Cursor Rules Template: Physiotherapy Treatment Progress Summary App

Overview


Cursor rules configuration for building a physiotherapy treatment progress summary app with Cursor AI. This template targets a Next.js + TypeScript frontend, a Node.js API, and a PostgreSQL database, providing policy-driven guidance for data models, privacy, authentication, and clinician-focused summaries in a clinical workflow.


Direct summary: This Cursor Rules Template encodes stack-specific rules for architecture, security, and data handling so AI-assisted development remains safe and auditable in a physiotherapy clinic context.



When to Use These Cursor Rules



  - When building patient progress dashboards that clinicians can read during sessions.

  - When auto-generating progress notes from structured session data with enforced privacy constraints.

  - When you need RBAC checks to restrict access to PII and clinical data.

  - When aiming for auditable data flows and reproducible builds in healthcare software.



Copyable .cursorrules Configuration


Framework: Next.js + TypeScript
Context: You are a software engineer building a physiotherapy treatment progress summary app. The app stores patient data in PostgreSQL with tables patients, sessions, progress_entries. You must ensure privacy, audit logs, and clinician workflows. Cursor AI should enforce stack-specific rules while assisting engineering tasks.
Role: Developer Assistant for Cursor AI in a physiotherapy clinic stack
CodeStyle: TypeScript strict, ESLint + Prettier, commit message guidelines
Architecture: Monorepo with apps/web (Next.js UI), apps/api (Node.js API), libs/db (PostgreSQL access), libs/auth (OAuth/JWT utilities), libs/ui (shared components)
Authentication: JWT-based sessions; OAuth2 for clinicians or clinic staff
Database & ORM patterns: PostgreSQL with normalized schema; use foreign keys; avoid storing PII in logs; use prepared statements
Testing & Linting Workflows: Jest for unit tests, Playwright for end-to-end tests; GitHub Actions CI with lint/test steps
Prohibited Actions and Anti-patterns: Do not bypass auth; Do not log PII; Do not call external APIs with patient data without consent; Do not store raw patient data in production logs; Do not use client-side data as the sole source of truth
Anti-patterns: Avoid client-only data fetching for protected data; Avoid dynamic SQL without parameterization
Notes: Cursor tokens should not generate or reveal clinical diagnoses without clinician confirmation.

Recommended Project Structure


apps/
  web/       # Next.js frontend for physiotherapy clinics
  api/       # Node.js API backend for clinical data and auth
libs/
  db/        # PostgreSQL data access and query helpers
  auth/      # JWT/OAuth utilities and middleware
  ui/        # Shared UI components and forms
scripts/
tests/

Core Engineering Principles



  - Data privacy by design: restrict access to PII and audit data.

  - Strong typing and explicit contracts across API surfaces and data models.

  - Defense in depth: layered authentication, authorization, and input validation.

  - Observability: structured logging with redaction and end-to-end testing.

  - Deterministic builds and reproducible deployments via a monorepo structure.

  - Safe AI-assisted development: guardrails, validation, and audit trails for AI outputs.



Code Construction Rules



  - Use TypeScript types for all request/response shapes and DTOs.

  - All database writes must occur inside a transaction with error handling.

  - Use parameterized queries to prevent SQL injection and enforce schema boundaries.

  - Model patient progress with clear tables: patients, sessions, progress_entries, with proper FK relationships.

  - Endpoints enforce RBAC by role (clinician, admin, support) before data access.

  - Logs must redact PII and rely on IDs, not raw patient data, for traceability.

  - Environment-specific configuration via secrets manager; never hard-code credentials.

  - Testing: unit tests for domain logic, integration tests for DB access, and E2E tests for clinician workflows.

  - Do not embed private keys, tokens, or credentials in code or the .cursorrules block.



Security and Production Rules



  - Transport: TLS everywhere; enforce secure cookies and CSRF protection where applicable.

  - Auth: short-lived access tokens, refresh tokens, and periodic rotation; protect API routes with RBAC.

  - Data protection: encrypt sensitive data at rest; minimize exposure of PII in logs and UI.

  - Observability: centralized logging with redaction and audit trails for data access events.

  - Deployment: feature flags for safe rollout, immutable builds, and blue/green deployments.

  - Secrets: store in a dedicated secrets manager; never commit secrets to VCS.



Testing Checklist



  - Unit tests for domain rules and data validation.

  - Integration tests for API endpoints and DB transactions.

  - End-to-end tests simulating clinician workflows with Playwright.

  - Static analysis and type checks in CI; linting with Prettier.

  - Security tests for auth, RBAC, and data redaction in logs.

  - Performance checks on common queries for patient progress data.



Common Mistakes to Avoid



  - Assuming client-side code is enough for protecting patient data.

  - Storing raw PII in logs or analysis outputs.

  - Skipping authorization checks on API endpoints.

  - Hard-coding secrets or connecting to external services without consent.

  - Over-fetching patient data or bypassing pagination and filtering.



Related implementation resources: AI Use Case for Medical Practices Using Outlook To Prioritize Urgent Patient Emails Over Routine Inquiries and Why authorization checks belong in AI coding instructions for production-grade systems.





FAQ


What is a Cursor Rules Template for physiotherapy apps?


A Cursor Rules Template is a copyable .cursorrules configuration that instructs Cursor AI on how to operate within a physiotherapy treatment progress summary app, including data models, privacy constraints, and integration patterns.


Which stack does this template cover?


It targets a Next.js + TypeScript frontend, a Node.js API, PostgreSQL database, and Cursor AI integration, with clear authentication, data models, and testing workflows.


How do I use the .cursorrules block?


Copy the provided block into a file named .cursorrules at your project root. Cursor AI reads the block to enforce stack-specific rules during content generation and coding tasks.


How does this template handle patient data privacy?


Rules enforce role-based access, data minimization, audit trails, and redaction patterns. The configuration prohibits exposing PII in logs or outputs and requires secure data handling.


Can I customize for other stacks?


Yes. Modify the Framework Context, Architecture rules, and database patterns in the header of the .cursorrules file to fit your stack while maintaining Cursor safety guidelines.