient records and payment tracking sit alongside that daily scheduling work.

Delivery context

Team
Solo, design to deploy
Period
2026-07 – 2026-10
Status
Built for a client; becoming a white-label product
Stack
Laravel 12 (PHP 8.3), React, TypeScript, MySQL

Hosting, patient data and scheduling

  • Shared hosting as a hard constraint

    The clinic already had shared cPanel hosting, so production had to fit it: no Docker, Node.js, root access or custom ports. It is a conventional Apache/PHP app, Docker stays in development only, and every release is a validated package (security checks, dependency audit, tests, production smoke test) with a documented rollback.

  • Patient data encrypted field by field

    Identifying patient data is one JSON payload sealed with XChaCha20-Poly1305, bound to the record type, UUID and field, with versioned keys and a rotation command. The CPF stays searchable through a keyed HMAC blind index. Patient searches send names and CPFs in the request body rather than the URL, keeping those search terms out of URL-based access logs. The cost: no free-text search in the database.

  • Scheduling conflicts checked where they are written

    Times travel as UTC ISO 8601 and are shown in America/Bahia. Overlaps use half-open intervals, so back-to-back sessions are allowed, and the check and the write happen in the same transaction, so two people booking the same room at once cannot both succeed.

Inside the shared-hosting deployment

The browser loads a React SPA and calls /api/v1 on Apache with PHP-FPM, which runs the Laravel 12 API on the clinic's shared cPanel hosting. The API keeps encrypted patient fields in MySQL and encrypted files outside the document root, and syncs with Google Calendar.Shared cPanel hostingHTTPSsyncBrowserReact SPAApachePHP 8.3 · FPMLaravel 12API /api/v1MySQL 5.7encrypted fieldsProtected filesoutside the docrootGoogle Calendar
  • Laravel 12 API and a React + Vite + TypeScript SPA compiled before release.
  • MySQL in production; the MVP ran on SQLite, and backup and restore still support both.
  • Development in Docker Compose; production on the shared cPanel hosting the clinic already paid for.
  • Google Calendar integration and an MCP server for assisted operation.

Availability and operating limits

  • Portuguese only: built around Brazilian law and regulation (health data, LGPD).
  • Shared hosting sets the ceiling: no long-running processes or custom services.
  • Private repository with client data around it; screenshots will be anonymized.