Built by 
About this software
About Carepoint Clinic Booking & SMS Reminders
Carepoint is a Node.js 22 / Express 5 / PostgreSQL application with a plain HTML, CSS and JavaScript front end. It serves three roles (patient, doctor and clinic admin) across 7 web pages: dashboard, login, register, booking, doctor workspace, confirmation and index. Patients register, book a service with a doctor, reschedule, cancel, and join a cancellation waitlist. Staff manage doctor and room schedules, patients, and appointments, with overlap checks for both doctors and rooms. Optional Twilio SMS sends 24-hour and 2-hour reminders and waitlist offers; jobs stay queued until credentials are set. Docker Compose and Render deployment files are included. The code shows no mobile apps, payment processing, multiple languages or multi-branch support; it is configured for one clinic via a default clinic slug.
Why Carepoint Clinic Booking & SMS Reminders
What makes it better
than the alternatives
- 01
Doctor and room conflict checks
Appointment inserts are validated against active schedules and overlapping doctor/room bookings, using transactions and row locking.
- 02
Cancellation waitlist with offers
When a slot is cancelled the next matching patient gets a time-limited offer with a random token link (2-hour acceptance window per the SMS text).
- 03
Signed, expiring confirmation links
SMS confirmation uses HMAC tokens tied to appointment, patient and time; no plaintext token is stored, and a migration removes the old column.
- 04
Role and ownership enforcement
Patients see only their own records, doctors only their own schedule and appointments, admins stay within their clinic; routes are documented in ROUTE-SECURITY.md.
- 05
Ready-to-run deployment
Docker Compose (Nginx, API, Postgres, reminder worker), a Render blueprint, pinned image digests, a dependency audit, and unit tests for auth, validation, rate limiting and confirmation.
Patient portal
- Self-registration with a password of at least 12 characters
- Book by doctor and service with availability slots
- View visit history
- reschedule and cancel
- Manage waitlist entries
- One-tap SMS confirmation page
Doctor workspace
- View own assigned appointments only
- View own schedule only
Clinic admin dashboard
- Clinic appointments and calendar view
- Patient directory with visit counts and last visit
- Doctors and services overview
- Create users with patient
- doctor or admin roles
- Full waiting list view
Scheduling
- Weekly schedules per doctor
- room and service
- Configurable slot length (minimum 10 minutes)
- Edit hours and activate or deactivate schedules
- Rooms and service catalog
Waitlist
- Patients request a service with a date range and an optional doctor
- Offers generated on cancellation
- with expiry
- Accept offer via tokenised link
- Cancel entries (patient or admin)
SMS reminders (Twilio)
- 24-hour and 2-hour reminder jobs
- Waitlist offer messages
- Separate reminder worker process
- Nothing is sent until Twilio credentials are configured
Security and sessions
- Scrypt password hashing
- HttpOnly
- SameSite=Strict signed session cookies with a 12-hour lifetime
- Per-user session revocation on logout
- Rate-limited login and registration
- Helmet with a Content Security Policy
- Parameterised SQL
Deployment and operations
- Docker Compose and Render blueprint
- Explicit database setup script with a migration ledger
- Create-admin script
- Health endpoint
- Optional demo seed data
- Light and dark themes
- plus clinic name
- timezone and brand configuration
| Language | Version | Framework | Used for | Share of code |
|---|---|---|---|---|
| JavaScript | — | — | Front-end | 51.7% |
| CSS | — | — | Styling | 30.8% |
| HTML | — | — | Front-end | 12.6% |
| SQL | — | — | Database | 4.9% |
- Primary language
- JavaScript (Node.js 22.23.4)
- Framework
- Express 5.1.0 (with helmet 8.3.0)
- Database
- PostgreSQL 16 (16.15 in Docker Compose)
- Authentication
- Email and password with scrypt hashing; HMAC-signed HttpOnly, SameSite=Strict session cookie; role checks for patient, doctor and admin
- Licence
- Single-site
- Screens
- 7
- Database tables
- 11
- Supported languages
- English UI only; no translation files or RTL support in the code
- Browser support
- Modern evergreen browsers (uses fetch, Intl and CSS layouts); no tested browser matrix is included
| Minimum | Recommended | |
|---|---|---|
| CPU | 2 vCPU | 2 vCPU |
| RAM | 2 GB | 4 GB |
| OS | Node.js 22.23.4 on Alpine Linux (Docker image); PostgreSQL 16.15 | Node.js 22.23.4 on Alpine Linux (Docker image); PostgreSQL 16.15 |
| Est. monthly hosting | $25 | $25 |
```bash cp .env.example .env # set POSTGRES_PASSWORD and SESSION_SECRET in .env docker compose up --build ``` Open http://localhost:8080. The API health check is at /api/health.
```bash git clone <your-repo-url> carepoint && cd carepoint cp .env.example .env # set POSTGRES_PASSWORD, SESSION_SECRET, PUBLIC_APP_URL and COOKIE_SECURE=true in .env docker compose up -d --build ``` Put a TLS reverse proxy in front of port 8080. See HowToSetup.md for the full steps.
Deploy with the included render.yaml Blueprint, then set the secret environment variables (POSTGRES_PASSWORD, SESSION_SECRET) in the Render dashboard.
```bash npm ci npm run db:setup npm run dev npm test ```
Quality report
Manually reviewedHow to read the quality report
What this is. Every project on Vibe96 goes through an automated audit of its source code before a reviewer in Dubai checks it by hand. The score is out of 100; 75 is the minimum to be listed, and any single failing check blocks a listing regardless of the score.
- Security
- No real credentials in the code, every data-changing route protected, admin areas role-gated, no SQL built from user input.
- Code structure
- A developer can navigate and extend it: clear module boundaries, no giant files, little copy-paste.
- Docs & completeness
- The setup guide, example config, schema and required files the builder committed to are actually in the archive.
- Dependency health
- Packages pinned, no known critical vulnerabilities, no abandoned libraries in production paths.
- Build & deploy
- A clean machine can restore, build and start it by following the shipped instructions.
Warnings are problems that didn't block the listing; they stay visible here until a later version clears them. The audit reads the code — it does not run it — so always try the live demo before you buy. Lines of code are counted from the same audited archive.
Reviewer notes (4 minor)
Mostly reproducible; howtosetup.md and dockerfiles unseen, committed zip and version mismatch are gaps; sql is parameterized and tenant-scoped; schema review is limited and a few input checks are missing. None of these stop the software from working; the developer has been told and improvements come in a future update.
Versions & updates
No updates yet. New versions appear here with a changelog.
Buyers receive updates free for 1 year.
What you get
- </>Full source codeThe complete audited source, delivered as a download from your account. No obfuscation.
- ▤DocumentationSetup guide, architecture notes, CLAUDE.md and AGENTS.md.
- ↻One year of updatesEvery new version the builder publishes, free for 12 months.
- ♧30 days of supportInstallation and defect support through Vibe96 tickets.
