A patient triage app, NHS-bound, founded in 2023. Eight thousand patients onboarded in the first quarter through a pilot in three South London GP practices. Built fast on Firebase. The demo was sharp and the clinicians liked it.
Industry Healthtech development · NHS DSPT-aware · DCB0129-aware · UK
Healthtech development, built to the clinical. safety baseline, not the demo.
Healthtech development for UK founders, NHS partners and B2B clinical teams. We build patient apps, clinician copilots and clinical workflow platforms with UK GDPR + NHS DSPT alignment, a DCB0129 clinical safety baseline, MHRA SaMD readiness and role-scoped clinical access — written to the question your assurance team and your acquirer’s CTO will both ask.
24hreply, from a senior
200+projects shipped since 2019
Senioronly, on the spine
Why UK healthtech founders sign
You build for the patient. We build for the patient, the regulator, and the acquirer at once.
DSPT compliant software development isn’t a pack you assemble the week before an assurance review. It’s a set of decisions you make in week one, or pay six months to retrofit. We make them in week one.
“The DSPT evidence pack was the document that reinstated our pilot. The assurance team read it and stopped asking.”
001
4
UK healthtech platforms shipped to production since 2019.
002
0
Patient-data leaks, double-entries, or customer-data breaches in production.
003
4
DCB0129-baseline clinical safety cases drafted on the back of our builds.
The founder this page is forPilot paused · 6 quiet weeks · 42 practices
Ayesha founded a UK triage app. The product worked. The assurance didn’t pass.
Then NHS England’s assurance team sent the DSPT pre-assessment. No role-scoping. No clinical safety case. No documented clinician hand-off. No SAR-ready export. The pilot went on hold pending assurance. 6 weeks of clinical conversation went quiet, and so did the board.
We rebuilt the spine over thirteen weeks on UK-hosted AWS (London region). Role-scoping for GP, nurse, patient, parent. A clinical safety case drafted to the DCB0129 baseline. A hand-off audit log on every clinician decision. The pilot was reinstated and 42 practices onboarded the quarter after. This page is for the healthtech founder who’d rather build to the regulator’s question on day one.
Six pillars.
Designed in at architecture, not retrofitted at assurance.
The cost of designing for NHS DSPT + DCB0129 + MHRA in week one is roughly a fortnight of architecture work. The cost of retrofitting them after the first assurance or buyer letter is months of senior engineering and an unhappy board. Open any row.
Record of Processing Activities, role-scoped clinical access, an audit log on every PHI touch, UK data residency on AWS London. DSPT self-assessment evidence prepared.
Clinical safety officer engagement, with introductions available. A hazard log. Mitigations documented. A safety case drafted to the NHS Digital DCB0129 baseline.
A SaMD classification assessment. UDI design. Quality Management System hooks. ISO 13485-aware where it applies to your product.
NHS Login OIDC. PDS lookup for verified identity. EMIS / SystmOne / Vision integrations via the NHS API Hub. eRS where the workflow calls for it.
Schema-level erasure design, not bolted on after launch. SAR-ready exports. A managed consent lifecycle. DPO sign-off included in the brief.
A data flow diagram showing every PHI movement. A sub-processor list. An international transfer assessment. A UK ICO-aligned ROPA.
The healthtech pain. The architectural answer.
Every healthtech founder who emails us is fighting one of these eight things. Each one is brutal to fix once patient data is flowing. Each one is a single architectural decision made on day one of our build.
- 01
“NHS England’s assurance team wants DSPT evidence in eight weeks. We have nothing.”
DSPT-ready architecture brief + evidence pack. DSPT self-assessment evidence prepared. Role-scoped access matrix. UK GDPR ROPA. Sub-processor list. An audit log per PHI touch. The DSPT review goes from panic to paperwork.
- 02
“We don’t have a clinical safety case. Our NHS partners require DCB0129.”
DCB0129-baselined safety case + hazard log. A clinical safety officer engaged, with introductions available. The hazard log built. Mitigations documented. A safety case drafted to DCB0129. Pilot reinstated.
