ZRMC ONE Hospital System

Zamboanga Regional Medical Center's online system for patients, staff and referring facilities.

A web app with two patient services:

1. Hospital records requests. Patients pick one or more documents and choose a pickup date.
   • Clinical Abstract / Discharge Summary
   • OPTECH Report
   • Medical Certificate
   • Certificate of Confinement
   • Medico-Legal Certificate
   • Diagnostic Test Result
   • Laboratory Test Result
   • Others (patient specifies)
2. OPD appointments. Patients book by clinic, date and time slot.

Patients get SMS messages at each step, plus automatic reminders.

The home page has two buttons: Public (records, OPD, tracking, directory and the referral portal) and Staff (Flag Ceremony Attendance and the Staff Panel). /#staff opens the Staff side directly, e.g. for a bookmark on hospital PCs.

Quick start (on your computer)

Requires Node.js 22. Without a DATABASE_URL, the app uses a built-in database stored in ./data, so nothing else needs installing.

npm install
cp .env.example .env      # Windows: copy .env.example .env
npm start                 # http://localhost:3000
npm test

On Windows PowerShell, if npm is blocked by "running scripts is disabled", type npm.cmd instead of npm.

Page	URL
Home	/
Request records	/request-records
Book OPD	/book-opd (add ?department=PEDIA to preselect a clinic)
Track / cancel	/track
Staff panel	/admin (first login: admin / admin123, or the ADMIN_USERNAME / ADMIN_PASSWORD you set)

Deploy on Vercel with Supabase

Vercel runs the API as a serverless function and serves the pages from public/. Supabase stores the data. The app creates its tables automatically on first use.

1. Create the Supabase database

1. Sign in at https://supabase.com and click New project. Choose the Southeast Asia (Singapore) region and save the database password you set.
2. When the project is ready, click Connect at the top of the dashboard.
3. Under Connection string, choose Transaction pooler (port 6543) and copy the URI. It looks like: postgresql://postgres.abcdefgh:[YOUR-PASSWORD]@aws-0-ap-southeast-1.pooler.supabase.com:6543/postgres
4. Replace [YOUR-PASSWORD] with your database password. If the password contains symbols such as @, # or /, reset it to letters and numbers only in Project Settings → Database.

2. Set the Vercel environment variables

In Vercel, open your project and go to Settings → Environment Variables. Add these:

Name	Value
DATABASE_URL	the Supabase connection string from step 1
SESSION_SECRET	a long random string (40+ letters and numbers)
ADMIN_PASSWORD	the first staff password (you can change it later in Settings)
CRON_SECRET	another long random string, used for reminders (step 3)
HOSPITAL_NAME	your hospital's name
SMS_PROVIDER, SEMAPHORE_API_KEY, …	see SMS setup

Then go to Deployments, open the ⋯ menu on the latest deployment and choose Redeploy. Environment variable changes only take effect after a redeploy.

3. Schedule the SMS reminders

Vercel's free plan only runs scheduled jobs once a day, so reminders use a free external scheduler:

1. Create a free account at https://cron-job.org and click Create cronjob.
2. Set URL to https://YOUR-APP.vercel.app/api/cron/reminders?key=YOUR_CRON_SECRET.
3. Set the schedule to Every 5 minutes and save.

Each call sends any reminders that are due. A reminder is never sent twice, even if calls overlap. You can test the URL in your browser: it should show {"ok":true,"sent":0}.

Security notes

• The app turns on Row Level Security for every table, which blocks Supabase's public REST API from reading patient data. The app itself connects as the database owner and is not affected. Don't add RLS policies, and don't use the Supabase anon key anywhere.
• The function refuses to start without SESSION_SECRET.

How it works

Records requests

• Documents may be claimed 3 calendar days after the request (RECORDS_CLAIM_DAYS). If that date falls on a weekend or a closed date set in Settings, it moves to the next working day, so a Friday request is claimable on Monday.
• The requester doesn't choose a date: the claiming date is set automatically and shown on the Review step, the confirmation screen and the SMS. Staff can still move it from the admin panel.
• Statuses run Pending → Processing → Ready → Released. A request can also end as Rejected (a reason is required) or Cancelled (by the requester, only while Pending).
• SMS is sent when the request is submitted, when it's Ready, when it's Rejected, and when staff move the pickup date. A pickup reminder goes out at 7:00 AM on the pickup date if the request is Ready.

Hardcopy or digital copy

On the last step of a records request (email is required), the requester chooses:

• Hardcopy: claim the printed documents at HHIMS on the claiming date.
• Digital copy: documents are emailed after the requester's identity is checked. The requester uploads a photo of a valid ID and a selfie holding the same ID, taken with the phone camera or chosen from the gallery and shrunk in the browser before upload. Digital copies are only offered when the patient is the requester; representatives claim hardcopies with the signed authorization letter.

This is the beginning of the README. Read the rest at the original. Read the full README ↗