MediSlot
Healthcare appointment scheduling, built for three kinds of users at once.
Solo full-stack developer — designed the system architecture, built the Express/MongoDB API, and shipped all three Next.js frontends (Patient, Doctor, Admin) end to end.
Feb – Sep 2026
Overview
MediSlot is a full-stack healthcare scheduling platform built as three separate applications — Patient, Doctor, and Admin — sharing one Express/MongoDB API, each with its own JWT-scoped login so a token issued for one role can never be replayed against another.
The core loop is a booking's lifecycle: a patient finds a doctor and requests a slot, the doctor confirms or declines it, and the appointment moves through PENDING → CONFIRMED → COMPLETED, with reschedule and cancellation handled at every step along the way. From there the platform layers on the pieces a real clinic actually needs — prescriptions tied to completed visits, recurring weekly availability rules per doctor, automated email reminders, in-app messaging between doctor and patient, post-visit ratings, and an admin console with live appointment and patient analytics.
Rather than a single admin panel bolted onto a booking form, each role gets a dashboard built around what that person actually does day to day — a patient managing their own care, a doctor running their queue and schedule, an admin operating the clinic — all reading and writing through the same authorization-checked API underneath.
Key Features
- Role-based dashboards for patients, doctors, and admins
- Real-time appointment slot booking and availability management
- JWT authentication with per-role authorization enforced on every API request, not just at login
- Prescriptions tied to completed appointments, with per-medicine dosage and status tracking
- Doctor-configurable recurring weekly availability, down to per-day time windows and slot length
- Automated email reminders and in-app doctor–patient messaging
- Post-visit doctor ratings and admin-side clinic-wide analytics
Challenges & Solutions
Keeping three independent frontends in sync on identity
Admin, doctor, and patient apps are separate Next.js projects hitting one Express API, so a single JWT payload (id + role only) had to drive every permission check. Solved with a shared protect + authorize(...roles) middleware chain on the backend and a /auth/me endpoint each frontend calls once on load to hydrate the full user profile client-side.
Coordinating booking state across roles without a shared frontend
A booking's status (pending → confirmed → completed/cancelled) has to stay consistent whether it's changed from the doctor app or the admin app, with no shared client state between them. Solved by treating the backend as the single source of truth and having each app poll/refetch on the appointment resource rather than trust local state.
Deriving patient records instead of storing them separately
Rather than maintain a separate "patients" collection prone to drifting out of sync with appointments, the admin patients view is computed on the fly from appointment history (dedupe by patient ID, roll up visit counts and last-visit status) — one less place for data to go stale.
Fire-and-forget email notifications
Appointment emails are sent async and failures are logged rather than blocking the request, so a flaky SMTP provider never breaks a booking.