Skip to main content
DOORCTA · FOR PRACTICE & CLINIC ADMINS

Roster, coverage, throughput, escalations, payouts.

Run the doctor side of a Doorcta-enabled practice. Roster grid with verification states. Coverage timeline with gap detection. Live throughput with SLA tracking. Escalations with severity. Payouts shipping in 2026.

Practice and clinic admins run the doctor side of a Doorcta-enabled practice. Today: a roster grid with verification states (active / pending / suspended), a coverage timeline that detects schedule gaps, a live throughput dashboard against the under-30-seconds SLA, and an escalations queue for red-flags, match timeouts, and payment-hold failures. Forward-looking: a payouts breakdown with platform-share split and CSV export, shipping with the Provider Payouts service in 2026.
01 / 05

1 · Doctor roster · verification states

The roster grid lists every doctor under your practice with their specialty, current load (`currentLoad / maxConcurrent`), recency-weighted rating, and verification state. The state machine is pending → active → suspended (with rejected as a terminal arm), governed by doorcta/server/src/db/schema.ts. The architectural decision is that the matcher only ever surfaces an active doctor — pending and suspended are visible to the practice admin but invisible to the patient pool. Onboarding a new doctor begins as pending; admin sign-off after MDCN + Didit + liveness flips to active. Suspension is one click and reflects in the pool query immediately.

Doctor roster12 active · 1 pending · 1 suspended
DoctorSpecialtyLoadRatingStatus
Dr. Adesina BelloCardiology2 / 54.9active
Dr. Chiamaka EzeFamily Medicine1 / 44.8active
Dr. Tunde OkaforInternal Medicinepending
Dr. Aisha BalaPediatrics4.6suspended
Verification gate · pending doctors cannot accept consults
Practice admin
doorcta.fastclinic.xyz/admin/roster
02 / 05

2 · Coverage timeline · gap detection

The coverage timeline shows when each doctor is on shift across the day, in 1-hour granularity. Gaps surface explicitly — a 'Coverage gap · 14:00-15:00' callout when no doctor is online during a window — so an admin can recruit ahead of a real consult-queueing event. The timeline reads from the same isOnline signal the doctor pool gates on, so what the admin sees is what the matcher considers. Coverage gaps fall back to the AI triage with retry rather than dropping the consult; the admin's role is to tighten the schedule so the fallback does not have to fire.

Coverage · Today3 doctors · 08:00–20:00
Doctor
08101214161820
Dr. Adesina Bello
Dr. Chiamaka Eze
Dr. Tunde Okafor
Coverage gap · 14:00–15:00
0 doctors online · queue will route to AI triage with retry
Gap detected
doorcta.fastclinic.xyz/admin/coverage
03 / 05

3 · Throughput · live · SLA tracking

The throughput dashboard surfaces the live KPIs that drive Doorcta's under-30-seconds promise: active consults, queue depth, match p50 (and p95), decline rate. The SLA caption is explicit — 'match in <30s, breach 0 in last hour' — and a breach over the day surfaces as a row on the escalations queue. The KPIs trace to the same instrumented state-machine transitions that drive the audit log; the dashboard is read-only on top of the production telemetry, not a separate source of truth.

Throughput · LiveRefreshed 1s ago
Active consults
27
↑ 4 vs 1h ago
Queue depth
3
0 over 30s
Match p50
11s
p95 24s · within SLA
Decline rate
4.1%
30-day avg 5.2%
In flightWaitedState
Cardiology · urgent8sin flight
Family Medicine · routine3sscoring
Pediatrics · routine1squeued
SLA · match in <30s · breach 0 in last hour
Live
doorcta.fastclinic.xyz/admin/throughput
04 / 05

4 · Escalations · 24/7 oncall queue

Escalations surface three things: red-flag clinical patterns (chest pain, stroke-pattern indicators, etc.), match timeouts that exhaust the 10-attempt reassignment ceiling, and payment-hold failures (idempotent retry exhausted). Each row carries a severity (critical / high / medium), an age timer, and a context summary. The SLA is respond-in-under-10-minutes; the queue is the 24/7 oncall surface for whichever admin is on. Review, reassign, and snooze-5m are the three actions; resolution writes a row on the audit chain.

EscalationsSLA · respond in <10 min · 24/7 oncall
  • Red flag · chest pain
    Patient SE-7K3M9 · routed to 112 + offered consult
    critical00:42
    Review
    Reassign
    Snooze 5m
  • Match timeout · 3 attempts
    Family Medicine · 0 doctors responded in 45s
    high01:18
    Review
    Reassign
    Snooze 5m
  • Payment hold · failed
    Hold #H-91K · idempotent retry exhausted
    medium03:54
    Review
    Reassign
    Snooze 5m
3 open
doorcta.fastclinic.xyz/admin/escalations
05 / 05

5 · Payouts · breakdown · coming 2026

The payouts breakdown is on the 2026 roadmap, shipping with the dedicated Provider Payouts service. The plan is per-doctor captured CREDITS for the period, the platform share carved out (12% of capture, audit-chained on apply), the net to the doctor, and a CSV export. Today the underlying data is in the FastCredits ledger as one row per captured consult; the dashboard surface that aggregates them into a finance-team-ready report is what 2026 unlocks. The mock is here so admins and finance can shape the surface before it ships.

