Built a hospital-grade records system where patients own their data: medical professionals can only view records after a patient explicitly grants access, and patients can revoke it or set an expiry at any time.
- Implemented role-based workflows for patients, medical professionals, and admins — registration with admin approval, access requests, grant/decline with expiry, and record download.
- Encrypted record payloads at rest with AES-256-GCM, hashed passwords with bcrypt, and protected all sensitive endpoints with JWT role claims; every query is parameterized against SQL injection.
- Shipped a production-style Docker Compose stack with an Nginx reverse proxy load-balancing three frontend and two backend replicas plus managed PostgreSQL, with one-command migrations and seeding.