The doctor owns the medicine. The software enforces it.
A physician-led preventive-medicine practice in Saudi Arabia asked us to build the platform its patients and doctors use every day. Patients connect wearables and send lab results; the physician's own clinical rules decide what is safe to suggest; patients get a clear plan for today. The client is confidential, so there are no screenshots.
Personal medicine only works if every number is the doctor's.
The practice runs longevity and prevention programmes built on the physician's own sourced protocol: hundreds of markers, interventions, rules and monitoring schedules. It needed software that follows that protocol exactly, day after day, for every patient.
Software must never guess
A threshold or dose typed by a developer is a clinical decision made by the wrong person. Every value had to come from the physician, and stay his.
Saudi data rules
Under PDPL, clinical records belong inside the Kingdom, and patient messages must never expose a value, dose or result.
Devices that disagree
Whoop reports near-real-time; Dexcom glucose arrives about three hours late outside the US; labs send PDFs. The product had to be honest about what is live and what isn't.
Busy people won't browse
Patients have little time. They open the app to find out what to do now, and a reminder at a fixed clock time is wrong on a day they wake up late.
Three portals around one plan.
Today, in one screen
A single Today screen answers what to do now. Around it: the 40-question intake, results that combine labs and wearables, device setup for Whoop and Dexcom, the recommended device catalogue, and a schedule the patient can subscribe to in their phone's calendar.
A console built around the morning
A worklist of everything outstanding across patients, a board of who needs a decision today, and per patient: interview and history, the plan, results, wearables, lab orders, documents and decision history. An outbox shows the exact wording patients receive.
Orders in, results back
Partner labs see only their own unexpired orders and return results, with OCR for scanned reports.
Nudges without health data
Patients get WhatsApp reminders that name the approved plan item but never carry values, doses or results; those stay behind login. Alerts reach both physicians on Discord.
The medicine and the machine live in separate places.
The physician's side
- The protocol is a versioned decision graph the physician approves, loaded one way into the database
- A lint check flags any clinical number written into application code
- The decision engine runs as its own Python (FastAPI) service behind a tested contract
- Every cited PubMed ID in the knowledge base is verified
Our side
- Next.js 16 · React 19 · next-intl, Arabic and English, tests fail on a missing translation
- PostgreSQL in three schemas (knowledge, clinical, auth) with row-level security and Drizzle ORM
- Argon2 passwords, TOTP two-factor, AES-GCM encrypted secrets and an audit log
- Whoop API, Dexcom Share, Tesseract OCR, WhatsApp and Discord, in Docker behind nginx
Rules written for the worst day.
Two gates before any suggestion
The physician's first gate looks at the worst realistic outcome, not the average, and excludes anything irreversible. The second requires an early-warning marker, a monitoring schedule and a stop rule. The software enforces them in code, and nothing reaches a patient until the physician has approved the plan.
Messages that can't invent facts
Every inbound message is first checked for an emergency by simple, dependency-free rules that work even when everything else is down. Every outbound message is checked last: any number or time in it must already exist in the patient's approved record.
Private even on a lock screen
Reminders anchor to when the patient actually wakes, sleeps or eats, recomputed from wearable data. Calendar titles are kept discreet, so a medication name never shows up on a phone someone else can see.
A clinical interface that never scolds.
Warm paper rather than clinical white, ink rather than pure black, and a single restrained green used sparingly. Marker states read optimal, off-optimal or not-measured — never a red-versus-green verdict — because a full baseline takes weeks, and waiting should feel calm rather than like failure.
A practice that can scale its care without diluting it.
The protocol stays the doctor's
Changing a clinical value is a change to the physician's knowledge base, never a code release.
A plan that fits the day
Patients see what to do now, timed to their real day, and the clinicians see who needs them.
Built for PDPL
Clinical records stay behind authentication, row-level security isolates every patient and lab, and the platform is designed to be hosted inside the Kingdom.
Tested where it matters
More than 800 automated tests cover the gates, the messaging guardrails, access rules and translations.
Building something where being wrong isn't an option?
If your product carries real-world consequences — clinical, financial or regulatory — let's talk about the boundaries it needs.