Payments

Vault records the payments a hospital takes through Pensieve, from cash at the counter to online payments through the payment gateway on the hospital's own merchant account. This page lists the counter methods, follows an online payment from gateway order to receipt, and sets out refunds and how the gateway is configured.

What flows

Counter payments are recorded inside Vault, and online payments run between Vault, the gateway and the checkout page the biller opens for the patient. Razorpay is the integrated gateway, reached from the platform through a provider adapter of its own.

A payer's settlement of a claim reaches Vault as remittance advice and is entered as an insurance settlement, as insurers and claims describes.

At the counter

A counter payment is a payment that staff confirm and enter by hand. Vault records it against the invoice or the account it settles, with its method and reference, and posts the receipt in the same step.

Counter payments run apart from the gateway, so the counter keeps taking them while the gateway is unreachable or before it is set up for the site. The card machine and the UPI QR code at the counter are the hospital's own and stand outside Pensieve, so the cashier enters each of their payments by reference, following take a payment.

An online payment

Each online attempt is a collection: a payment against an invoice or a deposit, held as pending until it is confirmed or closes as failed. The patient pays it on the gateway's hosted checkout.

1. 1

   Vault opens the collection

   The biller chooses the online method. Vault first confirms that no other collection on the invoice is pending, then opens this one, held for fifteen minutes.

2. 2

   The gateway order is created

   Vault creates the gateway order for the amount in rupees, carrying the site, the finance account and the invoice it settles. The gateway's record of the payment then points back to that invoice. Vault uses the invoice receipt as the gateway order's idempotency key, so a repeated request returns the same order.

3. 3

   The patient pays on the hosted checkout

   The checkout opens on the gateway's own page, where the patient pays by card, UPI or bank transfer.

4. 4

   The notification is verified

   The gateway sends a signed notification. Vault verifies the HMAC-SHA256 signature over the raw body before it reads a field. A forged or altered notification fails that check and is turned away before any record changes. The site is taken from the secret that verified the signature, never from the notification's content.

5. 5

   The payment is recorded once

   Vault matches the notification to the pending collection by the gateway's order identifier. A captured payment completes: the receipt posts against its invoice under the rules in invoices and credit notes, and the invoice moves to partly paid or paid in the same transaction. A failed one closes as failed. A notification sent again is recognised by the gateway's payment identifier and leaves the payment as recorded.

The pending hold

While an online collection is pending, Vault refuses a second payment on the same invoice, at the counter as well as online. A collection still unconfirmed when the hold ends closes as failed, and the invoice is open for payment again.

A failed attempt stays failed, and a later attempt is recorded as a new payment, so the account keeps the history of every attempt.

Refunds

An online payment is refunded through the gateway, in full or in part, and each refund request carries an idempotency key of its own, so a repeated request returns the same refund. Every refund names its reason from a fixed list, and the gateway reports it processed or failed.

Money returned at the counter is entered as a fresh outflow against the receipt. A refund above the desk threshold, by either route, waits for a second person's approval under approval and second signature.

Configuring the gateway

The merchant account behind every online collection is the hospital's own. In Westron, the gateway connection holds references to the merchant account's API key pair and to the secret the gateway signs its notifications with.

The online option goes live for a site only once a second person approves the switch. How these credentials are kept and rotated is set out in authentication between systems.

Common confusions

Read how each receipt moves an account's balance in deposits and payments, and what each exchange guarantees in delivery guarantees.