CodeixLab designed and engineered a clinic management and CRM platform for a hair transplant and aesthetic clinic workflow. The system follows the full patient journey, from the first enquiry through consultation, procedure planning, payment tracking, documents, photos, follow-ups and reporting, without turning daily clinic work into an ERP exercise.
Project overview
- Industry: Healthcare and aesthetic clinics
- Services: SaaS product development, mobile app development, UI/UX product design
- Platforms: Web dashboard, tablet-friendly mobile app (Expo), public booking pages
- Tech stack: Ruby on Rails, GraphQL, PostgreSQL, Expo (React Native), Action Cable, WhatsApp Cloud API
The challenge
Clinic software needs real operational depth, but staff cannot be buried in a heavy interface. A single patient touches many roles: the call center qualifies the lead, reception books and checks them in, doctors run consultations, procedure staff plan and record treatment, managers watch conversion and revenue, and admins control settings. Each role needs a different view of the same journey, and each must only see what it is allowed to see.
Clinics with more than one location add another layer. Records, staff and schedules belong to a branch, and a mistake in branch scoping is both a privacy problem and an operational one. On top of that, clinical forms change over time, yet every historical submission must stay readable exactly as it was signed.
Our approach
One backend that owns the rules
The Rails backend is the single source of truth for business logic. Every request passes through Pundit policies and branch scoping, so permissions are enforced in one place rather than re-implemented in each screen. Patient photos and documents are delivered through private, authorised file access instead of public links.
A role-aware API for web and mobile
The frontend consumes a GraphQL API that already knows the user’s role and branch. The same API powers the web dashboard and an Expo app designed for tablets in consultation rooms, which keeps both interfaces consistent and avoids duplicate logic.
Versioned clinical forms
Clinics author their own consultation and consent templates. Forms are modelled as versioned schemas, so a clinic can change a template tomorrow without corrupting any submission made today. Each record keeps a reference to the exact form version it was completed against.
Booking before automation
Public online booking was built with strict validation and rate-limit thinking first. Only once availability, services and rules were reliable did AI-assisted replies and lead conversion become safe to plan on top.
Key features
- Lead CRM with sources, stages and follow-up tasks
- Appointments, check-in and patient profiles with full history
- Branch-scoped permissions for multi-location clinics
- Dynamic clinical and consent forms designed for tablets
- Procedure planning, payment tracking and before/after photo records
- WhatsApp inbox architecture with a path to AI-assisted replies and lead conversion
- Real-time updates across reception and clinical staff via Action Cable
- Management reporting on leads, conversions and operations
Engineering decisions that mattered
- Permissions as code, not as UI: hiding a button is not security. Policies run on every API call.
- Historical integrity: versioned form schemas protect signed records from later template edits.
- Scope boundaries: inventory, reporting and messaging were designed as clear modules so the core patient workflow stays simple for front-line staff.
What this means for your project
If you run a clinic, salon, or any appointment-heavy service business in the UAE or elsewhere, the same patterns apply: one source of truth, role-scoped access, safe booking, and automation only where the data underneath is trustworthy. Read more in our article on building clinic software without turning it into an ERP, or book a free consultation to talk through your workflow.
Outcome
A clinic operations platform with role-scoped UX, branch integrity, protected patient files, versioned clinical forms and a safe path to WhatsApp and AI automation.