A full-stack HIPAA-compliant platform for weight loss treatment — built from the ground up
A secure, compliant, and intuitive platform connecting patients seeking weight loss treatment with the medical providers managing their care. Two portals, one codebase, zero compliance gaps.
Strict compliance requirements and high UX expectations — at the same time
HIPAA compliance was non-negotiable
Every feature, every data flow, and every third-party integration had to be evaluated against HIPAA's requirements before it was built.Retrofitting compliance is expensive — it had to be designed in from day one.
Two completely different user experiences
Patients and providers have fundamentally different needs, workflows, and levels of technical comfort. One codebase serving both groups without compromise required serious product thinking before development began.
Sensitive, stigmatised health data
Weight loss treatment involves health data that patients share reluctantly. The platform needed to handle it with a level of discretion and security that went beyond the technical minimum — trust was a product requirement.
Six months. A hard deadline.
The client had business commitments tied to the launch date. Scope, priorities, and trade-offs had to be managed tightly throughout the engagement — there was no room for slippage.
From first consultation to ongoing treatment — without leaving the platform
Deep compliance without slowing the product down
PHI had to be encrypted in transit and at rest across every layer — with role-based access controls ensuring patients only ever see their own data and providers only access assigned patients. Designing this before the first line of application code meant the schema, the API, and the infrastructure choices were all shaped by compliance requirements, not constrained by them after the fact
Secure messaging was the hardest single feature to get right. Standard email and third-party messaging tools aren't covered under a BAA — so a custom in-platform communication system had to be built from scratch, meeting HIPAA's requirements for electronic communications while still feeling fast and intuitive to both patients and providers. Payment processing, identity verification, and pharmacy integrations were all routed through HIPAA-compliant vendors with signed BAAs before a single API call was made.
Four things the platform does — built against real clinical workflows
Guided patient experience
Structured onboarding, health intake forms, consultation booking, treatment dashboard, and prescription tracking — designed to feel approachable rather than clinical. Intake completion rate hit 84% in month one.
Clinical efficiency, not added complexity
A filterable caseload view, full patient history access, prescription management, and secure messaging — consolidated into one workspace. Providers reported 40% less administrative time per patient.
HIPAA-compliant infrastructure throughout
AES-256 encryption in transit and at rest, role-based access controls, full audit logging, and BAA-covered third-party services — all designed in before development started, not added at the end.
Secure in-platform communication
A custom HIPAA-compliant messaging system replacing non-compliant communication channels entirely. Over 70% of patient-provider communication moved onto the platform within three weeks of launch.
Launched on schedule. Scaled to 1,200 patients in 90 days.
Building something that handles sensitive data and real users at the same time?
We've done it in healthcare. We can do it in your industry. Let's talk about what compliant, user-first engineering looks like for your product.
Let's Talk →