Context & Problem
Small dental clinics were caught between two bad options: paper-based tracking that caused double bookings and lost patient histories, or enterprise HMS software built for hospital-scale operations and priced accordingly. The client needed an affordable, mobile-first system that covered the full clinical workflow — scheduling, EHR, treatment planning, and billing — without requiring a full IT team to run it.
Small dental clinics struggled with managing patient records, scheduling, and billing using outdated paper systems or prohibitively expensive enterprise software designed for hospital-scale operations. Double bookings were common, patient histories were difficult to retrieve during appointments, and billing was a manual, error-prone process. The solution needed to be affordable for independent practices while still meeting healthcare data security standards. It also had to integrate seamlessly into existing clinical workflows without requiring extensive staff training.
Design Constraints
- teamInherited constraints from legacy project format.
Architecture Overview
Built the client as a native Android application in Kotlin, leveraging Jetpack Compose for a modern, responsive UI that feels natural on tablets and phones used in clinical settings. Backed it with a NestJS API on PostgreSQL, implementing row-level security and AES-256 encryption at rest for HIPAA-conscious data handling. Designed the scheduling engine with a constraint-satisfaction algorithm that accounts for procedure duration, provider availability, and room assignment to prevent conflicts. Integrated Firebase Cloud Messaging for automated appointment reminders via SMS and push notifications, with configurable timing and confirmation tracking.
Outcomes & Lessons Learned
Clinic Adoption
Adopted by 15+ dental clinics
Scheduling Conflicts
Reduced scheduling conflicts by 90%
Patient Wait Times
Decreased patient wait times by 25%
Retrospective
- Healthcare data security is a first-class architectural concern, not a feature to add later. Row-level security in PostgreSQL and AES-256 at rest were designed in from the start; retrofitting them after the data model exists is significantly more expensive.
- The scheduling conflict detection algorithm was the most complex piece of the system — accounting for procedure duration, room turnover time, provider breaks, and emergency slots simultaneously. We ended up modelling it as a constraint-satisfaction problem rather than a calendar query.