Viewing as
DOORCTA · FOR DOCTORS

Go online. Take consults. Get paid.

Doorcta Pro is the doctor app. Verify your MDCN once. Toggle online when you have capacity. Take incoming consults inside a 15-second window. Notes auto-attach to OneHealth. Earnings roll up on the FastCredits ledger.

Apply to onboardHow it works
Doorcta Pro is the React Native + Expo app for doctors. The lifecycle is verify (MDCN + Didit + selfie liveness, gated by an active verificationStatus), toggle (go online when you have capacity, off when you do not), accept (15-second response window per incoming request, with the patient's triage payload but no PII), consult (live video over Daily, chat over websocket, structured notes), and earn (every captured consult is a row on the FastCredits ledger; the rolled-up earnings surface ships in 2026). Healthcare guardrails are non-negotiable; the AI base does not diagnose or prescribe — that lives with you, signed against your MDCN registration.
01 / 07

1 · Verify once · MDCN + Didit + liveness

Doctors do not self-onboard into the live pool. The onboarding flow uploads the MDCN registration number (the Medical and Dental Council of Nigeria registry verifies the licence-holder name); the Didit identity-document check matches the doctor's government ID against the MDCN name; a selfie liveness confirms the doctor is the registry-named clinician. The admin panel runs the manual review; until verificationStatus flips to active, the doctor cannot go online. Re-verification runs quarterly; suspension on registry-status change is enforced.

10:42MTN5G
Verify your licence
Step 4 of 4 · doctor onboarding
  • MDCN MD-NL-04287
    Registry checked · mdcn.gov.ng
    Verified
  • Government ID
    Identity check · Didit · 100% match
    Verified
  • Selfie liveness
    Captured · 0.98 confidence
    Verified
  • Specialty + clinic
    Cardiology · LUTH Lagos
    Verified
Submit for review
Active within 24h · re-verify quarterly · suspend on registry status change
02 / 07

2 · Go online · the doctor pool

When you have capacity, you flip the online toggle. The pool query in doorcta/server/src/matching/pool.ts then includes you; the matcher considers you for any consult where the suggested specialty matches yours, your current load is below your maxConcurrent ceiling, and you do not already have a pending claim. The shift screen surfaces your active-consults gauge (e.g. 2 / 5), your average response time, your response rate, and your today-count. Auto-offline kicks in after 30 minutes of idle so a forgotten online flag does not bleed match attempts.

10:42MTN5G
Doorcta Pro · Shift
Dr. Chiamaka Eze
Family Medicine · Verified
Online
Active consults2 / 5
Capacity from pool.ts · maxConcurrent
Avg response
11s
Response rate
97%
Today
8 consults
Go offline
Auto-offline after 30 min idle · re-verify quarterly
03 / 07

3 · Incoming request · 15s · clinical-only payload

An incoming-request screen surfaces with a 15-second countdown (`DOCTOR_RESPONSE_TIMEOUT_MS`). The payload carries the urgency, the suggested specialty, the symptoms, the body area, the duration, the severity, the prior conditions, and the patient's preferred language — but no PII. The state-machine.ts comment is explicit: 'No PII (name, email, etc.) — only clinical data.' Accept and the consult opens; decline (or timeout) and the matcher releases your claim and reassigns to the next-ranked candidate.

10:42MTN5G
Incoming request13s
UrgentCardiology
  • Symptoms
    Sharp chest pain, shortness of breath
  • Body area
    Chest · upper left
  • Duration
    About 2 hours
  • Severity
    7 / 10
  • Prior conditions
    Hypertension (5y)
  • Language
    English
Accept
Decline
No PII · clinical only · timeout releases doctor claim
04 / 07

4 · Live consult · chat alongside video

The consult runs over Daily.co video; chat flows over the same websocket that pushed the match event. The chat thread is structured — the patient's role, the doctor's role, timestamps; messages are not free-form forever, they are bounded by the consult lifetime. The architectural decision is that the consult artefact is one bounded unit (video + chat + notes + Rx) rather than scattered across surfaces. Chat is the parallel channel for things that do not fit naturally into video — a drug name to spell out, a number to confirm, a link to a pharmacy.

