Outcome summary
We designed and built a platform that brings regional data residency, patient consent, a catalogue of certified analyses, licensing and reporting together as one coherent system.
Starting situation
Our client builds software for brain and heart health: tools that analyse biosignals with AI-based methods and turn them into clear, clinically useful reports for clinics and hospitals. The challenge was to make this work across countries, where patient data is subject to different rules and must stay under strict control.
A single central system does not fit healthcare. Regulators and hospitals want data to stay in the region where it was collected. Patients must give explicit, traceable consent. Every analysis must be reproducible and auditable. At the same time, the business needs one product that can scale to new regions without being rebuilt each time.
The system
- Regional nodes keep the clinical data and run the analyses close to where it is collected. Sensitive data is encrypted by region, and only what must cross reaches the central hub, over mutually authenticated, certificate-secured channels.
- A central hub coordinates what is shared across regions: licences, usage credits, a catalogue of certified analysis pipelines, legal texts and reporting.
- A consent and legal-text layer manages versioned, signed patient consent and keeps the master copy of every legal document in one place.
- An analysis engine runs versioned, certified pipelines, so the same input always produces a traceable result.
- Operations built for medicine: automated, declarative deployments; containerised services on orchestrated clusters across several environments; centralised logging, metrics and alerting; encrypted off-site backups; a full audit trail of who accessed what; and single sign-on with role-based access for clinicians, administrators and partners.
Implementation
We began in early 2026 by designing a hub-and-regional-nodes architecture, then built it.
Every part is a separate, replaceable service. The services exchange events through a messaging backbone, share one identity system and are deployed from version-controlled configuration. That makes the platform repeatable: a new region is a new node, not a new project.
Results and evidence
The regional model, the consent flow, the analysis catalogue, licensing and reporting work together as a single system.
After launch
The same foundation is designed to let the business:
- open new countries with local data residency from day one;
- onboard clinics and hospitals as separate organisations, each with its own users, data and rules;
- sell through distributors and partners, with licences and pay-per-analysis credits;
- grow a catalogue of add-on analyses without changing the platform;
- deliver reports in multiple languages;
- connect to partner systems such as scheduling and notifications.