Connect an approved clinic account
OAuth routes are designed to link a clinic-controlled provider account using signed, time-limited, one-time state.
Keep a virtual visit connected to the clinic workflow around it
ClinicPro360 includes a telehealth workflow that relates account authorization, meeting creation, attendee access, appointment context, patient consent, and session follow-up. Production Zoom infrastructure is not yet activated or proven.
Launch boundary
Telehealth is implemented in source, not activated for production use
The current code contains Zoom OAuth, Meeting SDK, signature, webhook, replay, consent, and room-flow controls with focused local tests. ClinicPro360 still needs entirely new provider applications and credentials, approved agreements and policy, production configuration, and real end-to-end session evidence before this capability can be offered.
Connected lifecycle
Treat the virtual room as one step in a broader visit
Create the meeting from clinic context
Meeting creation belongs to the appointment and authorized clinic workflow rather than an untracked standalone link.
Resolve attendee access
Staff and patient room routes obtain meeting context and require a valid SDK signature before entry.
Return status to the application
Webhook validation and replay-handling paths support provider events returning to ClinicPro360 without treating every request as trusted.
Source controls
Make authorization and failure behavior explicit
Signed, one-time OAuth state
The current source signs provider authorization state, applies a short lifetime, and uses one-time Redis-backed claim/completion behavior in production mode.
Validated provider callbacks
Webhook paths include provider-contract signature validation, URL-validation handling, and replay checks.
Fail-closed room entry
Attendee entry is designed to stop when a valid meeting signature cannot be obtained rather than substituting a demo credential.
Production evidence
What must exist before a clinic relies on the workflow
Independent provider ownership
Brand-new ClinicPro360 provider apps, credentials, webhooks, account ownership, and access governance must be documented.
End-to-end acceptance
Account linking, create/join/end behavior, consent, failure recovery, revocation, and callback replay need real staging evidence.
Policy and patient communication
Practices need approved consent, privacy, contingency, support, and incident procedures before enabled clinical use.
Continue exploring
Review the entire virtual-visit lifecycle
A responsible evaluation covers account ownership, appointment creation, patient entry, clinician entry, failure behavior, consent, callbacks, and follow-up—not just the video room.