Shifokor

Live: shifokor-site.vercel.app · Code: github.com/Jaloliddin-Kulmatov/shifokor-site

Find a good doctor, know the price before you go, and ask a specialist online. Built first for people living in villages, in Uzbek, Russian and English.

State polyclinic queues, medical records and prescriptions belong to DMED and my.gov.uz; Shifokor points people there instead of competing with it. It focuses on what DMED doesn't do: choosing the right specialist (state or private), checked credentials, prices up front, and online consultation in Uzbek.

Status: prototype. Accounts, consultations and visit requests use the server when a database is configured, otherwise a demo saved in the browser. The clinic directory uses real open data.

What's inside

• Doctors: profiles with specialty, experience, licence, languages, workplaces, services with prices, and online consultation prices (text, audio, video), typical reply time and online hours. Search by specialty, region, language, name or service; "online only"; sort by checked first, cheapest consultation or experience.
• Reviews: only a patient whose consultation with the doctor is finished, or whose confirmed visit day at the clinic has come, can rate them (1–5 stars, optional comment, name shown as "Ali V." or hidden), once per consultation or visit. Ratings show on profiles and cards and count in "checked first" and "highest rated" sorting (a few reviews are pulled towards 4 stars, so one 5-star review doesn't beat many 4.8s). Doctors and clinics can reply; admins can hide reviews.
• Photos in consultations: the patient can add up to 3 photos to the application (a rash, a wound, a lab result) and either side can send photos in the chat, up to 20 per consultation. The browser shrinks each photo to a JPEG of at most 1600 px, which also removes the phone's location data. Photos are stored in the database (app_files), and only that consultation's patient and doctor can open them. While an application is still open, a doctor who could accept it can open them too. The server checks each file's first bytes and accepts only JPEG, PNG or WebP up to 1.5 MB. In demo mode, smaller copies stay in the browser.
• Prices (#/prices): every service and consultation price that doctors and clinics entered, searchable by service (with common synonyms, e.g. UZI / узи / ultratovush), region, maximum price and "available online", each with the date it was updated.
• Online consultation: patients fill in an application first (with an emergency safety check), see the chosen doctor's price for that kind of consultation, then the doctor replies by text or calls.
• Onalar uchun (for mothers), #/ona: a pregnant woman saves her due date (or the first day of her last period) and, if she likes, her gynaecologist. She sees her week of pregnancy and the WHO schedule of 8 antenatal check-ups, and checks in every week, on the page or with Telegram buttons, with nine danger signs. A danger sign tells her to call 103 or go to the maternity hospital at once and messages her doctor and one family member she linked by a Telegram link. Telegram also reminds her before each check-up. For six weeks after the birth the check-in also asks about the baby. Doctors see the pregnant patients who chose them, with their last check-in, and can mark themselves as a woman doctor ("Faqat ayol shifokorlar" filter). Data: app_preg, app_preg_checks; the weekly messages come from the daily job. Shifokor never diagnoses.
• First available doctor: doctors switch on "Hozir onlaynman" (online now) for 1, 2 or 4 hours on their account page; patients see a green "Hozir onlayn" badge. A patient can choose "Birinchi bo‘sh shifokor" instead of a named doctor: doctors online now (matching the specialty, or GPs) get a Telegram alert, and the first to accept takes the consultation.
• Come in person, no charge: instead of accepting a new application, a doctor can write their advice and mark that an in-person visit is needed. The application closes as "Yuzma-yuz ko‘rikka", nothing is charged, and the patient sees the advice with links to nearby hospitals and 103. The home page and the application form list which problems suit an online consultation and which need 103 at once.
• Follow-up: two days after a consultation is finished, Telegram asks the patient "Qalaysiz?" with Better / Same / Worse buttons, and the consultation page asks too. "Worse" tells the doctor and shows the patient what to do next. Vercel runs /api/daily once a day at 10:00 Tashkent time (vercel.json); set CRON_SECRET in Vercel so only Vercel's own call is accepted.