10:42MTN5G
End-to-end encrypted · NDPA 2023 compliant
  • Doctor · 10:42
    Tell me when the chest pain started. Any radiation to the arm or jaw?
  • You · 10:43
    Started about 06:30. No radiation. Feels sharp not crushing.
  • Doctor · 10:44
    OK. I'm sending an ECG referral to the closest LUTH Lagos partner. Stay seated.
Send
05 / 07

5 · Notes auto-save to OneHealth

The consult-notes screen takes structured notes — Assessment, Plan, Advice. Auto-save runs continuously; every save flows to OneHealth's POST /v1/records endpoint as a draft. The architectural decision is that PHI lives in OneHealth, not in Doorcta — Doorcta stores only the OneHealth record ID locally for the link-back. The notes are envelope-encrypted with a per-record DEK, AAD bound to a UUIDv5 derived from the record ID, audit-chained on write. The consult timer keeps you anchored; the End-consult button is one tap away.

10:42MTN5G
Consult notes04:12
  • Assessment
    Likely musculoskeletal chest pain, low cardiac risk on triage.
  • Plan
    Aspirin 75mg OD ×30d. ECG within 7 days. Re-consult if worse.
  • Advice
    Avoid lifting >5kg for 48h. Stop and call 112 if pain radiates.
Auto-saved to OneHealth · 2s ago
End consult
Notes encrypt with the patient's record key · audit-chained on write
06 / 07

6 · Prescribe · sign + send to OneHealth

The prescribe screen captures drug name, dose, frequency, duration, and notes-for-patient. Your MDCN signature line is pre-filled (Dr. <name> · MDCN <number>); the Sign + send to OneHealth button writes the prescription as a Provenance-tagged record bound to the consult. Prescriptions are first-class records in OneHealth, retrievable by the patient through OneHealth's patient surface, and linkable to a Fastclinic-partner pharmacy for dispensing. Sign-and-send is one transaction; a save-draft path exists for the in-progress case.

10:42MTN5G
Prescribe
MDCN signature
Dr. Tunde Okafor · MDCN MD-NL-04287
Sign + send to OneHealth
Save draft
Encrypted with the patient's record key · provenance-tagged on write
07 / 07

7 · Earnings · this week · coming 2026

Doctor earnings roll up on the FastCredits ledger — every captured consult is a row that the doctor's service-token integration can read via GET /v1/accounts/:id/transactions. The dedicated Earnings Summary surface that aggregates them into a daily, weekly, monthly view ships in 2026 alongside the Provider Payouts service. Today the underlying ledger primitives are operational; the rolled-up settlement layer is what 2026 unlocks. Until then, earnings are queryable on the ledger and visible per-consult.

10:42MTN5G
This week · EarningsComing 2026
Captured
32,650 CREDITS
Captured · 94% rate
42 consults
  • Mon4,250
  • Tue5,100
  • Wed4,900
  • Thu6,300
  • Fri7,100
  • Sat3,200
  • Sun1,800
Payouts to bank · NGN ↔ CREDITS at the day's mid-market rate
Earnings surface ships in 2026 · ledger-aggregated, service-token auditable today
What you get

Verified-only pool · matcher only sees you when ready

The pool query gates on isOnline=true and verificationStatus=active and currentLoad < maxConcurrent. The matcher does not waste a 15-second window on a saturated or unverified clinician; the Redis SETNX claim with a 20-second TTL prevents two patients from racing on you.

15-second response window · no PII in the payload

The incoming-request payload is clinical-only — urgency, specialty, symptoms, body area, duration, severity, prior conditions, language. No name, no email, no phone. The 15-second timer is short enough to keep the patient's under-30-seconds promise honest.

Notes auto-save to OneHealth · provenance-tagged

Doorcta keeps no PHI of its own. Your notes are envelope-encrypted in OneHealth, audit-chained on write, AAD-bound to the record ID. Auto-save runs throughout the consult so a network drop does not lose the record.

