Portfolio Project

ClarityCare

Enterprise Hospital Management System

A comprehensive, enterprise-grade Hospital Management System designed from the ground up to transform how healthcare organisations deliver patient care. Built on modern cloud-ready architecture, ClarityCare unifies every department — from reception desks to operating theatres, from pharmacy counters to executive boardrooms — into a single, secure, and intelligent platform with 11 fully integrated feature modules.

View on GitHub

Platform at a Glance

One Patient. One Record. One Platform. Every interaction, every observation, every prescription, every invoice — captured in a single unified system that gives clinical teams complete visibility, administrators total control, and patients confidence that their care is coordinated and comprehensive.

11

Feature Modules

7

User Roles

31

Permissions

50+

Database Tables

7

Aggregate Roots

11 Integrated Feature Modules

Each module represents a core operational area within a hospital. They are not isolated features — data flows between them. A patient registered at reception appears in appointments, their consultation generates a prescription reviewed by pharmacy, and the service is captured by billing. One connected system.

1. Patient Registration

Auto hospital numbers, NHS validation, duplicate detection, allergy recording, soft-delete, full audit trail

2. Appointments & Scheduling

Multi-step booking wizard, real-time availability, overlap prevention, reception dashboard, no-show tracking

3. Clinical Workflows

Consultation workspace, vital signs, clinical notes, ICD-10 diagnosis coding, care plans, record locking

4. Laboratory & Diagnostics

Lab requests, priority classification, result entry with reference ranges, critical result alerting, trending

5. Pharmacy & Prescriptions

Allergy conflict detection, pharmacist review workflow, dispensing confirmation, medication history

6. Billing & Payments

Auto invoice generation, multi-item, tax calculation, payment recording, insurance claims, revenue reporting

7. Administration & Security

User management, 7 roles, 31 permissions, password management, session control, immutable audit log

8. Admissions & Bed Management

Ward configuration, visual bed map, concurrency-safe allocation (RowVersion), transfer/discharge workflows

9. Medication Administration

Medication rounds, administration recording, high-risk flagging, overdue alerts, nursing task board

10. Documents & Patient Portal

Document versioning, form builder, consent recording, patient self-service portal, appointment/results access

11. Integration & AI

FHIR/HL7 endpoints, message queue with retry, AI-assisted summaries (advisory), analytics, multi-tenant

Domain-Driven Design with Rich Aggregate Roots

The heart of ClarityCare is a pure Domain layer with zero external dependencies. Every business entity is a sealed aggregate root with private setters, factory methods, and state transition methods that enforce clinical workflow invariants at compile time. No developer can accidentally set a prescription to "Dispensed" without going through "Submitted → Approved → Dispensed". The domain layer makes illegal states unrepresentable.

PatientAggregate

Registration, updates, archival with mandatory reason

AppointmentAggregate

Booking, arrival, consultation, completion with overlap prevention

ConsultationAggregate

Start, complete with mandatory summary, automatic record locking

PrescriptionAggregate

Draft → Submit → Approve/Reject → Dispense (no shortcuts)

InvoiceAggregate

Draft → Issue → Payment recording with balance validation

LabRequestAggregate

Request → Sample → Processing → Complete (no result tampering)

AdmissionAggregate

Request → Bed allocation → Admit → Discharge with summary

MedicationSchedule

Active → Pause/Resume → Complete (patient safety critical)

Security & Compliance Architecture

Healthcare data is among the most sensitive in existence. ClarityCare treats security as a first-class concern — every architectural decision was made with SOC 2 Type II, ISO 27001, HIPAA, and GDPR requirements as design constraints. The audit trail is immutable: the AuditService only performs INSERT operations. No UPDATE or DELETE method exists.