Payouts · This weekMon–Sun · CREDITS
DoctorConsultsCapturedShareNet
Dr. Adesina Bello4232,6503,91828,732
Dr. Chiamaka Eze3121,4002,56818,832
Dr. Tunde Okafor1812,1501,45810,692
Platform share · 12% of capture · audit-chained on apply
Export CSV
Aggregated from FastCredits ledger · service-token auditable today
Coming 2026
doorcta.fastclinic.xyz/admin/payouts
What you get

Roster grid · verification gate, today

Pending → active → suspended state machine on every doctor under your practice. The matcher only routes to active. Onboarding flows include MDCN, Didit, liveness; suspension is one click and reflects in the pool query immediately.

Coverage timeline · gap detection, today

Per-doctor 1-hour shift visualisation across the day with explicit coverage-gap callouts. Reads from the same isOnline signal the matcher uses, so what you see is what the patient pool considers.

Throughput dashboard · SLA-tracking, today

Live active consults, queue depth, match p50/p95, decline rate. The under-30-seconds SLA is named, not implied; a breach surfaces as an escalations row.

Escalations queue · 24/7 oncall, today

Red flags, match timeouts, payment-hold failures. Severity-tagged, age-tracked, with review/reassign/snooze actions. The SLA is respond-in-under-10-minutes; resolution writes the audit chain.

Capabilities

AI base
  • Triage agent on Opus · single-shot classifier
  • Deterministic red-flag pre-check · runs before LLM
  • Triage invariant · urgency only increases
  • All AI calls audit-logged · input/output/tools/guardrails
  • Healthcare guardrails non-negotiable · no diagnosis, no Rx
  • Single import boundary · ai/base.ts is the only call site
Match state machine
  • DOCTOR_RESPONSE_TIMEOUT_MS = 15s · accept/decline window
  • PATIENT_CONFIRM_TIMEOUT_MS = 10s · confirm window
  • MAX_REASSIGNMENT_ATTEMPTS = 10 · ceiling on retries
  • Doctor pool gate · online + verified + capacity
  • Atomic claim · Redis SETNX with 20s TTL
  • 5-factor scorer · BASE_WEIGHTS tunable without redeploy
Cost & credits
  • CONSULTATION_COST = 1 credit · 1 credit = 1 naira
  • Hold at match start · capture at consult end
  • Release on cancel · release on match failure
  • Reference grammar · consultation:<id>
  • Idempotent retries · UNIQUE(account_id, reference)
  • Doubly-delivered webhooks converge on one debit
Records & PHI
  • Notes flow to OneHealth · POST /v1/records
  • Doorcta keeps no PHI · only the OneHealth record ID
  • Envelope encryption · per-record DEK + UUIDv5 AAD
  • Audit-chained on write · 7-year retention
  • Patient retrieves through OneHealth · single product surface
  • Provenance-tagged on prescription · MDCN signature
Realtime & video
  • Websocket gateway · per-app channel
  • Match events push · no polling
  • Daily.co video · per-session rooms + tokens
  • End-to-end encryption · regulated video provider
  • Chat over the same socket as match events
  • Connection-quality telemetry · admin throughput surface
Verification & compliance
  • MDCN registration verified · mdcn.gov.ng
  • Didit identity check · ID document + face match
  • Selfie liveness · prevent stolen-photo onboarding
  • Re-verify quarterly · suspend on registry change
  • NDPA 2023 compliant · controller Fastclinic Limited
  • African data residency · single Nigerian region

Integrations

Fastclinic
FastLogin

FastLogin is identity. Patient app and Doctor app are OAuth2/OIDC clients of FastLogin (the doorcta-mobile authorization-code-with-PKCE client) and the Doorcta server-to-server callers use the doorcta-server client_credentials grant. Tokens are 15-minute access plus 24-hour refresh with rotation; JWKS is cached for 5 minutes with a singleflight group on unknown-kid lookup. Doctor onboarding routes through FastLogin's KYC handoff (Didit identity-document verification + selfie liveness) before the doctor can flip to verificationStatus=active in the doctor pool. The middleware classifies tokens by client_id because Hydra 2.x stamps sub=client_id on client_credentials tokens.

