# Project Continuity Snapshot: Consultation App

## 1. Context & Objective
*   **Project:** Nutritionist Consultation App.
*   **Objective:** Hardening security and achieving DPDP Act 2023 compliance.
*   **Current Branch:** `development`.
*   **Status:** Groups 1-20 are 100% complete and verified on localhost, staging, and production; code pushed to remote.

## 2. Technical Environment
*   **Stack:** Node.js (ESM), Express, MySQL.
*   **Hosting:** Shared environment (Hostripples).
*   **Security Limitation:** Encryption-at-rest (AES-256) is NOT supported/active on the current hosting plan (documented in `ENCRYPTION_LOG.md`).

## 3. Key Implementations (Groups 11-20)
*   **Hard Delete (Right to Erasure):** Replaced soft-delete with permanent physical erasure of users and all associated medical data (consultations, food plans, reports).
*   **Log Retention:** `cleanup_old_logs.mjs` deletes files in `logs/` older than 365 days.
*   **Inactive Cleanup:** `inactive_user_cleanup.mjs` permanently erases users inactive for >24 months after a 48h warning.
*   **Automation:** Both cleanup scripts are integrated into `server.mjs` using `setInterval` (24h).
*   **Database:** Migrations for `users_v2` columns (consent, DOB, last_login, deleted, etc.) are in the `sql/` folder.
*   **Database Backup:** Implemented an admin-only database backup feature with cross-platform path handling and custom filename generation, restricted to a specific admin email.

## 4. Documentation Audit Trail
*   `COMPLIANCE_AUDIT.md`: Master checklist of all 20 groups.
*   `DATA_MAPPING.md`: Inventory with "Legal Basis" (Affirmative Consent).
*   `BACKUP_LOG.md` & `BACKUP_SECURITY_LOG.md`: Host-confirmed weekly remote backups.
*   `BREACH_RESPONSE.md`: 72-hour notification protocol.

## 5. Pending Next Step
*   All security-migration tasks for this portal are complete and verified across all environments.