We are exploring a patient-facing mobile application connected to Frappe Healthcare. The app would allow patients to sign in, view available practitioners, request appointments, receive reminders, and access selected medical records.
I’m involved with AppVerticals, a mobile app development company, and we are currently evaluating the safest integration approach for this type of project: INSERT-YOUR-MOBILE-APP-DEVELOPMENT-PAGE-URL
Before proceeding, I would appreciate guidance from developers who have implemented a similar solution.
Would you recommend using Frappe’s standard REST API for the mobile application, or creating a separate integration layer with custom whitelisted methods? We also need to understand the best way to:
-
Authenticate patients securely without exposing ERPNext credentials
-
Restrict each patient to their own appointments and records
-
Check practitioner availability in real time
-
Prevent duplicate appointment requests
-
Send push notifications when an appointment is confirmed or changed
-
Handle API failures and temporary offline access
-
Maintain an audit trail for sensitive healthcare information
My current preference is to keep all permissions and validation on the server, expose only the fields required by the mobile app, and avoid giving the client direct access to unrestricted DocType endpoints.
Is this the recommended architecture for Frappe Healthcare, or are there existing modules and patterns that would reduce the amount of custom development required? Any examples or documentation would be helpful.