Diagnostic lab platform for booking, home collection and reports

The brief

A diagnostic lab group in India wanted a diagnostic lab platform that covers the whole test cycle. A patient books a test and a collector visits the home for the sample. The lab enters results, a pathologist signs off, and the patient gets the report.

Patients should also be able to add their ABHA health ID, under India’s Ayushman Bharat Digital Mission. Lab results are some of the most sensitive data a person has. Access control and consent had to be built in from day one.

What we built for the diagnostic lab platform

One API, five apps

The design is one NestJS API serving five front ends:

• Admin (web) for administrators
• Lab console (web) for lab assistants and pathologists
• Patient app (Expo) and patient web
• Collector app (Expo) for phlebotomists on home visits

The lab console is web on purpose. A lab assistant may enter a 92-parameter package in one sitting, and mistakes there are clinical.

Family accounts

One mobile number can hold profiles for a whole family. Orders, samples and reports attach to the person, not the phone. Every profile records date of birth and sex, because a reference range cannot be resolved without them.

Access control for health data

Every request passes three checks: a signed token, a role permission and an ownership check. The API is closed by default. A patient asking for someone else’s report gets “not found”, so the API never confirms a profile exists.

Lab staff see their own branch only. Sessions live in the database, so access can be revoked the moment someone leaves. Patients sign in with a mobile OTP, and staff accounts lock after repeated failed logins.

Consent is recorded per purpose, timestamped and revocable, with India’s DPDP Act in mind.

How we worked

We wrote the first-phase scope down before building. It has eleven features, from sign-in and the test catalog to home collection, results, reports, notifications, audit and ABHA. Analyzer interfacing, insurance claims and doctor-referral portals are out of the first version. Where the spec contradicted itself, we flagged it before committing to a delivery date.

The API is contract-first. The backend publishes a typed client with a mock mode, so frontend work can start before an endpoint exists. Every push runs the end-to-end tests against a real PostgreSQL database. More on this approach in how to scope an MVP.

Where it stands

In development. The API’s identity and access layer is built. End-to-end tests cover sign-in, OTP, lockout, sessions, roles and patient data scoping. The clinical modules come next, then the five apps on the same API contract.