Overview:
Quetzalli Health & Wellness is the website for
Dr. Selene Q. López, PT, DPT — personalized pelvic health
physical therapy that puts patients first, with one-on-one
care in El Paso, TX and virtual pelvic health PT across
TX, NM, and IN. The site presents the practice's services,
approach, background, and frequently asked questions, and
closes the loop with a multi-tab evaluation form (in-person,
virtual, coaching, and general contact) backed by Supabase.
Key Achievements
-
Booking Platform:
Built a multi-tab evaluation form covering in-person,
virtual, coaching, and contact requests, validated
server-side and persisted to Postgres through a single
Supabase Edge Function.
-
Email Pipeline:
Designed a three-function pipeline where
submit-booking stores the request first, then
send-worker-email notifies the practice and
send-client-email confirms with the patient,
all sending through a Gmail service account.
-
Content Architecture:
Structured the site around reusable sections — hero,
services, how it works, FAQ, biography and education —
with a responsive, mobile-first layout built in
Tailwind CSS.
-
Practice Workflow:
Modeled a booking status vocabulary
(new, contacted, scheduled, in_treatment, closed,
not_relevant, spam) so the practice can track every
request from first contact through treatment.
Technical Architecture
-
Frontend:
Built a component-based single-page application with
React 18 and TypeScript, styled with Tailwind CSS and
compiled with Vite, organized into layout, home, and
contact component groups.
-
Backend & Database:
Used Supabase for the PostgreSQL database and TypeScript
Edge Functions, with a bookings table, updated_at
triggers, and schema migrations tracked in the repo.
-
Security Model:
Enabled Row Level Security with no policies at all, so
the browser can never read or write bookings directly;
the only public write path is the submit-booking Edge
Function using the service-role key server-side.
-
Email Delivery:
Shared a single Gmail transport and worker pipeline
across both email functions, keyed only by an
unguessable booking UUID so neither call needs a
credential of its own.
Engineering Challenges & Solutions
-
Protecting Patient Information:
Locked the database down so the browser never touches
bookings directly — RLS is enabled with no policies and
the tables are revoked from the anon role entirely, with
every write flowing through one server-side function.
-
Bot & Abuse Resistance:
Combined server-side validation, a hidden website
honeypot, and a SECURITY DEFINER rate-limiting helper in
the database to keep spam and flooding out of the
practice's inbox.
-
Data Loss Avoidance:
Inserted the booking row first and emails second, so a
Gmail outage can never lose a patient request — email
failures never roll back a booking, and a saved request
is always reported to the patient as a success.
-
Exactly-Once Emails:
Stamped each sent-at column only after Gmail accepted,
guarded with an is(..., null) check so retries
can never double-send, and answered already-sent calls
with a skipped status.
-
Secret Handling:
Kept the service-role key and Gmail service-account
credentials exclusively in Edge Function secrets; only
public, publishable VITE_ configuration is ever bundled
into the browser.
Results & Live Product
Quetzalli Health & Wellness is deployed in production at
quetzallihealth.com,
where patients explore services and request evaluations
online while the practice receives every submission in
Postgres and in email, with a clear status trail for
follow-up.
The project demonstrates my ability to build a
privacy-conscious, healthcare-adjacent product end to end,
combining front-end engineering, database-level security,
serverless functions, and reliable email delivery.