Authentication & Security

  • PBKDF2 password hashing with 100,000 iterations and per-user salt
  • Constant-time comparison preventing timing attacks
  • JWT Bearer tokens with configurable expiry (60 min default)
  • 7 pre-configured roles, 31 granular permissions
  • CORS enforcement, HTTPS in production, no stack traces leaked

Audit & Compliance

  • Every data modification: user, timestamp, before/after values, reason
  • Immutable audit logs — no user can edit or delete entries
  • X-Correlation-Id tracing from browser through to database
  • RFC 7807 exception shielding — zero information disclosure
  • GDPR data access request support through patient record export

CQRS with MediatR — Complete Command/Query Separation

Every write operation flows through a sealed command record with a dedicated FluentValidation validator and a single-purpose handler. Every read operation flows through a sealed query that projects directly into DTOs using .Select() — no entity ever loads into application memory for read operations. This means read paths are optimised for speed while write paths are optimised for correctness.

Command Flow:  Controller → MediatR → Validator → Handler → Domain Aggregate → DbContext → Audit
Query Flow:    Controller → MediatR → Handler → .AsNoTracking().Select(DTO) → Response

Architecture Layers

ClarityCare.Domain → Pure entities, enums, interfaces (zero dependencies)

ClarityCare.Application → Business logic: Commands, Queries, Validators

ClarityCare.Infrastructure → Data access, external services, persistence

ClarityCare.Api → Web API layer: Controllers, Middleware

ClarityCare.Tests → Unit and integration tests

Angular 20 Enterprise Frontend

The frontend demonstrates modern SPA architecture with standalone components, Angular Signals for state management, OnPush change detection throughout, permission-based UI rendering, lazy-loaded routes, and a design system built on DaisyUI + TailwindCSS with full WCAG 2.1 AA accessibility.

Standalone Components

Zero NgModules, tree-shakeable, lazy-loaded per route

Angular Signals

Reactive state with fine-grained change detection and OnPush throughout

Permission-Based UI

Sidebar and navigation show only authorised modules based on JWT claims

Interceptor Pipeline

Correlation → Auth → Error — every request traced, authenticated, error-handled

Reusable DataTable

Built-in search (400ms debounce), pagination, sorting, badges, empty states, loading

Generic API Service

Typed get<T>(), post<T>(), list<T>() methods — no HttpClient in components

Database Engineering — Production Hardened

Entity Framework Core with SQL Server configured for enterprise resilience. 50+ normalised tables with full referential integrity, composite indexes on high-query-volume columns, row-level concurrency control on critical resources like beds and admissions, and a soft-delete architecture that ensures no data is ever permanently destroyed.

Retry strategy with 3 attempts, 10s delay
30s command timeout preventing thread pool blocking
IEntityTypeConfiguration for every entity
Composite indexes on high-query columns
RowVersion optimistic locking on critical resources
Soft delete with IsDeleted, DeletedAtUtc, DeletedBy
Split queries for complex joins
AsNoTracking for all read paths
Indexed audit log (entity, user, date, module)

Technology Stack

Backend

.NET 10ASP.NET CoreMediatR 14FluentValidation 12AutoMapper 16Entity Framework Core 10SQL ServerJWT BearerSerilogSwagger

Frontend

Angular 20TypeScriptAngular SignalsDaisyUI 5Tailwind CSS 4Standalone ComponentsOnPush Change DetectionLazy-Loaded Routes

Architecture

Clean ArchitectureCQRSDomain-Driven DesignSealed AggregatesState MachinesMediatR PipelineDomain Events

Compliance

SOC 2 Type IIHIPAAISO 27001GDPRNHS Digital StandardsImmutable AuditRFC 7807

What This Demonstrates About My Engineering

Modelling complex clinical workflows as code
Domain-driven design with rich aggregate roots
Compliance-grade security and audit architecture
CQRS with strict command/query separation
Full-stack: .NET 10 + Angular 20 + SQL Server
50+ table relational database design
Making illegal states unrepresentable at compile time
Production-hardened: retry, concurrency, soft delete
End-to-end tracing from browser to database
Understanding healthcare domain complexity

Interested in this level of engineering?

I am available immediately for senior developer, technical lead, and contract opportunities across the UK.