Operational records
Booking statuses, audit events, policy decisions, payments, sessions, and notification deliveries are stored so webhooks and retries stay idempotent.
- Booking states track the difference between held, pending payment, confirmed, rescheduled, cancelled, and expired flows.
- Audit records support customer support review and replay-safe payment/notification behavior.
- The confirmation page reads booking state and token validity instead of trusting client-side state.
Temporary holds
Redis holds protect slots during checkout or booking creation and are intentionally temporary.
- Held slots expire automatically when checkout is not completed in time.
- A released hold lets the slot return to public availability if policy and availability still allow it.
- Confirmed bookings rely on durable booking records rather than temporary holds.
Payment references
Consulta stores payment references, amounts, currencies, statuses, checkout IDs, and webhook audit metadata needed to reconcile bookings.
- Card numbers, CVV, and banking credentials stay outside Consulta.
- Payment webhooks must be verified and idempotent before confirming paid sessions.
- Refund and dispute records depend on provider-specific status and final operating policy.
Notification records
Notification delivery records show whether the system attempted or sent client/consultant messages without exposing message secrets publicly.
- Records include channel, kind, recipient, status, timestamps, error summary, and provider reference where available.
- Dashboard summaries avoid exposing raw payloads, confirmation tokens, and Beam join links.
- SMTP and WOP delivery is live; approved workshop messages are active and optional workers keep contract-specific gates.
Video separation
Beam stores room references and join-token context. Consulta does not put consultancy notes or payment data inside Beam.
- Beam remains reusable for education and telemedicine skins because it has no consulting-specific state.
- Join links are tokenized and treated as sensitive access links.
- Room lifecycle evidence is tracked separately from booking/payment policy evidence.
Retention
Redis holds expire automatically. Longer booking, payment, notification, and room-reference records are retained for support, audit, refund, and recovery workflows.
- Exact production retention windows are not finalized in this MVP copy.
- Export and deletion request handling needs final operating procedure before broad self-serve launch.
- Provider-specific retention windows must be documented when live payment, notification, and email providers are connected.
Open policy work
Consulta keeps integration edges behind adapters so provider changes do not rewrite the booking state machine.
- Payments, notifications, and video each have their own integration boundary.
- Provider credentials are secrets and must only live in environment configuration.
- Policy pages must be updated when provider contracts or retention commitments become final.
