A full-stack Clinic Management System built as a group project to streamline patient management, appointment scheduling, billing, and multi-role staff access in a clinical environment.
- Designed the PostgreSQL database schema for patients, appointments, and billing with normalized, relational tables.
- Built CRUD REST APIs with Node.js and Express.js following a clean layered architecture (routes → controllers → services → database).
- Developed role-based dashboards for Patients, Doctors, Receptionists, Branch Managers, and Top Managers.
- Prevented double bookings by validating slot availability before persisting appointments.
- Used parameterized queries throughout to eliminate SQL injection vulnerabilities.
- Handled accuracy-sensitive patient and billing data with bcrypt password hashing and JWT authentication.
- 🧑⚕️ Multi-role access — Patient, Doctor, Receptionist, Branch Manager, Top Manager dashboards
- 📅 Appointment Booking — Slot availability check before booking prevents double bookings
- 🏥 Patient Records — Full patient profile with medical history and visit tracking
- 💳 Billing Module — Invoice generation and payment tracking per appointment
- 📁 File Uploads — Lab report uploads via Multer
- 🔐 Secure Auth — JWT-based authentication, bcrypt hashed passwords, rate limiting
- 🛡️ SQL Injection Prevention — All queries use parameterized statements
- 🚀 CI/CD Pipeline — GitHub Actions → auto-deploy frontend (Vercel) + backend (Render)
| Layer | Technology |
|---|---|
| Frontend | React 18 + Vite + TypeScript |
| UI Components | shadcn/ui + Radix UI + Tailwind CSS |
| Backend | Node.js + Express.js |
| Database | PostgreSQL (Neon Serverless) |
| Auth | JWT + bcrypt |
| API Validation | express-validator |
| File Uploads | Multer |
| PDF Export | html2pdf.js |
| Testing | Vitest |
| Deployment | Vercel (frontend) + Render (backend) |
| CI/CD | GitHub Actions |
The project follows a layered architecture to ensure separation of concerns — changing one layer does not break the rest:
frontend/ ← React + TypeScript SPA
backend/
├── server.js ← Entry point, middleware setup
└── src/
├── routes/ ← HTTP route definitions (API contracts)
├── controllers/ ← Request handling & response formatting
├── services/ ← Business logic & rules (e.g. slot validation)
└── db/ ← Parameterized SQL queries (no raw string concat)
- Node.js ≥ 18
- PostgreSQL database (or a Neon serverless instance)
cd backend
npm install
# Create .env
cp .env.example .env
# Fill in DATABASE_URL, JWT_SECRET
# Run database migrations
node setup_database.js
# Start dev server
npm run devBackend runs on http://localhost:5000
cd frontend
npm install
# Create .env
cp .env.example .env
# Fill in VITE_API_URL=http://localhost:5000
npm run devFrontend runs on http://localhost:5173
Core tables:
| Table | Description |
|---|---|
users |
All system users with roles |
patients |
Patient profile and medical info |
doctors |
Doctor profiles and specialisations |
appointments |
Bookings with slot validation |
billing |
Invoice and payment records |
branches |
Clinic branch locations |
- JWT tokens with expiry for all protected routes
- bcrypt (salt rounds: 10) for password storage
- Parameterized queries — no raw string interpolation in SQL
- express-rate-limit — brute-force protection on auth endpoints
- CORS configured for allowed origins only
This is a group project. Key contributions include:
- Designed the PostgreSQL schema (patients, appointments, billing)
- Built CRUD APIs with Node.js + Express.js in a layered architecture
- Implemented double-booking prevention via slot availability checks
- Applied parameterized queries for SQL injection protection
- Built role-based dashboards for all user types
MIT © 2025 CATMS Group