- 03
“Our app makes clinical recommendations. Where does MHRA think we sit?”
SaMD classification + QMS hooks. The classification assessment ships in the audit. UDI design. ISO 13485-aware QMS hooks. The UK Approved Body engagement path identified, so your regulatory lead isn’t guessing.
- 04
“One URL parameter could expose another patient’s record. Nobody’s tested it.”
Role-scoped access, IDOR-tested at architecture. Role-scoped access at the data layer. The IDOR playbook run in audit week. Multi-role testing built into CI. Cross-patient access becomes architecturally impossible.
- 05
“We need NHS Login but we don’t know where to start.”
NHS Login OIDC + PDS lookup wired. NHS Login OIDC integration shipped in week two. PDS lookup for patient verification. Pseudonymised tokens for patient sessions. NHS Digital sandbox testing included.
- 06
“Our triage AI escalates to a clinician. There’s no audit trail.”
Audit log on every decision + hand-off. Every triage decision logs the AI reasoning, the clinician review, the action taken, and the timestamp. Exportable per patient, per clinician. Clinical-safety-review ready.
- 07
“GP practices want us in their EMIS workflow. We don’t know the API.”
NHS API Hub + EMIS / SystmOne wired. The EMIS Web Partner Programme. SystmOne via TPP One. Vision via INPS. Documented integration patterns carried over from three previous healthtech builds, ready for week-one re-use.
- 08
“We had a near-miss data exposure. The ICO might ask. We have no records.”
Audit log + ICO-ready breach response pack. A 72-hour breach response template plus audit log evidence. A sub-processor notification list. The ICO breach form pre-populated. Your DPO reads the pack and signs.
Four things a generic SaaS shop can’t hand you
This is what four healthtech builds have hammered into the studio. The reasons NHS partners and founders trust us with patient data.
42
GP practices onboarded the
The DSPT evidence pack was the document that reinstated our pilot. The assurance team read it and stopped asking.
Three tiers, one audit log that survives the review.
Four UK healthtech platforms have stress-tested these picks. Tier 1 runs every build. Tier 2 is what we reach for when the brief needs it. Tier 3 scales it to NHS-grade volume.
T1
What every healthtech build runs on
MERN + PythonMongoDBPostgreSQLNode.js + ExpressReact + Next.jsTypeScriptFlutterPython (FastAPI)NHS Login (OIDC)FHIR R4LangGraphDaily.co (WebRTC)Mixpanel
T2
When your healthtech brief calls for it
reach when neededEMIS WebSystmOne (TPP)Vision (INPS)Apple HealthKitGoogle FitJava + Spring
T3
The infrastructure that scales it
AWS London + cloud-nativeAWS (London)HIPAA-eligible servicesAWS KMSRDS / AuroraKubernetes (EKS)Apache KafkaSQS + EventBridgeRedisTerraformDatadog + SentryVanta + ICO docsMicroservices
Recent client · UK healthtech · 2024
Paused NHS pilot to
Paused NHS pilot to
42 practices onboarded, DSPT evidence accepted first time
Ayesha’s patient triage app, in real numbers. We rebuilt the spine on UK-hosted AWS with NHS DSPT alignment, a DCB0129 clinical safety baseline, role-scoped access, NHS Login integration, and SAR-ready exports. A thirteen-week sprint, behind a feature flag. The NHS Digital DSPT evidence pack shipped at handover.
The sprint
13wk
Clinical spine rebuilt
0
Patient-data leaks
The outcome
42
GP practices onboarded after
1st
DSPT pack accepted, first pass
Track record
4
Healthtech platforms since 2019
100%
DSPT packs accepted first time
HEALTHTECH SURFACES WE’VE SHIPPED
Healthtech surfaces, live in production
What lives on the clinical spine. Each one role-scoped, audit-logged, and built so the next assurance review reads as paperwork, not panic.
SURFACE(01)
Patient apps
iOS + Android via Flutter. NHS Login. Symptom intake. Triage flows. Push reminders. Clinician hand-off chat with a full audit trail.