• Photos and logo: the home page uses five free photos from Unsplash (Unsplash License, commercial use allowed): Vitaly Gariev (doctor on a video call, at a desk, on the phone), Joel Heard (a woman in Nukus) and Alexander Popovkin (Shah-i-Zinda, Samarkand). They're stored in site/img in 640 and 1200 px widths and credited at the bottom of the home page. Use them only in general, friendly roles, never to show the people in them as patients with an illness. The logo and browser icon (site/icon.svg) are a black Chust do‘ppi with white almond motifs and a medical cross.
• Doctor photos: doctors upload a photo on their account page (shrunk to 480 px); it shows on their cards and profile.
• Online payment (Payme, Click): when a doctor accepts an application, its price is fixed from the doctor's price for that kind of consultation. The patient then sees "Maslahat uchun to‘lov" with Payme and Click buttons, and pays on Payme's or Click's own page (Shifokor never sees card details). Until the patient pays, the doctor can't reply or call; the patient can still write. Payme and Click tell the server about each payment directly (app_payments), so a paid consultation can't be faked from the browser, and refunds made in the Payme cabinet show as "To‘lov qaytarilgan". Free consultations, and every consultation while no payment keys are set, work as before without payment. In demo mode a test button shows the flow.
• Adding doctors from a list: only doctors who agreed to be listed. An admin opens Tekshiruv → Shifokorlarni qo‘shish (#/admin?tab=import), downloads the blank template, fills one row per doctor in Excel or Google Sheets, saves it as CSV (;, , or tab between cells; UTF-8 or Windows-1251) and uploads it. The page checks every row first (name, phone, specialty, region, phone listed twice) and adds only rows without errors, after the admin ticks that the doctors agreed. Columns: ism* (name), telefon* (phone), email, mutaxassislik* (specialty, e.g. Ginekolog), viloyat (region), litsenziya (licence), tajriba (years), tillar (uz, ru, en), ish_joyi (workplace), matn_narx, audio_narx, video_narx (online prices in soums; empty means not offered), onlayn (ha if they consult online), haqida (bio); English names (name, phone, specialty, region, …) work too. Each added doctor gets a personal invite link (/#/claim/…, valid 30 days, shown once). Send it to that doctor by Telegram or SMS: they set a password, confirm the profile, and can edit it. Until then they show in the directory with a note and take no online consultations or payments. The same tab lists doctors who haven't opened their link, with "new link" and "remove" (for a doctor who withdraws consent).
• Doctor payouts: the money from Payme and Click goes to the platform's merchant account, and the platform pays doctors. A doctor is owed their share (the price minus PLATFORM_FEE_PERCENT, recorded when the patient paid) for each paid consultation once it's finished; refunded ones don't count. Admins see Tekshiruv → Shifokorlarga to‘lov (#/admin?tab=pay): totals, what each doctor is owed, and a form to record each bank transfer after making it (amount, date, payment order number). It can't record more than the doctor is owed, and a transfer recorded by mistake can be deleted. The doctor gets a Telegram message and sees "Daromadingiz" (earnings and transfers) on their account page. Both lists export to CSV for the accountant. Doctors' bank details aren't stored on the site; get them from the doctor directly.
• Audio and video calls: the doctor presses "Qo‘ng‘iroqni boshlash"; the patient gets a Telegram notice and a "doctor is calling" banner, and joins. The call runs straight between the two browsers (WebRTC, encrypted by the browsers) and isn't recorded; the server only passes the short set-up messages (app_signals, deleted after 10 minutes). Either side can mute, turn the camera off, switch to the back camera on a phone (to show a rash), or shrink the call to a small box and keep using the chat. If one side drops out, the call reconnects when they come back. In demo mode a call can be tried between two tabs of one browser.
• Checks: admins confirm doctors and clinics before they show "Checked" or take visit requests.
• Notices: Telegram, and SMS through Eskiz.uz, plus unread counts.
• Hospitals (secondary): 1,554 health facilities in all 14 regions and 199 districts with a map and "near me", for "where to go after the consultation". Hospitals that join Shifokor can take visit requests; state polyclinic queues point to DMED / my.gov.uz.
• The older booking demo, sample clinic workspace and village helper (sample clinics with made-up prices) are no longer linked from the menu.