Sign + send · MDCN signature on every prescription

Prescriptions carry your MDCN registration number as the signature line and are persisted as Provenance-tagged OneHealth records bound to the consult. The patient retrieves through OneHealth; the pharmacy reads through the same record.

Capture-rate analytics · ledger-backed, today

Every consult captured is a row on the FastCredits ledger; every consult released is a row on the same ledger. Capture rate is queryable today through GET /v1/accounts/:id/transactions; the rolled-up dashboard ships in 2026.

Capabilities

AI base
  • Triage agent on Opus · single-shot classifier
  • Deterministic red-flag pre-check · runs before LLM
  • Triage invariant · urgency only increases
  • All AI calls audit-logged · input/output/tools/guardrails
  • Healthcare guardrails non-negotiable · no diagnosis, no Rx
  • Single import boundary · ai/base.ts is the only call site
Match state machine
  • DOCTOR_RESPONSE_TIMEOUT_MS = 15s · accept/decline window
  • PATIENT_CONFIRM_TIMEOUT_MS = 10s · confirm window
  • MAX_REASSIGNMENT_ATTEMPTS = 10 · ceiling on retries
  • Doctor pool gate · online + verified + capacity
  • Atomic claim · Redis SETNX with 20s TTL
  • 5-factor scorer · BASE_WEIGHTS tunable without redeploy
Cost & credits
  • CONSULTATION_COST = 1 credit · 1 credit = 1 naira
  • Hold at match start · capture at consult end
  • Release on cancel · release on match failure
  • Reference grammar · consultation:<id>
  • Idempotent retries · UNIQUE(account_id, reference)
  • Doubly-delivered webhooks converge on one debit
Records & PHI
  • Notes flow to OneHealth · POST /v1/records
  • Doorcta keeps no PHI · only the OneHealth record ID
  • Envelope encryption · per-record DEK + UUIDv5 AAD
  • Audit-chained on write · 7-year retention
  • Patient retrieves through OneHealth · single product surface
  • Provenance-tagged on prescription · MDCN signature
Realtime & video
  • Websocket gateway · per-app channel
  • Match events push · no polling
  • Daily.co video · per-session rooms + tokens
  • End-to-end encryption · regulated video provider
  • Chat over the same socket as match events
  • Connection-quality telemetry · admin throughput surface
Verification & compliance
  • MDCN registration verified · mdcn.gov.ng
  • Didit identity check · ID document + face match
  • Selfie liveness · prevent stolen-photo onboarding
  • Re-verify quarterly · suspend on registry change
  • NDPA 2023 compliant · controller Fastclinic Limited
  • African data residency · single Nigerian region

Integrations

Fastclinic
FastLogin

FastLogin is identity. Patient app and Doctor app are OAuth2/OIDC clients of FastLogin (the doorcta-mobile authorization-code-with-PKCE client) and the Doorcta server-to-server callers use the doorcta-server client_credentials grant. Tokens are 15-minute access plus 24-hour refresh with rotation; JWKS is cached for 5 minutes with a singleflight group on unknown-kid lookup. Doctor onboarding routes through FastLogin's KYC handoff (Didit identity-document verification + selfie liveness) before the doctor can flip to verificationStatus=active in the doctor pool. The middleware classifies tokens by client_id because Hydra 2.x stamps sub=client_id on client_credentials tokens.

Fastclinic
FastCredits

FastCredits is the credit ledger. Doorcta calls POST /v1/accounts/:id/hold at match start with the deterministic reference consultation:<id>, captures through POST /v1/holds/:id/capture at consult end, and releases through POST /v1/holds/:id/release on cancel or match failure. CONSULTATION_COST is 1 credit. The single-writer 409-is-success invariant applies: a 409 from a retry is a confirmation that the prior call succeeded and the response was lost, not an error to surface to the patient. The duration_seconds parameter is now honoured (post-OH-09 fix); Doorcta passes the consult's expected lifetime so the hold does not silently default to 10 minutes.

