Patient platforms & portals
Booking, intake forms, results, messaging and consent management for patients.
Healthcare software development
We build patient and clinic platforms, HL7 FHIR integrations and medical AI for healthcare providers and digital health companies — with GDPR and HIPAA requirements designed into the architecture from the first sprint.
GDPR
HIPAA
HL7 FHIR R4
SMART on FHIR
Standards
Standards we build to
Every healthcare project is designed against GDPR and, for US patient data, HIPAA; integrations use HL7 FHIR R4 and SMART on FHIR authorisation. We build in line with these standards — certification of your product stays with your organisation.
GDPR
EU data protection
Health data as special-category data (Art. 9), processor agreements (Art. 28), security of processing (Art. 32).
HIPAA
US patient data
Security Rule technical safeguards and a Business Associate Agreement before any PHI access.
FHIR
R4
R4
Interoperability
HL7 FHIR R4 resources and REST APIs for exchanging clinical and administrative data.
SMART
Authorisation
SMART on FHIR and OAuth 2.0 for standard app launch and scoped access to records.
Industry services
Healthcare software we build
We design, build and maintain six kinds of healthcare systems, from patient-facing apps to back-office automation and clinical AI.
Clinic & practice management
Scheduling, staff rotas, billing and reporting for clinics and medical centres.
EHR / EMR integrations
HL7 FHIR R4 interfaces, data mapping and synchronisation with existing records systems.
Telehealth & remote monitoring
Video consultations, device data ingestion and alerting for care teams.
Medical document processing
Extraction of structured data from referrals, lab reports and scanned forms.
Clinical AI assistants
Summaries and answers grounded in clinical documents, always with clinician review.
Interoperability
How a FHIR integration works
We place a FHIR integration layer between existing clinical systems and your application, so data is validated, mapped and access-checked in one place.
SourceEHR / EMR / LISExisting clinical systems
FHIR R4Integration layerValidation · mapping · consent checks
SMARTAuthorisationOAuth 2.0 scopes per user and app
AppYour applicationPatient or clinician experience
LogAudit trailWho accessed which record, when
Compliance
Compliance built into delivery
Each regulatory requirement is mapped to concrete engineering work in the scope, so compliance is visible in the backlog rather than left to a final review.
| Requirement | What we do in the project |
|---|---|
| GDPR Art. 9 — special-category data | Document the legal basis and minimise health data for every data flow. |
| GDPR Art. 28 — processor | Sign a data processing agreement before accessing personal data. |
| GDPR Art. 32 — security | Encryption in transit and at rest, role-based access, tested backups. |
| GDPR Art. 35 — DPIA | Provide technical input for your data protection impact assessment. |
| HIPAA §164.312(a) — access control | Unique user IDs, role-based permissions, automatic session timeout. |
| HIPAA §164.312(b) — audit controls | Tamper-evident logs of access to and changes of patient records. |
| HIPAA §164.312(e) — transmission security | TLS for all traffic; no PHI in emails, logs or analytics tools. |
| HIPAA — business associate | Business Associate Agreement signed before any PHI access. |
- Medical AI with a human in the loop. Clinical outputs are suggestions reviewed by qualified staff, and every model answer cites its source document.
- Medical device questions raised early. If software could qualify as a medical device under EU MDR, we flag it in discovery and work with your regulatory team.
FAQ
Healthcare questions
What healthcare teams ask before working with us.
Is RubyPlius HIPAA certified?
There is no official HIPAA certification for companies or software. We build in line with the HIPAA Security Rule, sign a Business Associate Agreement when we handle PHI, and support your own compliance assessment.
Where is patient data stored?
In the region you choose. For EU clients we use EU cloud regions by default; for US clients, US regions covered by a BAA with the cloud provider.
Can you integrate with our existing EHR?
Yes, if it exposes an HL7 FHIR API or another documented interface. We start with a short technical review of the available endpoints and data quality.
Do you use patient data to train AI models?
No, not without your explicit written agreement. Development uses de-identified or synthetic data, and AI providers are configured not to retain or train on your data where the provider allows it.
Do you build medical devices?
We build software for healthcare organisations. If a product may qualify as medical device software, we work under your quality management system and regulatory guidance.
Contact
Discuss a healthcare project
Describe the system and the data involved. Please do not include any patient data in this form.