clinic-wa-cms — WhatsApp CMS PoC

Privacy — not a clinical system

WhatsApp is not a confidential medical channel. This PoC may store message bodies that are personal data under the Hong Kong PDPO. Do not put real patient records here. HIPAA is out of scope unless separately commissioned.

Webhook

GET challenge + POST messages

/api/webhooks/whatsapp

Signature verify is live when META_APP_SECRET is set.

Outbound

Graph /{phone-number-id}/messages

Dry-run is on unless you set a real token and META_CLOUD_DRY_RUN=false.

Postgres

Connected

Tenant rows: Clinic, WhatsAppLine, Conversation, Message.

Sample clinics

Seed fixtures, marked as sample — not real customers.

Clinic	phone-number-id	Status
Harbour Family Practice (sample) harbour-family-sample	pnid_sample_harbour	ACTIVE
Mid-Levels Dental (sample) midlevels-dental-sample	pnid_sample_midlevels	ACTIVE

Send stub

Builds the Cloud API payload. Default is dry-run.

Recent conversations

Tenant-scoped by clinic. Inbound webhooks append here when the phone-number-id matches a line.

Harbour Family Practice (sample)

Sample patient A

OUTBOUND · E2E UI send: 星期四下午 3 點可以嗎？（dry-run）
OUTBOUND · Harbour Family Practice (sample): 星期四下午 3 點可以嗎？
INBOUND · E2E inbound: 星期四下午改期可以嗎？

Mid-Levels Dental (sample)

Sample patient B

INBOUND · E2E mid-levels: 想預約洗牙