Clinical and patient software, built for the compliance review
Products handling health data, where access control and retention are design inputs rather than a later hardening pass.
What this domain does to the build
The stack is broadly the same everywhere. These are the parts that are not, and they are usually where an estimate goes wrong.
- Patient data has legal retention and access rules that shape the schema, not just the permissions
- Access must be role-scoped and logged — who read what, and when, is itself a requirement
- Integrations are with systems you do not control and cannot change
- Downtime has a different cost when clinicians are mid-consultation
What we typically build here
- Role-based access with full audit logging
- Consent, retention and data-deletion flows
- Third-party clinical system integration
- Security and authorisation review
Your sector not listed?
The constraints are usually recognisable even when the domain is new to us. Describe them and we will say honestly whether we are the right team.