← Back to Projects

Case Study

MediLink

Secure healthcare appointment booking platform with JWT authentication and PostgreSQL-backed scheduling.

Live DemoGitHubArchitectureCase Study
ReactJavaScriptNode.jsExpressPostgreSQLJWTREST API

Overview

MediLink is a full-stack healthcare appointment booking application that connects patients with providers through a secure, responsive web interface. Built with React on the frontend and Node.js/Express on the backend, it uses PostgreSQL for relational data storage and JWT for authenticated access to sensitive patient and appointment records.

Problem Statement

Healthcare providers still rely heavily on phone-based appointment scheduling, which is time-consuming for staff and inconvenient for patients. An online booking system must handle appointment conflicts, protect patient data, and work reliably on mobile devices — while meeting the security expectations of healthcare workflows.

Solution Architecture

MediLink follows a classic three-tier pattern: a React SPA handles patient registration, login, and appointment booking UI. An Express API layer enforces JWT authentication, input validation, and business logic for scheduling conflicts. PostgreSQL stores users, providers, time slots, and appointments in a normalized relational schema with foreign-key constraints.

┌──────────────────┐     ┌──────────────────┐     ┌─────────────────┐
│    React SPA     │────▶│  Express REST API │────▶│   PostgreSQL    │
│  (Responsive UI) │     │  (JWT + Validation)│    │ Users/Appts     │
└──────────────────┘     └──────────────────┘     └─────────────────┘
         │                        │
         ▼                        ▼
   Protected Routes         Conflict Detection
   Mobile-First Forms       Availability Checks

Technology Stack

  • React
  • JavaScript
  • Node.js
  • Express
  • PostgreSQL
  • JWT
  • REST API

Key Features

Patient Registration & Login

Secure account creation with password hashing and JWT-issued sessions for authenticated access to booking features.

Appointment Scheduling

Patients select providers, choose available time slots, and book appointments with real-time conflict detection.

Provider Availability

Backend logic checks provider schedules and existing bookings to prevent double-booking and invalid time slots.

Protected REST APIs

All sensitive endpoints require valid JWT tokens with server-side validation and sanitized input handling.

Responsive Mobile UI

Touch-friendly forms and navigation designed for patients booking appointments on phones and tablets.

Relational Data Model

PostgreSQL schema with users, providers, appointments, and availability tables linked by foreign keys.

Patient Authentication

Patients register with personal details and credentials. Passwords are hashed with bcrypt before storage. Login returns a JWT containing the user ID and role, which the React app stores and attaches to subsequent API requests via Authorization headers.

Appointment Booking

The booking flow guides patients through provider selection, date picking, and time slot selection. Before confirming, the API runs a conflict check query against existing appointments for the selected provider and time window.

Availability & Conflict Detection

Provider availability is defined as recurring weekly schedules plus exception dates. When a booking request arrives, the API queries overlapping appointments and rejects slots that conflict — returning clear error messages to the frontend.

API Endpoints

  • POST /api/auth/register, /api/auth/login — patient authentication
  • GET /api/providers — list available healthcare providers
  • GET /api/appointments/availability — fetch open time slots
  • POST /api/appointments — create a new appointment
  • GET /api/appointments — retrieve patient's appointment history

Database Schema

PostgreSQL tables for users (patients), providers, provider_schedules, appointments, and appointment_status. Indexes on provider_id and appointment_datetime accelerate conflict detection queries. Foreign keys enforce referential integrity between patients, providers, and bookings.

Challenges Faced

  • 01Modeling appointment conflicts and provider availability with edge cases like overlapping slots and timezone handling
  • 02Implementing secure JWT session management without exposing patient data in client-side storage
  • 03Building accessible, mobile-friendly forms for patients with varying technical comfort levels
  • 04Ensuring API input validation prevents SQL injection and invalid booking states

Lessons Learned

  • Healthcare scheduling demands strict conflict detection at the database query level, not just the UI
  • JWT expiration and secure storage patterns are critical when handling sensitive patient workflows
  • Mobile-first form design significantly improves adoption for patient-facing healthcare apps
  • Normalized PostgreSQL schemas make appointment auditing and reporting straightforward as requirements grow