FlutterNHS LoginTriage flowsAudit trail
Patient apps
SURFACE(02)
Clinician copilots
GP and nurse-facing. Patient summary, risk flags, audit-logged note generation. EMIS / SystmOne sync where the practice runs it.
Risk flagsNote generationEMIS syncSystmOne
Clinician copilots
SURFACE(03)
Clinical workflow
Referral routing, MDT booking, hand-off audit, escalation rules. All tied to role-scoped access, so the wrong role sees zero rows.
Referral routingMDT bookingRole-scopedEscalation
Clinical workflow
SURFACE(04)
Telemedicine + video
WebRTC + Daily.co. NHS-aware consent. Recording with consent. A clinical-safety-reviewed interface, not a generic video call.
WebRTCDaily.coConsentSafety-reviewed
Telemedicine + video
SURFACE(05)
Patient triage AI
A LangGraph state machine. Citation-grounded recommendations. A clinician approval gate on any irreversible advice. Reasoning logged.
LangGraphCitation-groundedApproval gateReasoning logged
Patient triage AI
SURFACE(06)
Wearables + RPM
FHIR-shaped integration with Apple HealthKit, Google Fit, and Withings. Remote patient monitoring dashboards your clinicians trust.
FHIR R4HealthKitGoogle FitRPM dashboards
Wearables + RPM
What healthtech founders actually ask before signing
Pain-first, soft-second. The questions every founder asks before they trust a studio with patient data.
We’re engineers, not an NHS framework supplier. We build the platform to NHS DSPT alignment and the DCB0129 clinical safety baseline. Three of our healthtech builds have shipped to NHS pilots. For procurement, we work alongside UK NHS commercial-route consultancies, and introductions are available. The technical evidence your assurance team reads is the part we own.
NHS Login via OIDC. PDS lookup for verified identity. EMIS via the Web Partner Programme. SystmOne via TPP One. Vision via INPS. We’ve shipped three of these, so the integration patterns are documented and ready for week-one re-use rather than discovered on your budget.
Yes, alongside a clinical safety officer, with introductions available. We draft the hazard log, the mitigations, and the technical evidence. The CSO owns the clinical sign-off. Four DCB0129-baseline safety cases have been drafted on the back of our DSPT compliant software development work.
We do the technical assessment in audit week. Whether you’re a SaMD, and which class, is a regulatory decision your QA or regulatory consultant owns. We document the technical evidence MHRA will look for, including UDI, QMS hooks, and ISO 13485 alignment where it applies.
AWS London region by default, for UK data residency. AWS HIPAA-eligible services only on the data path. Encryption at rest via KMS. Per-record encryption available for high-sensitivity workloads. UK GDPR and the Data Protection Act 2018 are designed in, not retrofitted. This is the heart of dspt compliant software development.
Three things make this hard to fake. The 30-day walk-away clause goes both ways. Payments are milestoned 25/25/25/25, so you never pay more than 25% ahead of working software. And we’ve been shipping since 2019, listed on Companies House, UK VAT registered. You can check us before you sign.
Yes, with 14 days’ notice. The engineers move to other projects, your repo stays where it is, and your spend pauses. Resume with 14 days’ notice and we pick up at the same sprint board, same engineers. No cancellation fee. We’ve done this six times in 2025.
Yes, signed inside 30 minutes via DocuSign. We keep a mutual NDA template ready, so nothing about your healthtech development brief leaves a confidential channel before you’ve had the chance to share it.
In context
What it looks like shipped.
healthtech development, in context — the dashboards, flows and components your team actually ships, reviews and maintains.
One paragraph. That’s it.
Tell us what you’re building, who your patients and partners are, and the clinical or regulatory question you’re most worried about. Mohit reads every first email and replies inside 24 hours: a clear yes, a clear no, or the one question that decides it.
What happens after the email lands
- < 24h
A personal reply.
Yes, no, or the deciding question. Straight to your inbox, not a team thread.
- Week 1
Audit week begins.
We draw the clinical spine, map DSPT and DCB0129, and hand you a signed scope.
- Week 14
Assurance-ready healthtech.
Role-scoped, audited, with the DSPT evidence pack your assurance team reads cold.