Run it

No build step. From the site folder:

python3 -m http.server 8765

Then open http://127.0.0.1:8765. Without Supabase settings the site runs in demo mode (everything saved in the browser).

Deploy on Vercel

Import the repository with the root directory left as the repository root. vercel.json sets the build (node scripts/write-config.mjs), serves the site folder, and api/app.js runs as a server function.

Add one environment variable (Project → Settings → Environment Variables):

Name	Value
DATABASE_URL	your Postgres connection string (POSTGRES_URL or SUPABASE_DB_URL also work)

For Supabase, copy it from Connect → Connection string → Method: Transaction pooler (host …pooler.supabase.com, port 6543) and replace [YOUR-PASSWORD] with the database password. The "Direct connection" string (db.<project>.supabase.co) works over IPv6 only, which Vercel functions can't reach. If the password has special characters, percent-encode them.

Optional variables (add them, then redeploy):

Name	What it turns on
ADMIN_EMAILS / ADMIN_PHONES	Comma-separated emails or 998… phone numbers of the people who check clinics and doctors. Signed in, they see Menyu → Tekshiruv (#/admin).
TELEGRAM_BOT_TOKEN	Telegram notices. Create a bot with @BotFather and paste its token. Production deploys point the bot at /api/app?tg=hook by themselves; an admin can also press "Telegram botni shu saytga ulash" on the Tekshiruv page.
TURN_URLS with TURN_SECRET, or with TURN_USERNAME + TURN_CREDENTIAL	A TURN relay for calls on networks that block direct connections (many mobile and office networks). Without it calls use public STUN only and some won't connect. TURN_URLS is comma-separated, e.g. turn:turn.example.uz:3478,turns:turn.example.uz:5349. With your own coturn server (use-auth-secret), set TURN_SECRET to its static-auth-secret, and each user gets a password that expires in 12 hours. For a hosted TURN service, set its fixed username and credential instead. A coturn server in Uzbekistan also keeps relayed call traffic in the country.
PAYME_MERCHANT_ID, PAYME_KEY (+ PAYME_TEST=1 while testing)	Payme payments. In the Payme business cabinet, set the cashbox endpoint to https://<site>/api/app?pay=payme and the account field to consult. Test first with the test key and PAYME_TEST=1 in Payme's sandbox (test.paycom.uz), then switch to the real key and remove PAYME_TEST. Optional PAYME_IKPU and PAYME_PACKAGE_CODE add the service's IKPU (MXIK) code to the fiscal receipt.
CLICK_SERVICE_ID, CLICK_MERCHANT_ID, CLICK_SECRET_KEY	Click payments. In the Click merchant cabinet, set both the Prepare and Complete URLs to https://<site>/api/app?pay=click.
CRON_SECRET	Any long random text. Vercel sends it with the daily follow-up job, and other callers are refused. Without it the job still works, since it only ever sends what's due.

Then redeploy. On the first request the server creates its tables (app_users, app_sessions, app_consults, app_messages, app_appts, app_reviews, app_files, app_signals, app_payments, app_payouts, app_preg, app_preg_checks) by itself, including new ones added later. Without DATABASE_URL the site runs in demo mode.

How the backend works

• The connection string lives only on the server (api/app.js); the browser gets nothing but a sign-in token.
• Accounts: patients, doctors and clinics sign up with an email or a +998 phone number and a password (stored as a scrypt hash). Sign-in works with either. Sessions last 30 days.
• Applications and messages: patients see only their own; doctors see open applications for them and the ones they accepted; only the patient and the accepted doctor can write in a consultation.
• Checks: a clinic takes visit requests only after an admin confirms it (for the hospital it claimed; claiming another hospital or changing the name or licence needs a new check). Doctors show "Checked" once confirmed. Verify with an official source, such as the hospital's official phone number or the licence register.
• Notices: people link Telegram from their account ("Telegramni ulash" opens the bot; pressing Start links the chat). Patients hear when a visit is confirmed or declined and when a doctor accepts or replies; clinics hear about new and cancelled requests; doctors about applications sent to them. Without Telegram, visit answers go by SMS when Eskiz is set up. The site also shows unread counts on "Qabullarim" and on a clinic's account button.
• Visit requests: only the patient who sent one and the clinic it went to can see it. A patient can have at most 5 open requests and one per clinic per day; days must be within the next 30 days (Tashkent time).
• Chat and requests refresh every few seconds while the page is open.
• Row-level security is on with no policies, so Supabase's public Data API can't read these tables even if its keys leak.
• Not yet: rate limiting on sign-in, password reset, email or phone verification of accounts.

Use test data only on servers outside Uzbekistan. Real patient data must be stored on servers in Uzbekistan.

Data and licences

• Clinics: Healthsites.io / © OpenStreetMap contributors, under the Open Database License (ODbL). site/clinics.js is a derived database and stays under ODbL.
• Regions and districts: OCHA COD-AB administrative boundaries for Uzbekistan (2018), CC BY-IGO.
• data-build/build.py rebuilds site/clinics.js; see site/README.md for details.

Shifokor is a directory and scheduling tool, not a medical provider. In an emergency, call 103.