A bilingual (English and Bengali) website and patient-booking system for a mother-and-child hospital with 25 consultants. Patients book a serial number online, and reception issues numbers from the same table at the counter, so the two can never hand out the same number.
The hard part is not the website. It is a queue that two channels share without ever clashing, patient data that only the right staff can see, and a system the hospital can run on its own after handover.
The hospital had no booking of any kind. Patients phoned or queued at the counter to get a serial number for a consultant’s sitting.
A patient is given number 14 for the evening sitting and seen when 14 is called. A clock-time appointment system would promise a precision the clinic cannot keep.
There is no technical team after handover. Anything an administrator might need to change — consultants, schedules, fees, notices, images — had to be editable without a developer, or it would never change.
Online and counter bookings both claim serials through one function, inside a serializable transaction, with a unique index on sitting, date and serial as the database-level backstop. The website and the front desk cannot issue the same number.
Reception may overfill a sitting and may book one already under way; the website may do neither. A walk-in reserve, bounded by both the online quota and the room physically left, keeps space for patients who arrive in person.
A cancelled booking gives up its place but keeps its number, so two paper slips never read the same serial. The search window widens by the retired count, so a sitting for 30 still seats 30.
Patients are told when their serial is expected, not when the next unsold number is. Running-late messages go out only on a real change, so a queue is not re-texted on every “call next”.
Roles are composed from a permission catalogue. The admin UI shows only what a role can use, but that is a courtesy — the refusal happens in the server route.
An assistant and a doctor’s own assistant hold nearly the same permissions and differ only in which doctors’ patients they may see. That scope is enforced on every query, not by a permission.
Each read or write of patient data is written to an audit log — including denials — so a question about who saw a record has an answer.
Demoting a user revokes their existing sessions, rather than leaving the old permissions live until their next sign-in.
SMTP plus three Bangladeshi SMS providers, configured from the admin. Gateway credentials are stored in the database, encrypted at rest with AES-256-GCM.
The serial is issued either way. The failure is recorded, so reception has a call list instead of a patient who never heard back.
Gateway errors are caught and rethrown without the request URL, so an outage cannot print a live API key into the admin’s browser or a proxy log.
A cancellation SMS is required because the patient may already be travelling; it is not considered delivered just because the email went through.
It is prerendered and long-cached, so a CDN keeps serving it for a week after the origin goes down — on a bad connection, at 2am.
The database client is created on first use and a boot check names every missing setting without exiting, so a bad deploy cannot take the static pages down with it.
The image library is loaded lazily. With it removed entirely, the site still starts and still serves its pages; only image processing fails.
Extension, declared type and file signature must agree, with an image decode as a fourth check. Private files live behind separate routes and are unreachable from the public ones.
Consultant directory with schedules and fees, departments, centres, packages, a baby-growth tool and an emergency page — in English and Bengali, with separate localised routes.
Choose a consultant and sitting, book a serial at any hour, and look the booking up later by reference and mobile number.
A counter queue for issuing and calling serials, printable slips, and a display board for the waiting room.
20+ screens for consultants, schedules, sittings, fees, notices, media, branding, staff, roles and integrations — plus plain-language guides written for staff, one page per job.
It is how the chambers run. An estimate per serial is honest; a 3:15pm appointment would not be.
Two allocators would eventually disagree. One function and one unique index make a double-issued number impossible, not just unlikely.
A hidden menu item is not access control. Every admin endpoint refuses on the server.
A specialty exists in both languages or is honestly missing in one — never silently shown in the wrong language.
A configuration or infrastructure problem may break only what depends on it. The emergency page must survive everything.
There is no operations team after handover. What cannot be edited will not be kept current.
An SMS outage should cost a phone call, not a patient’s serial.
The web server ships without database tooling; migrations and seeds run from a separate tools image and exit.
Patients can book a serial at any hour, from the same queue reception uses.
Website and counter can never issue the same number for the same sitting.
Role- and scope-based access, checked on the server, with every access logged.
Content, people, schedules and fees are all editable by staff from the admin.
I designed, built and coded the whole system: the booking model and its allocator, the access-control and audit design, the notification layer and its failure handling, the bilingual data model, the media pipeline, the admin and staff tools, and the Docker deployment with its runbook and restore drill. I also wrote the technical overview and the plain-language staff guides that go with the handover.
Described generically — the hospital is not named while the site is awaiting launch. One-page summary (PDF)
Shipped to production. Licences verify offline, so a vendor outage never stops a paying customer, and support moved from engineering to audited operator actions.
Read the case study →Secure streaming · E-learningIn use from 2021 to 2023. Any leaked recording traces back to one student, and course access matches how courses are sold — at a centre, at home, or both.
Read the case study →Next