Healthcare Software Development Company in London, built to ship.

Patient identity is the hardest problem in the building

Two records for one person is the defining healthcare data failure, and it happens through a misspelt name, a changed surname, a transposed date of birth. Once duplicated, a clinician sees half a history and does not know it. Master patient index and matching rules belong in the first architecture conversation, not in a later data-quality project.

Interoperability is the requirement behind the requirement

HL7 v2 is still everywhere and FHIR is what everything new expects, so most real systems speak both and translate between them. The translation layer is where the effort goes, because the two models disagree about how much structure a clinical fact has.

Audit is not logging

Who viewed which record, when, and under what justification. Access logging in healthcare is a legal artefact that gets read by an investigator, so it has to be immutable, queryable and complete, which is a different design from application logs that rotate away after thirty days.

Every field is a clinical safety decision

A dropdown that permits an implausible dose, a date picker that accepts a future birth date, a free-text field where a coded value was needed. Validation here is not input hygiene, it is the difference between a caught error and a delivered one.

Working overlap

3.5 hours a day

Five and a half hours behind Surat in winter, four and a half in summer. The overlap is our afternoon and their morning, roughly 14:00 to 17:30 IST. That is enough for a daily call and not enough for continuous pairing, so the working agreement has to be written down rather than assumed.

The law that applies

the UK GDPR and the Data Protection Act 2018

The UK holds an EU adequacy decision, so EU-to-UK transfer is straightforward, but transfers onward to India need their own basis. In practice that means standard contractual clauses and a transfer risk assessment, and it is far cheaper to put those in place at contract signature than at go-live.

Procurement

Expect a security questionnaire, proof of insurance, and possibly a penetration test report. Budget the calendar for it.

Language

English throughout.

Where the data can live

AWS eu-west-2, Azure UK South and Google europe-west2 all sit in London. Since Brexit the region choice carries a second meaning: EU customer data in a London region is a transfer, not a domestic hop, and a client with European users will ask which region before they ask about the roadmap.