Fastclinic
FastCredits

FastCredits is the credit ledger. Doorcta calls POST /v1/accounts/:id/hold at match start with the deterministic reference consultation:<id>, captures through POST /v1/holds/:id/capture at consult end, and releases through POST /v1/holds/:id/release on cancel or match failure. CONSULTATION_COST is 1 credit. The single-writer 409-is-success invariant applies: a 409 from a retry is a confirmation that the prior call succeeded and the response was lost, not an error to surface to the patient. The duration_seconds parameter is now honoured (post-OH-09 fix); Doorcta passes the consult's expected lifetime so the hold does not silently default to 10 minutes.

Fastclinic
OneHealth

OneHealth is the record store. Doctor consult notes and any prescription land via POST /v1/records — envelope-encrypted with a per-record DEK, AAD bound to a UUIDv5 derived from the record ID, audit-chained on write. Doorcta stores only the OneHealth record ID locally for the link-back; the body is OneHealth's. The architectural decision is that PHI lives in one product so a patient can retrieve it through one surface. The same record API is used by the doctor's prescription pad — a Sign + send to OneHealth call writes the prescription as a Provenance-tagged record bound to the consult.

External
Daily.co

Daily.co is the video provider. Each consult provisions a per-session room and a per-participant token through doorcta/server/src/video/daily.ts; the rooms are end-to-end encrypted; tokens expire with the consult. The architectural decision is to use a regulated video provider with E2E encryption rather than build a media server — Daily handles SFU, NAT traversal, codec negotiation, and the regulated-region routing that lets us keep the media path inside Africa. The Daily API call is the only routine cross-border edge in the Doorcta data flow; it carries metadata, never PHI.

Compliance & safety

NDPA 2023 — controller Fastclinic Limited (RC 1919428)

Doorcta processes the personal-data fields it needs to operate the consult — the FastLogin user identifier, the chat transcripts, the call metadata, the rating and free-text feedback — under NDPA 2023 §25 lawful bases. The data controller is Fastclinic Limited, RC 1919428, registered in Lagos. The data-processing record is updated alongside every release that touches a new dataset or a new processor. We do not claim NDPC processor registration; that filing is in progress. Clinical content (consult notes, prescriptions) is held by OneHealth under the same controller, not by Doorcta — the architectural separation matches the legal separation.

NDPA 2023
MDCN registration — verified before live pool

Doctors do not self-onboard into the live pool. The onboarding flow uploads the MDCN (Medical and Dental Council of Nigeria) registration number plus a government ID and a selfie liveness; the admin panel runs the manual checks against the MDCN public registry; only when the doctor's verificationStatus flips to active can they go online. Re-verification runs quarterly; suspension on registry-status change is enforced. The pool query gates on both isOnline=true and verificationStatus=active, so the matcher only ever surfaces a verified clinician.

MDCN public registry
Healthcare guardrails — no diagnosis, no prescription from AI

The AI base is a triage and red-flag-detection layer. It does not diagnose; it does not prescribe. Every agent registered in doorcta/server/src/ai/agents/ declares which guardrails apply to it, and the healthcare guardrails (no diagnosis, no prescription) are non-negotiable. Diagnosis and prescribing happen exclusively in the doctor's app, signed by an MDCN-licenced clinician. The deterministic red-flag pre-check runs before the LLM and forces an emergency escalation on a small set of keywords regardless of what the model says, so the AI cannot down-rank a true emergency.

Source — doorcta CLAUDE.md AI base
African data residency — single Nigerian region

Postgres, Redis, and the Daily.co video region all run in or close to a Nigerian-region AWS account that the Fastclinic Limited data controller operates. The chat messages live in the Doorcta database for the consult lifetime; clinical data flows to OneHealth at consult end. Cross-border transfer is limited to specifically-named processors under signed agreements (Daily.co for video media, Paystack for the FastCredits cash on-ramp). The architectural decision is a single residency posture across the ecosystem: the patient's data does not jump regions when they switch from the Doorcta app to OneHealth or to FastCredits.

Master spec — residency policy
Audit posture — every AI call, every match, every consult

Every AI base interaction is audit-logged: input, output, tool calls, guardrail flags, token usage. Every match-state transition is audit-logged through the state machine. Every consult is bracketed by startConsultation and endConsultation events with timestamps, doctorId, patientId, and the FastCredits hold reference. Doorcta itself does not hold PHI; the consult notes and any prescription audit-chain against OneHealth's hash-chained log on POST /v1/records. The 7-year retention applies to the OneHealth audit chain, which is where the clinical record of every consult is anchored.

OneHealth audit posture

Plain answers

Roster, coverage, throughput, escalations.

Run the doctor side of a Doorcta-enabled practice. The four operational surfaces (roster, coverage, throughput, escalations) ship today; the payouts breakdown ships in 2026 alongside Provider Payouts. Talk to us about onboarding the practice, the integration shape is locked.