Add this line to your env file before deploying with real patient data:

PROVIDER_TOKEN=replace_this_with_a_long_random_string

If PROVIDER_TOKEN is not set, provider routes remain unprotected
(existing behaviour, safe for local dev and demos).
Generate a secure token with: python3 -c "import secrets; print(secrets.token_urlsafe(32))"