BioMedigo

Problem

Smaller clinics in the region keep patient and credentialing data in paper files and scattered spreadsheets, which means patients re-tell their history at every visit and hospitals cannot verify each other’s referrals. The CapacityDey tech-club team set out to prototype a shared medical-records platform that both sides could trust — hospitals onboard with their licence documents and branches, patients carry a single verified profile. The challenge was building enough of the foundation (data model, auth, verification) for the team to layer real clinical features on later, not just a CRUD demo.

Approach

• 01

  Modelled clinics as first-class tenants. A Clinic belongs to a UserProfile of type Hospital and owns Branch, Doctor, and ClinicDocument rows — so credentialing artefacts (licences, accreditation) live next to the operational data instead of in a separate KYC system.

• 02

  Staged account verification as an enum, not a flag. AccountVerificationStage (PASSWORD_UPDATE_REQUIRED → EMAIL_VERIFICATION_REQUIRED → PROFILE_UPDATE_REQUIRED → VERIFIED / SUSPENDED) lets the API and UI gate routes by exact onboarding step rather than juggling N booleans.

• 03

  Layered auth: local + Google + OTP. Passport strategies for JWT and Google OAuth 2.0, Argon2 password hashing, cookie-parser/express-session for the OAuth handshake, and a resend-otp module wired to the mailer for email-verification codes.

• 04

  Made the dev loop boring. Docker Compose runs separate dev and test Postgres instances; npm scripts wrap prisma migrate dev/deploy, db:dev:restart, and db:test:restart so any team member can reset state in one command.

• 05

  Two-repo split with matching branch conventions. frontend-staging/backend-staging → *-dev → *-prod plus a feat|bug|docs|... commit cheat sheet in both READMEs — gave a small student team a predictable PR flow.

Outcome

• 01

  Auth, user, admin, mail, and resend-OTP modules shipped with DTO validation and Swagger docs; Prisma schema covers 7 models and 5 enums.

• 02

  Frontend reached an end-to-end onboarding flow (Landing → SignUp → Verify → AccountSetup → Home/Welcome) on React 18 + MUI + Redux Toolkit.

• 03

  Codified contribution flow (backend-staging / frontend-staging → dev → prod, commit-type cheat sheet) that the tech club reused for later teams.

• 04

  Led a CapacityDey Team Beta of 20 as backend lead, with a parallel contribution on the frontend.

Lessons

• 01

  Model the verification state machine, not booleans. Enum-driven stages (PASSWORD_UPDATE_REQUIRED → VERIFIED) collapse a pile of isEmailVerified / hasProfile flags into one source of truth — and the frontend can switch on it directly to pick the next screen.

• 02

  Spin up the test DB the same way you spin up dev. Having db:test:restart mirror db:dev:restart (via a separate Compose service and .env.test) meant e2e tests with Pactum never poisoned dev data — worth the 30 minutes to set up on day one.

• 03

  For a student team, write the branch/commit rules into the README before the first PR. The cheat-sheet table did more for code review velocity than any tooling — review comments stopped being about branch names and started being about the code.