CarelineOS (Backend)
Scalable backend for digital health: 100+ REST APIs supporting appointments, patient records, role-based access, and secure workflows. Node.js, MongoDB, modular architecture for hospital and clinic management.
Why This Was Hard
A hospital platform can't afford sloppy API design. Patient data is sensitive, roles are strict, and downtime or data leakage isn't an option. This is the backend powering CarelineOS — a modular REST API layer handling every digital-health operation across hospitals, clinics, and multi-tenant deployments — and it needed clear domain boundaries (auth, users, appointments, analytics) so the surface area stayed manageable even as the API count grew past 100 endpoints. Where the CarelineOS app project covers the product experience, this is the engine underneath it.
What I Built
- 100+ REST endpoints covering appointments, patient records, vitals, and messaging
- Role-based access control — admin, doctor, patient, and staff permission guards enforced at the API layer, not just the UI
- Secure workflows — encrypted communication channels and audit trails for sensitive actions
- Modular domain architecture — auth, users, appointments, and analytics kept as separate, independently testable modules
- Optimized MongoDB models — indexed queries built for the access patterns a hospital dashboard actually uses (recent vitals, upcoming appointments, per-doctor patient lists)
- Refresh-token auth flow — short-lived access tokens with secure refresh handling
Tech Stack
- Runtime: Node.js
- Framework: Express
- Database: MongoDB
- Auth: JWT, refresh tokens
Key Decisions
- Structured the API around domain modules (auth, users, appointments, analytics) instead of one flat routes file, so a new engineer could find and extend a single domain without reading the whole backend
- Used short-lived access tokens with a separate refresh flow rather than long-lived JWTs, trading a bit of extra request overhead for a meaningfully smaller attack window on sensitive patient data
- Indexed MongoDB collections around the queries the dashboard actually runs (recent vitals per patient, upcoming appointments per doctor) rather than indexing everything, keeping write performance predictable as data grew
- Documented every endpoint's contract before the frontend team built against it, treating the API surface as a product in its own right
Outcome
A production-ready backend supporting the full CarelineOS platform, with clear API contracts and documentation that let the frontend team build against a stable, predictable interface.