Authentic Apothecary Website
A functional medicine practice site built around a portal route the practice owns rather than its software vendor, and an enquiry form deliberately designed not to collect health information.
Authentic Apothecary is a functional medicine and compounding practice. The site introduces the practice, explains genetic testing and compounded care, lists the conditions it works with, gives referring providers their own page, and puts patients one click from the portal. It is server-rendered ASP.NET Core MVC on .NET 9, with no front-end framework and no build step beyond the .NET SDK.
The practice's electronic medical records system is being built by another vendor and had no address yet, which would normally mean waiting. Instead the site was written to work in both states and flip between them with one configuration value and a restart. Until the portal exists, /patient-portal explains that it is on its way; once the address is set, the same route sends patients straight to it.
That route is the practice's own on purpose. It can be printed on business cards and after-visit paperwork today, it keeps working when the portal launches, and it keeps working again if the vendor is ever replaced, because printed URLs outlive software contracts. The hand-off is a temporary redirect rather than a permanent one for the same reason: browsers cache a permanent redirect indefinitely, which would strand every patient who had followed the old link once. The address from configuration must be absolute and secure before it is used, so a mistyped or hostile value leaves the portal quietly unavailable instead of putting a broken or dangerous link in front of patients.
The enquiry form takes a name, a way to reply, whether the sender is a patient or a provider, and a short note. It deliberately collects no health information: a website form arrives as ordinary email, landing in whatever inbox and backup sits behind that address, with none of the protections clinical data requires. Clinical detail belongs in the medical records system. Behind the form are an anti-forgery token, server-side validation, a server-side honeypot and per-IP rate limiting, and mail delivery sits behind a single interface so the sending route can change later without touching the form. If delivery is not configured or fails, the visitor is told plainly and given the practice's address, because reporting success for a message that reached nobody leaves someone waiting on a reply that is never coming.
The palette and typography come from the practice's own printed material: cream, deep forest green, sage and gold, with classical serif headings. The two gold tones were re-derived by measuring contrast rather than matching by eye, because they carry text small enough that the usual large-text allowance does not apply. The design is typographic and botanical rather than photographic, so the layouts are complete today instead of holding empty slots for photography that may never arrive.
Highlights
Vendor-independent portal route
The practice owns the address patients type, so printed cards keep working if the software vendor changes.
Configuration-driven cutover
One setting flips the patient portal from "coming soon" to live, with no code change or redeploy.
Validated external links
The portal address must be absolute and secure, so a bad value stays inert instead of shipping a broken or hostile link.
No health information by design
The enquiry form takes a name, a reply address and a short note; clinical detail belongs in the medical record.
Layered form protection
Anti-forgery tokens, server-side validation, a server-side honeypot and per-IP rate limiting.
Honest failure
If mail is unconfigured or delivery fails, the visitor is told and given the practice address rather than a false success.
Swappable mail delivery
Sending sits behind one interface, so the mail route can change without touching the form or its protections.
Privacy-aware logging
Failure and rate-limit logs record who wrote in, never what they wrote.
Contrast-audited palette
Brand colours re-derived by measurement to stay legible at the small sizes they actually carry.
Typographic design system
Botanical vector motifs and colour blocks instead of stock photography, so nothing waits on a photo shoot.
Tuned caching
Fingerprinted assets cached for a year and images for 30 days, while pages themselves are never cached.
Search and share ready
Clean canonical routes, sitemap, robots and structured data, with a raster social card for platforms that cannot render vector previews.