For Stakeholders

Why this matters, what it's worth, and where the risk sits. Written for decision-makers.

The strategic case

The CRM module moves Dentolize up the value chain — from running a clinic to growing one. Until now, Dentolize managed operations (appointments, invoicing, records) but was blind to acquisition: where patients come from and what they cost. This module makes acquisition measurable and automatable inside the product, which:

• Deepens the moat. A clinic that runs its ads, inbox, follow-up, and ROI through Dentolize

is far harder to displace than one that only bills through it.

• Creates an upsell tier. Integrations, marketing analytics, and automation are natural

premium capabilities.

• Fits the region. Phone dedupe with Arabic-Indic numerals, WhatsApp-first messaging, and

multi-branch support are built for the Middle East dental market Dentolize serves.

What it actually delivers

A closed loop — ad spend → lead → conversation → patient → revenue → ROI — with five capabilities: social/ad integrations, a unified multi-channel inbox with SLAs, a marketing hub with revenue-based ROI, an automation engine, and WhatsApp-based reviews. Each is independently feature-flagged, so rollout can be staged per capability and per clinic.

Engineering quality signals (verified in code)

• Durable, idempotent ingestion. Every inbound webhook is signature-verified, persisted to

a replayable inbox, and processed asynchronously; redeliveries collapse on database unique keys. This is the right architecture for third-party integrations that will misbehave.

• Security by construction. AES-256-GCM encryption for platform tokens with key rotation,

tokens never exposed via the API, tenant routing never derived from attacker-controlled input, and automatic 90-day PII redaction of raw logs.

• Self-healing operations. Nightly reconciliation catches leads that webhooks missed and

repairs counter drift (reporting anomalies to Sentry). Runbooks are documented (docs/crm-runbooks.md).

• Verified incrementally. The PR reports each of 28 slices was E2E-verified against a

purpose-built platform-mock, so integration flows are testable without live platform apps.

Risks & what to watch

• Scope on the label. The PR is titled "CRM" but also contains a large, separate

accounting module (~10k LOC + ~54 mobile screens) not mentioned in its description. This is a review/traceability risk more than a technical one — the two should be understood as distinct deliverables. See Scope, Gaps & Honest Notes.

• One unverified claim. The "~1,266 req/s" burst-test figure has **no benchmark artifact in

the repo**. Don't cite it externally until it's reproduced and published.

• Web/mobile flag asymmetry. Web gates all CRM behind feature flags; mobile does not.

Confirm this is intended before GA, or a beta clinic could see CRM on phones prematurely.

• Third-party dependency & approvals. Meta/TikTok/Snapchat/Google **business verification

and Advanced Access reviews** gate go-live (weeks of lead time; Google Business Profile is the slowest). Only Meta is live today; the rest are built but await approval + a real-credential smoke test.

• Data migration in flight. The Lead→Patient field cutover is done in code but the

physical column drop is deferred to a post-soak follow-up PR (protected by a CI tripwire).

Compliance posture

Personal data (names, phones, message text) lands in the webhook inbox and is auto-redacted after 90 days, deleted after a year — a concrete retention control aligned with GDPR/PDPL expectations. Meta's required Data Deletion callback is implemented.

Recommended rollout

Stage it: enable Meta + inbox + automation for a handful of verified beta clinics first; withhold public performance claims; complete platform approvals before widening; resolve the web/mobile flag asymmetry and confirm accounting-module scope before GA. The architecture supports a careful, per-capability, per-tenant rollout — use that.