VulCode

Healthcare and medtech software development

Apps and panels for medtech companies and clinics: device data, staff dashboards, alerts and protection of health data. We built SafeBands' whole wristband monitoring system in two weeks.

Commerce and tech
A telecare coordinator panel: open alerts with priority and owner, teams, bands to check and how one alert went

SafeBands: a monitoring wristband system for rescuers

The bands were ready for production; the software was missing. In two weeks we built the operational core of the whole platform.

The SafeBands mark

Bands without software

Medical requirements left no room for mistakes in security or reliability.

SafeBands, emergency portal

The operational core of the platform

A secure, reliable system that collects device data, manages users and alerts, and is ready to scale from pilot to production. See the SafeBands project.

What works after two weeks

Delivery time: 2 weeks
A web app integrated with the wristbands
Monitoring: real time
Device data monitoring and an alert system
Emergency portal: no sign-in
An interface built for field use on phones
Accounts and roles
Accounts with role-based access control

From sensor to a human decision

In device systems what matters most is what happens when the signal disappears or the data looks wrong.

  1. Device

    Sensor or wristband

    A reading and a device ID, with no personal data in the packet.

    09:31:06Band 0417: SOS button, battery 64%
  2. Link

    Phone or gateway

    Data transfer with a buffer for when there is no coverage.

    09:31:06the packet via the home gateway
  3. Backend

    Intake and rules

    Validation, storage and server-side alert rules.

    09:31:07validated and stored; SOS rule: priority 1, nearest free Team B
  4. Staff

    Panel and alert

    An alert with a priority, acknowledged by a specific person.

    09:31:29Carer 02 took the alert; other teams see the owner
    09:40:12Carer 02 on site

When the signal disappears

A lost signal is an event too: the system flags a device that stopped transmitting instead of showing its last good reading.

  1. Band 0108 goes silentlast packet at 09:35:02, while a packet comes every 30 s
  2. Rule: over 5 min of silencepriority 2, not an old reading
  3. Alert P2: no signal09:40:02, no owner yet; escalation to the coordinator at 09:43

A staff panel that shows who is handling an alert

In a medical panel every alert has an owner and every data access leaves a trace.

An SOS alert on a carer's phone: priority, acceptance and arrival, emergency information for the role and the band's status

  1. Alerts with priority and acknowledgement

    A specific person or team acknowledges each alert, so two people do not respond to the same event and none is left without a response.

  2. Device status

    Battery, last signal and assignment to a person or team in one view.

  3. Panel and app

    We quote the panel and the mobile app for field work separately, for your scope.

Data access by role

An example split we agree before building. The rule: everyone sees only what they need for their work.

  1. The person's data

    • A person's readings
    • Minimum emergency information

  2. Coordinator

    • Alerts for own team
    • A person's readings
    • Device management
    • Minimum emergency information

  3. Field staff

    • Alerts for own team
    • A person's readingsDuring an active alert
    • Minimum emergency information

  4. Public view

    • Minimum emergency informationOnly what is essential

  5. Outside the person's data

    Administrator

    • Device management
    • Accounts and roles

Who opened the data and when

The access log records every opening of a person's data: who, when, in which role and on what basis.

The access log for person 0417: entries with role and basis, a refusal for the administrator and who can see the data now

  1. Access log

    Who opened a person's data and when. The foundation for accounting for health data processing.

  2. Access only during an alert

    Field staff open a person's readings only during an active alert, and the entry says how long that access lasted.

  3. Security as a requirement

    Encryption, access control, an access log and backups are in scope from day one, as described on our security page.

Health data and the medical device line

Two things decide the scope of a medtech project: health data rules and whether the software becomes a medical device. We write this as the website builder, not a law firm, so it is not legal advice.

GDPR (Regulation 2016/679)
art. 9, EUR-Lex
The text on EUR-Lex

  1. art. 9(1) Health data is a special category

    GDPR (Regulation 2016/679), art. 9, EUR-Lex

    Wording: Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.

    In plain words: The GDPR prohibits processing health data unless one of the exceptions in art. 9(2) applies. That is why we agree the legal basis, data scope and retention with your data protection officer before building.

  2. Annex VIII, rule 11 Software can be a medical device

    MDR (Regulation 2017/745), Annex VIII, rule 11, EUR-Lex

    Wording: Software intended to provide information which is used to take decisions with diagnosis or therapeutic purposes is classified as class IIa, except if such decisions have an impact that may cause (...). Software intended to monitor physiological processes is classified as class IIa, except if it is intended for monitoring of vital physiological parameters, where the nature of variations of those parameters is such that it could result in immediate danger to the patient, in which case it is classified as class IIb.

    In plain words: Rule 11 of the MDR classifies software that provides information used for diagnostic or therapeutic decisions as at least class IIa, and software that monitors physiological processes as at least class IIa too. Such software needs a conformity assessment.

Questions from medtech companies and clinics

The most common questions before a project starts.

Describe your device or clinic

Tell us what you measure and who should use the data. We will reply with a proposed scope and a free quote.