Fastclinic
OneHealth

OneHealth is the record store. Doctor consult notes and any prescription land via POST /v1/records — envelope-encrypted with a per-record DEK, AAD bound to a UUIDv5 derived from the record ID, audit-chained on write. Doorcta stores only the OneHealth record ID locally for the link-back; the body is OneHealth's. The architectural decision is that PHI lives in one product so a patient can retrieve it through one surface. The same record API is used by the doctor's prescription pad — a Sign + send to OneHealth call writes the prescription as a Provenance-tagged record bound to the consult.

External
Daily.co

Daily.co is the video provider. Each consult provisions a per-session room and a per-participant token through doorcta/server/src/video/daily.ts; the rooms are end-to-end encrypted; tokens expire with the consult. The architectural decision is to use a regulated video provider with E2E encryption rather than build a media server — Daily handles SFU, NAT traversal, codec negotiation, and the regulated-region routing that lets us keep the media path inside Africa. The Daily API call is the only routine cross-border edge in the Doorcta data flow; it carries metadata, never PHI.

Compliance & safety

NDPA 2023 — controller Fastclinic Limited (RC 1919428)

Doorcta processes the personal-data fields it needs to operate the consult — the FastLogin user identifier, the chat transcripts, the call metadata, the rating and free-text feedback — under NDPA 2023 §25 lawful bases. The data controller is Fastclinic Limited, RC 1919428, registered in Lagos. The data-processing record is updated alongside every release that touches a new dataset or a new processor. We do not claim NDPC processor registration; that filing is in progress. Clinical content (consult notes, prescriptions) is held by OneHealth under the same controller, not by Doorcta — the architectural separation matches the legal separation.

NDPA 2023
MDCN registration — verified before live pool

Doctors do not self-onboard into the live pool. The onboarding flow uploads the MDCN (Medical and Dental Council of Nigeria) registration number plus a government ID and a selfie liveness; the admin panel runs the manual checks against the MDCN public registry; only when the doctor's verificationStatus flips to active can they go online. Re-verification runs quarterly; suspension on registry-status change is enforced. The pool query gates on both isOnline=true and verificationStatus=active, so the matcher only ever surfaces a verified clinician.

MDCN public registry
Healthcare guardrails — no diagnosis, no prescription from AI

The AI base is a triage and red-flag-detection layer. It does not diagnose; it does not prescribe. Every agent registered in doorcta/server/src/ai/agents/ declares which guardrails apply to it, and the healthcare guardrails (no diagnosis, no prescription) are non-negotiable. Diagnosis and prescribing happen exclusively in the doctor's app, signed by an MDCN-licenced clinician. The deterministic red-flag pre-check runs before the LLM and forces an emergency escalation on a small set of keywords regardless of what the model says, so the AI cannot down-rank a true emergency.

Source — doorcta CLAUDE.md AI base
African data residency — single Nigerian region

Postgres, Redis, and the Daily.co video region all run in or close to a Nigerian-region AWS account that the Fastclinic Limited data controller operates. The chat messages live in the Doorcta database for the consult lifetime; clinical data flows to OneHealth at consult end. Cross-border transfer is limited to specifically-named processors under signed agreements (Daily.co for video media, Paystack for the FastCredits cash on-ramp). The architectural decision is a single residency posture across the ecosystem: the patient's data does not jump regions when they switch from the Doorcta app to OneHealth or to FastCredits.

Master spec — residency policy
Audit posture — every AI call, every match, every consult

Every AI base interaction is audit-logged: input, output, tool calls, guardrail flags, token usage. Every match-state transition is audit-logged through the state machine. Every consult is bracketed by startConsultation and endConsultation events with timestamps, doctorId, patientId, and the FastCredits hold reference. Doorcta itself does not hold PHI; the consult notes and any prescription audit-chain against OneHealth's hash-chained log on POST /v1/records. The 7-year retention applies to the OneHealth audit chain, which is where the clinical record of every consult is anchored.

OneHealth audit posture

Plain answers

Verify once. Take consults. Get paid.

Verification is once. The pool gates on online + verified + capacity. Notes flow to OneHealth. Prescriptions are MDCN-signed. Earnings are on the FastCredits ledger today; rolled-up payouts ship in 2026. Apply to onboard and the verification queue takes it from there.

Apply to onboardRead the docs