A clinic information app that collects nothing about its visitors
A patient-facing resource app built so it stores no cookies and tracks no individuals.
A working sample we built to show how we would solve a problem like this. It is not a delivered project.
In plain terms
This app gives clinic visitors resources, partner contacts and calendar files without recording who they are. It uses no cookies and no browser storage, and its address never changes. Usage is only counted by date. Every privacy rule has an automatic test that runs in a real browser.
- No cookies, no stored data in the visitor's browser.
- Visitors are counted per day, never as individuals.
- Download links expire after 60 seconds.
- Tests deliberately break the app to prove the privacy checks catch it.
What this does not claim: Runs on demo data in this version. Connecting it to a real database is a planned change to one file and has not been done here.
Technical details
Next.js App Router with a server-only data layer (src/lib/store.ts); the browser never talks to the database. Middleware issues a per-request CSP nonce; next.config sets Referrer-Policy no-referrer, HSTS, frame protection, nosniff, Permissions-Policy and noindex. POST-only endpoints for taps, feedback, tickets and partner contact, with bot detection and hashed in-memory rate limiting. Ticketed files expire after 60 s; redirects are never logged. test_privacy.py drives the production build in real Chrome; mutation_check.py breaks the app one way at a time and confirms the tests fail.
- Next.js 15
- TypeScript
- Content-Security-Policy nonces
- Python test harness
- Supabase (planned)
Need something like this?
Tell us the problem in your own words. We reply with a plain, practical plan.
Discuss a project like this