Pablo Zarate
All projects

Clínica de mama · WhatsApp CRM

A tiny CRM that confirms every appointment on WhatsApp, automatically.

Client
Clínica de mama · internal tool for reception staff
Role
Freelance · Architecture & development
Year
2026
Status
In production
WhatsApp booking confirmations and delivery status
A broadcast in progress
A broadcast in progress
Imported patient list with message status
Imported patient list with message status
Broadcasts overview
Broadcasts overview
≤5 min
from booking to WhatsApp
~$0.009
per message
0
phone numbers in logs

The story

Reception needed every patient who booked online to get a confirmation right away, and a safe way to reach thousands of past patients when the clinic moved to its new address.

The automation is a dependency-free AWS Lambda on a five-minute EventBridge schedule. It reads new bookings from Google Calendar with a read-only service account and sends an approved WhatsApp template with the date, a location header and buttons for directions and reception. Failed sends are retried and nothing is sent twice. Meta’s webhooks report delivered, read, failed and opt-out replies, each request verified by signature.

The panel is a small Hono app in a hardened Docker container. Staff import CSV exports from Excel, review an analysis before anything is saved, and launch broadcasts that send in capped batches, pause on errors and resume where they stopped. Patients who reply BAJA are excluded forever.

Privacy shaped the design: the system keeps as little patient data as it can, logs carry no names or phone numbers, and every staff action lands in an audit log.

Engineering highlights

01

Booking → WhatsApp in minutes

Google Calendar to Lambda to WhatsApp Cloud API with idempotent sends, retries and a CloudWatch alarm that emails on failure.

02

Broadcast engine

Batches every five minutes under a daily cap, pause/resume, per-recipient status and permanent opt-out handling.

03

Forgiving CSV import

Handles UTF-8 and Excel’s Windows encoding, auto-detects columns, merges duplicates and supports ARCO deletion requests.

04

Locked-down access

Invite-only accounts with two-step sign-in, two roles, and layered protection against abuse on a hardened deployment.

05

Least-privilege AWS

Infrastructure as code in CloudFormation, each piece given only the permissions it needs, and secrets kept out of the code.

Next project
TSG Transportes
A bilingual site for a freight carrier in northern Mexico.