USE nirvaan;

/* Password reset tokens — hashed at rest, single use */
CREATE TABLE IF NOT EXISTS password_resets (
  id          BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  actor_type  ENUM('doctor','admin') NOT NULL,
  actor_id    INT UNSIGNED NOT NULL,
  email       VARCHAR(160) NOT NULL,
  token_hash  CHAR(64)     NOT NULL,
  expires_at  DATETIME     NOT NULL,
  used_at     DATETIME     NULL,
  ip          VARBINARY(16) NULL,
  created_at  DATETIME     NOT NULL DEFAULT CURRENT_TIMESTAMP,
  UNIQUE KEY uq_reset_token (token_hash),
  INDEX idx_reset_actor (actor_type, actor_id, used_at),
  INDEX idx_reset_email (email, created_at)
) ENGINE=InnoDB;

INSERT INTO settings (skey,sval,stype,sgroup,label) VALUES
 ('min_rate_paise','500','int','pricing','Lowest per-minute rate a doctor may set')
ON DUPLICATE KEY UPDATE label = VALUES(label);

/* ---------------- Legal and about pages ---------------- */
INSERT INTO cms_pages (slug,title,page_type,is_published,published_at,body_html) VALUES
('privacy','Privacy policy','legal',1,NOW(),
'<p><em>This is a working draft. Have it reviewed by a lawyer before you launch — it is not legal advice.</em></p>
<h2>What we collect</h2>
<ul>
<li><b>Your mobile number.</b> Used to sign you in and to bridge calls. It is never shown to a doctor.</li>
<li><b>A display name you choose.</b> This is what the doctor sees. It does not have to be your real name, and we do not ask for one.</li>
<li><b>What you tell a doctor.</b> Messages and consultation notes are encrypted in our database.</li>
<li><b>Payment records.</b> Amounts and references. Card details never touch our servers — our payment gateway handles them.</li>
</ul>
<h2>What the doctor can see</h2>
<p>Your display name, a reference code, your age band, city and the language you prefer. Not your name, not your number, not your email. If a doctor asks our team to unmask a patient for a clinical safety reason, the request and the reason are recorded and the access is logged.</p>
<h2>What we never do</h2>
<ul>
<li>We do not sell your data. Not to advertisers, not to pharmacies, not to insurers.</li>
<li>We do not name the health category in any SMS, email or bank statement.</li>
<li>We do not share your identity with a doctor unless you ask us to.</li>
</ul>
<h2>How long we keep things</h2>
<p>Medical records are retained as required for a registered practitioner to defend their clinical decisions. Payment records are kept for statutory accounting periods. You can ask us to delete everything else.</p>
<h2>Your choices</h2>
<p>Write to us to get a copy of your data, correct it, or ask for deletion. Deleting your account removes your profile and messages; it cannot remove a prescription already issued, since that is a medical record.</p>
<h2>Contact</h2>
<p>Email our grievance officer at the support address in the footer. We respond within the timelines set out in India&rsquo;s data protection rules.</p>'),

('terms','Terms of use','legal',1,NOW(),
'<p><em>This is a working draft. Have it reviewed by a lawyer before you launch.</em></p>
<h2>What this platform is</h2>
<p>We are a technology platform. We connect you with independent, verified medical practitioners and counsellors. We do not practise medicine, we do not employ the practitioners, and we do not guarantee any outcome.</p>
<h2>What a consultation is and is not</h2>
<p>Consultations happen under India&rsquo;s Telemedicine Practice Guidelines, 2020. A remote consultation cannot include a physical examination. Where a practitioner judges that one is needed, they will tell you to be seen in person, and that is the correct advice rather than a failure of the service.</p>
<p><b>This service is not for emergencies.</b> If you are in danger, in severe pain, or at risk of harming yourself, contact your nearest hospital or call Tele-MANAS on 14416.</p>
<h2>Money</h2>
<ul>
<li>Consultations are billed per minute from your wallet. You see the rate before you start.</li>
<li>The meter stops the moment either side ends the session. You pay only for minutes that began.</li>
<li>If a call fails to connect, the charge is reversed automatically.</li>
<li>Wallet balance does not expire. Refunds to the original payment method are at our discretion and are handled case by case.</li>
</ul>
<h2>Prescriptions</h2>
<p>Only a Registered Medical Practitioner may prescribe, and only within the drug lists permitted by the 2020 Guidelines. Some medicines cannot be prescribed remotely at all. A counsellor cannot prescribe anything.</p>
<h2>What we ask of you</h2>
<p>Be truthful about your symptoms, age and medication — a practitioner can only work with what you tell them. Do not record a consultation without consent. Do not use the platform to harass a practitioner; we will suspend accounts that do.</p>
<h2>Limits</h2>
<p>Our liability is limited to the amount you paid for the consultation in question. Nothing here limits liability that cannot be limited under Indian law.</p>'),

('about','About us','static',1,NOW(),
'<p>Most people in India who have a question about sexual health never ask it. Not because there is nowhere to go — there are clinics in every city — but because of the room. The waiting room, the receptionist, the form, the chance of being recognised.</p>
<p>That barrier is social, not medical. Social barriers can be designed away.</p>
<h2>How we did it</h2>
<p>You consult under a handle you choose. The doctor sees that handle and a reference code. Your name and number are hidden at the database level, not merely kept off the screen, and calls are bridged through our number so neither side receives the other&rsquo;s. Your bank statement shows a neutral descriptor.</p>
<h2>Who you are talking to</h2>
<p>Every practitioner is checked against their state medical council register before taking a single consultation. Profiles show qualification, registration status and years in practice. Nobody buys their way to the top of the list.</p>
<h2>What we will not do</h2>
<p>We will not promise cures. The law prohibits advertising them, and more to the point, no honest clinician would. We do not sell products off the back of a consultation, and we do not sell your data.</p>')
ON DUPLICATE KEY UPDATE title = VALUES(title);

INSERT INTO seo_meta (entity_type,entity_id,route,meta_title,meta_desc,robots,sitemap_priority,sitemap_freq) VALUES
 ('page',0,'/privacy','Privacy policy — Nirvaan','How we handle your data, what a doctor can see, and what we never do with it.','index,follow',0.3,'yearly'),
 ('page',0,'/terms','Terms of use — Nirvaan','What this platform is, how billing works, and the limits of a remote consultation.','index,follow',0.3,'yearly'),
 ('page',0,'/about','About Nirvaan','Why most people in India never ask a sexual health question, and how we removed the reason.','index,follow',0.6,'monthly'),
 ('page',0,'/doctors.php','Verified sexual health doctors and counsellors — Nirvaan','Browse every verified doctor and counsellor. Filter by gender, language and speciality.','index,follow',0.9,'daily')
ON DUPLICATE KEY UPDATE meta_title = VALUES(meta_title);