Franklin Chilango Finyange | Developer Portfolio

Building a Scalable Telemedicine Platform: MyAfya Case Study

Telemedicine platforms require careful architectural planning to handle multiple user types, secure health data, and manage real-time interactions. This article explores how I built MyAfya—a comprehensive healthcare system supporting patients, doctors, laboratories, and pharmacies.

#The Challenge

Traditional healthcare systems operate in silos. Patients visit clinics, doctors maintain separate records, labs operate independently, and pharmacies dispense medications without integrated context. MyAfya was designed to unify these touchpoints into a cohesive digital experience.

The core requirements were: - Multi-role authentication (Patient, Doctor, Lab Technician, Pharmacist, Admin) - Real-time appointment scheduling and virtual consultations - Electronic Health Records (EHR) with privacy compliance - Prescription management with pharmacy integration - Payment processing for consultations and lab tests - Audit trails for compliance and security

#Architecture Decisions

Backend: Django + Django REST Framework

I chose Django for its: - Robust ORM with complex relationship handling - Built-in authentication and permission system - Excellent middleware support for custom workflows - Maturity and battle-tested security practices

The architecture follows these principles:

API Layer → Service Layer → Models → Database ↓ Custom Permissions & Role-Based Access ↓ Audit Logging & Compliance

Database Design: SQLite (Development) → PostgreSQL (Production)

The schema includes:

Users Table: Extended with role-specific profiles
Appointments: Tracks scheduling with time slots and virtual meeting URLs
EHR Records: Encrypted patient health data with access logs
Prescriptions: Links to both doctor and pharmacy with status tracking
Consultations: Records of virtual sessions with timestamps
Payments: Transaction logs with payment gateway integration

#Key Implementation Insights

1. Multi-Tenancy & Role-Based Access

Different user roles need different data visibility:

class ConsultationViewSet(viewsets.ModelViewSet):
    def get_queryset(self):
        user = self.request.user
        if user.role == 'PATIENT':
            return Consultation.objects.filter(patient=user)
        elif user.role == 'DOCTOR':
            return Consultation.objects.filter(doctor=user)
        return Consultation.objects.all()

2. EHR Privacy & Encryption

Health data requires encryption at rest:

class EncryptedHealthRecord(models.Model): patient = models.ForeignKey(Patient, on_delete=models.CASCADE) data = models.BinaryField() # Encrypted def save(self, *args, **kwargs): cipher = Fernet(settings.ENCRYPTION_KEY) self.data = cipher.encrypt(json.dumps(self.data).encode()) super().save(*args, **kwargs) ```

3. Real-time Notifications

Using Celery for async task processing:

@shared_task
def send_appointment_reminder(appointment_id):
    appointment = Appointment.objects.get(id=appointment_id)
    send_email_notification(appointment.patient, appointment)
    send_push_notification(appointment.doctor, appointment)

4. Payment Integration

Securely handling payment without storing sensitive data:

class PaymentProcessor:
    def process_consultation_payment(self, consultation):
        # Use payment gateway (Stripe, PayPal)
        charge = stripe.Charge.create(
            amount=consultation.fee * 100,
            currency='usd',
            token=consultation.payment_token,
            idempotency_key=consultation.id
        )
        consultation.status = 'PAID'
        consultation.save()

#Challenges & Solutions

Challenge 1: Handling Concurrent Appointment Bookings

Multiple users booking the same time slot simultaneously could cause conflicts.

Solution: Implemented database-level locking and transaction management:

@transaction.atomic def book_appointment(doctor_id, time_slot): slot = TimeSlot.objects.select_for_update().get( doctor_id=doctor_id, time=time_slot ) if slot.is_available: slot.is_available = False slot.save() return Appointment.objects.create(...) raise ConflictError("Slot already booked") ```

Challenge 2: HIPAA Compliance

Ensuring patient data privacy and meeting regulatory requirements.

Solution: - End-to-end encryption for sensitive fields - Comprehensive audit logging for all data access - Regular security audits and penetration testing - Secure key management with environment variables - Data retention policies and automatic purging

Challenge 3: Virtual Consultation Reliability

Ensuring video calls work seamlessly across different networks.

Solution: - Integrated WebRTC with fallback to phone consultations - Used Twilio SDK for reliable video infrastructure - Implemented connection quality detection and fallback mechanisms

#Performance Optimization

1. Database Indexing: Indexed frequently queried fields (patient_id, doctor_id, appointment_date) 2. Caching: Used Redis to cache doctor availability and common queries 3. Lazy Loading: Optimized querysets with select_related() and prefetch_related() 4. Pagination: Implemented cursor-based pagination for large datasets

#Results & Learnings

What Worked: - Django's permission system scaled beautifully - Celery async tasks handled load spikes during peak hours - Role-based views reduced code duplication

What I'd Do Differently: - Use FastAPI for better async support from day one - Implement gRPC for service-to-service communication instead of REST - Use PostgreSQL from the start (not SQLite)

#Key Takeaways

Building a healthcare platform taught me: 1. Security First: Healthcare data requires serious protection—no shortcuts 2. Clear Architecture: Multi-role systems need clear permission boundaries 3. Async is Essential: Background jobs prevent UI blocking in medical emergencies 4. Testing is Non-Negotiable: Every workflow has edge cases in healthcare 5. Documentation Matters: Medical teams need clear API docs for integration

#Tech Stack - Backend: Python, Django, Django REST Framework - Database: SQLite (Dev), PostgreSQL (Prod) - Real-time: WebRTC, Twilio - Async Jobs: Celery - Security: JWT, bcrypt, encryption - Deployment: Docker, AWS

This project reinforced why thoughtful architecture beats hasty implementation. Healthcare systems impact lives—they deserve careful engineering.