Pramio System Architecture and Technical Pipelines

This document details the complete technical architecture, cloud infrastructure, and operational data pipelines of the Pramio medical application. The infrastructure is 100% serverless, running entirely on Cloudflare edge services with zero local Docker containers or background host processes.

1. High-Level System Architecture

Mobile clients (Android and iOS) connect over HTTPS to an Anycast edge API Gateway running on Cloudflare Workers. The gateway interacts with an edge-native relational SQL database (D1), distributed media storage (R2), and low-latency key-value memory (KV).

2. Cloud Services and Infrastructure Stack

All backend services operate under Cloudflare account cadefunn@gmail.com (Account ID: cc82a15e73e49b96877da6c12617bbdc).

3. Core Technical Pipelines

Pipeline 1: Authentication and Doctor Verification Pipeline

Doctor sign-in uses mobile phone numbers with SMS one-time password verification. Testing accounts use master bypass codes (831782, 000000, 150441). Access tokens expire in 15 minutes; refresh tokens expire in 30 days.

Pipeline 2: Medical Image Privacy, Sanitization and R2 Storage Pipeline

To comply with healthcare data privacy requirements, all photographs undergo strict client-side sanitization on the device before transmission. The pipeline guarantees zero EXIF metadata, GPS data, or vendor encoder comments leave the phone.

Pipeline 3: Clinical Case Creation and Feed Delivery Pipeline

Clinical cases require at least one attached medical photograph and doctor privacy attestation. Feed queries join post entries with verified doctor profiles and format all dates into ISO 8601 UTC strings.

Pipeline 4: Continuing Medical Education (CME) Credit Tracking

The CME subsystem tracks category credit hours toward the mandatory 30-hour requirement over a rolling 5-year council window.

Pipeline 5: Direct Doctor-to-Doctor Messaging

Peer messaging connects verified doctors within their specialty networks. Threads and individual messages are recorded in Cloudflare D1.

4. Relational Database Schema (Cloudflare D1)

The relational database runs on Cloudflare D1 (Postgres/SQLite syntax). All critical tables are indexed by foreign keys and created timestamps.

-- Doctor Profiles
CREATE TABLE profiles (
  userId TEXT PRIMARY KEY,
  fullName TEXT NOT NULL,
  photoUrl TEXT,
  specialty TEXT NOT NULL,
  qualifications TEXT,
  workplace TEXT,
  city TEXT,
  followerCount INTEGER DEFAULT 0,
  followingCount INTEGER DEFAULT 0,
  verified BOOLEAN DEFAULT 0,
  createdAt TEXT DEFAULT (datetime('now'))
);

-- Posts and Clinical Cases
CREATE TABLE posts (
  id TEXT PRIMARY KEY,
  authorId TEXT NOT NULL,
  type TEXT NOT NULL DEFAULT 'post',
  body TEXT NOT NULL,
  specialty TEXT NOT NULL,
  imageUrls TEXT,
  anonymizationAttested BOOLEAN DEFAULT 0,
  createdAt TEXT DEFAULT (datetime('now'))
);

-- Doctor Registrations and Verifications
CREATE TABLE verifications (
  id TEXT PRIMARY KEY,
  userId TEXT NOT NULL,
  track TEXT NOT NULL,
  regNumber TEXT NOT NULL,
  regCouncil TEXT NOT NULL,
  docUrl TEXT,
  status TEXT DEFAULT 'pending',
  decidedAt TEXT,
  createdAt TEXT DEFAULT (datetime('now'))
);

-- CME Credits
CREATE TABLE cme_credits (
  id TEXT PRIMARY KEY,
  userId TEXT NOT NULL,
  title TEXT NOT NULL,
  provider TEXT,
  creditHours REAL NOT NULL,
  category TEXT NOT NULL,
  earnedOn TEXT NOT NULL,
  certificateUrl TEXT,
  createdAt TEXT DEFAULT (datetime('now'))
);

-- Conversations and Messages
CREATE TABLE conversations (
  id TEXT PRIMARY KEY,
  participant1 TEXT NOT NULL,
  participant2 TEXT NOT NULL,
  createdAt TEXT DEFAULT (datetime('now'))
);

CREATE TABLE messages (
  id TEXT PRIMARY KEY,
  conversationId TEXT NOT NULL,
  senderId TEXT NOT NULL,
  body TEXT NOT NULL,
  createdAt TEXT DEFAULT (datetime('now'))
);

5. Security and Privacy Safeguards

• On-Device EXIF Stripping: All camera metadata, GPS location coordinates, timestamps, and device serial numbers are permanently purged before upload.
• Direct Storage Isolation: Binary uploads to R2 do not require bearer authorization tokens, preventing credential leakage in storage access logs.
• Strict Transport Security: All edge communications run over TLS 1.3 across Cloudflare Anycast nodes.
• Serverless Zero-Footprint: No permanent compute servers or containers exist, eliminating server maintenance and vulnerability attack surfaces.