MindFlow is built as an open platform. Every integration uses configurable credentials stored securely in the platform settings, nothing is hardcoded. All outbound calls to external services are logged, and all inbound webhook events are cryptographically verified before processing.
Connection uses the standard Google OAuth2 flow, no passwords are shared. Tokens are stored per clinician and refreshed automatically before expiry. Appointments sync in both directions: changes in either system are reflected in the other within seconds.
For clinics using Cal.com as their primary public booking page. Connection uses Cal.com's OAuth flow and per-user credentials. Blocked slots from Cal.com are reflected in MindFlow availability, and vice versa, so double-booking is prevented regardless of where the appointment is made.
When calculating available slots, the system combines availability from all connected sources in a single query. A slot only shows as available if it is free in all of them simultaneously, there is no polling delay or eventual-consistency lag between systems.
Credentials (Account SID, Auth Token, sender number) are stored in settings and used server-side. No Twilio credentials are exposed to the browser. Delivery status callbacks from Twilio update the message log automatically when configured.
Provider-agnostic, supports Twilio, D7, or any provider with a WhatsApp Business API endpoint. Message templates must be approved by Meta before use. All outbound calls are made server-side; no credentials reach the browser.
A Telegram bot is configured via a bot token stored in settings. Patients opt in by starting the bot from a secure link. Document delivery (prescriptions, lab reports, invoices as PDFs) is the primary use case.
Server-to-Server OAuth, no individual Zoom user account is required. Sessions are created via the Zoom API and managed through webhook events. All webhook events are HMAC-verified before processing.
Used for session recording transcription and voice prescription (VoxRx). Sarvam AI supports major Indian languages alongside English, Hindi, Punjabi, Tamil, Telugu, Kannada, Malayalam. All audio is sent over HTTPS. A local Whisper-based transcription fallback is available for environments without external network access.
Any OpenAI-compatible endpoint can be used. The system supports a priority chain of providers, if the first fails, the next is tried automatically. Both hoster-supplied credits (plan-included) and clinic-configured keys (bring-your-own) are supported.
Scanned lab report images (JPEG, PNG, PDF) uploaded by patients or staff are processed through OCR.space to extract text. This allows paper lab results to be digitised without manual re-entry. A rate-limited public key is used as a fallback if no paid key is configured, so the feature works out of the box at low volume.
Diagnosis code lookup is powered by the official WHO ICD-11 API using authenticated calls (OAuth2 client credentials). Responses are cached locally to keep search fast during consultations. The API can be called using a hoster-supplied client ID/secret or the clinic's own credentials.
Card, UPI, and net banking payments via PayU's redirect flow. The patient is sent to PayU's secure hosted payment page and returned to the application on completion. Asynchronous payment confirmation arrives via signed webhook, the signature is verified before the payment is applied.
International card and PayPal wallet payments via PayPal's redirect checkout. The callback from PayPal is handled server-side and verified before the payment is recorded.
Physical orders are shipped via Shiprocket. Shipment creation, AWB assignment, and tracking updates all flow through the Shiprocket API. Tracking status updates are received via webhook and shown to the patient in their portal.
The store's product image picker can search Unsplash for stock photos. Calls are made server-side using a configured API key, Unsplash is never called directly from the patient's browser. A hoster-supplied key can be included in the plan.
A REST/JSON API allows external systems to read patient records, appointments, and billing data. All calls require an API key stored in settings. Calls are logged with endpoint, method, response code, and latency. Rate limits are configurable per key.
Plugins extend the platform through a defined hook system. Each plugin declares its capabilities in a manifest. Plugins can add navigation items, API handlers, and scheduled tasks. Plugins cannot override core permission checks or access data outside the defined hook interface.
All inbound webhooks (PayU, Shiprocket, Zoom, Telegram) follow the same security pattern: verify the cryptographic signature or token, log the raw payload, parse and apply the update, return an immediate 200 acknowledgement. Processing is fast and synchronous to avoid gateway retries.
The demo comes pre-loaded with real sample data, so you can click through actual appointments, patients and prescriptions.