When the GLP-1 surge outgrew off-the-shelf software, we replaced four disconnected vendors with one clinical platform — asynchronous chart review, 50-state licensing, e-prescribing into 503A compounding, and split-billing that settles at capture.
A fast-growing US digital health venture needed to scale past off-the-shelf software to run tens of distributed clinics on high-volume GLP-1 protocols.
Disjointed Vendor Latency
Intake, charting, e-prescribing and billing sat in four systems that never shared a patient record.
Manual Pharmacy Routing
A coordinator picked a compounding pharmacy by hand, then re-keyed the prescription into its portal.
Multi-Tenant Scalability Block
Onboarding a clinic meant a code change and a migration, with no guarantee of record isolation.
Cold Chain Blind Spot
Temperature excursions surfaced when a patient reported a warm package — long past recovery.
Scroll to walk the pipeline. The rail tracks where you are and shows the contract each stage emits.
Asynchronous patient intake with automated clinical rule checks.
Structured intake on a white-labeled PWA. The worker parses biometrics, checks BMI against protocol, and clears MEN2/MTC contraindications before anything reaches a physician.
- Payload format
- FHIR R4 JSON schema
- Encrypted
- Identity verification
- Stripe Identity API
- Verified
- Biometric validation
- BMI ≥ 30, or ≥ 27 with comorbidity
- Passed
- Contraindication screen
- MEN2 / MTC / pancreatitis ruleset
- Cleared
Deterministic jurisdiction matching against active MD/DO credentials.
The prescriber must hold an active licence in the patient’s state. Routing matches residence against live provider registries and per-state async rules before assigning a queue.
- Jurisdiction matching
- Residence state + geo signal
- State verified
- Physician registry
- NPI registry + active licence
- Validated
- Telehealth ruleset
- Async vs. synchronous board rules
- Enforced
- Malpractice boundary
- State carrier coverage check
- Active
Synthesized clinical decision support with one-click signature.
A pre-compiled dossier — vitals, biomarkers, suggested titration step. Sign with a 21 CFR Part 11 signature, or escalate to synchronous video.
- Chart synthesis
- Pre-compiled vitals & lab trendlines
- Rendered
- Decision support
- Protocol titration step suggestion
- Automated
- Digital signature
- SHA-256 PKI timestamped signature
- 21 CFR Part 11
- Audit logging
- Append-only immutable audit stream
- Encrypted
Automated compounding prescription routing and EDI dispatch.
Signed orders dispatch over NCPDP SCRIPT EDI, or straight to a 503A partner over REST — selected on inventory, licensing and proximity.
- Message protocol
- NCPDP SCRIPT / EDI 10.6
- Validated
- Compounding hub
- Certified 503A facility selection
- Proximity matched
- Batch validation
- Certificate of analysis check
- Verified
- Transmission
- mTLS encrypted webhook gateway
- Dispatched
Continuous 36–46°F monitoring across the whole transit window.
Carrier webhooks and in-box loggers stream transit telemetry continuously, alerting the moment a package trends toward its limit — not after it breaches.
- Safe temperature zone
- 36°F to 46°F (2°C to 8°C)
- Continuous
- Insulated packaging
- Validated 48-hour cold box
- Verified
- Carrier ingestion
- Cold-chain telemetry webhook
- Real-time
- Patient alerting
- Automated delivery notice
- Triggered
Multi-party disbursement and 28-day titration triggers.
One charge, three destinations: professional fee, pharmacy wholesale, clinic margin — with the next refill scheduled in the same transaction.
- Subscription capture
- $233.00 recurring monthly
- Captured
- Physician group payout
- $45.00 professional fee
- Transferred
- Pharmacy fulfilment
- $115.00 503A wholesale
- Transferred
- Clinic platform margin
- $73.00 net to tenant
- Settled
A 45-second SLA is a layout problem before it is an engineering one. Hover a numbered entry to find it on the screen.
Pick a queued patient, read the dossier, sign. The real decision surface, with synthetic records behind it.
Patient A-102
Texas (TX) · 38y · Female- Biometric
- BMI 31.2
- Derived at intake from structured telemetry
- Recommended protocol
- Semaglutide SQ
- Opening dose 0.25mg sub-Q / week
- Lab integration
- Sync verified
- Fasting glucose and lipid panel synced from lab partner
Adherence reminders, queue SLA monitors, lab callbacks and refill scheduling run as self-hosted workflows. Run the graph to watch an approved encounter propagate.
FHIR to SCRIPT Converter
{
"messageId": "RX-TX-992148",
"format": "NCPDP_SCRIPT_10_6",
"pharmacyNcpdp": "503A-AUSTIN-HUB-01",
"dosageVial": "5mL Multi-Dose",
"refills": 3
}In-box loggers and carrier webhooks stream transit telemetry continuously, so an excursion is predicted rather than reported.
- Safe zone
- 36–46°F (2–8°C)
- Packaging
- Validated 48-hour cold box
- Ingest
- Carrier webhook, real time
The alert fires on the trend, not the breach. At hour 31 the payload is still inside the safe band — which is the window in which a shipment can still be re-iced or re-routed rather than written off.
Every clinic's records share one table. Isolation is enforced by PostgreSQL, not application code — a query without a tenant context returns nothing rather than the wrong rows.
SET LOCAL app.current_tenant_id = 'tenant_01'; SELECT id, patient, rx, phi_data FROM clinical_encounters;USING (tenant_id =
current_setting('app.current_tenant_id'))Evaluated by PostgreSQL during query planning — before a row is handed back to the application.
Awaiting query
Awaiting query
The same rule, seen from the network console.
A network administrator sees every clinic they own on one screen, and nothing they don't. Commercial figures and tenant names are redacted here for the same reason this case study is anonymized.
Select a tier to read the contract it hands the one below it.
PostgreSQL row-level security and envelope keys
PostgreSQL 15 · RLS · KMS envelope encryptionLogical tenant isolation enforced in the database itself rather than in application code. PHI fields are encrypted at rest under per-tenant envelope keys.
- Encryption at rest
- AES-256, per-tenant envelope keys
- Transit
- TLS 1.3 · mTLS between services
- Audit
- Append-only, tamper-evident stream
-- Tenant isolation, enforced by the engine
ALTER TABLE clinical_encounters ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation_policy ON clinical_encounters
FOR ALL
USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
-- Session context, set before any query runs
SET LOCAL app.current_tenant_id = '018f2d91-4e78-7102-a1b2-c3d4e5f60708';Onboarded onto one shared platform with no per-tenant code branch — 10 of them operating at full scale.
- 12,400+Patient records under managementIsolated per tenant by row-level security
- 311Encounters approved / monthAsynchronous physician review, 45s SLA
- ~$76KPlatform revenue / monthAveraging ~$233 per encounter, split at capture
- < 1.2sSignature to pharmacy dispatchPreviously a manual re-key by a coordinator
This venture is described by sector and geography rather than by name, so publishing never waits on a client's sign-off. The figures are unchanged either way — our delivery record is independently verifiable on Upwork.
Our pods already know what a BAA, an NPI registry and a 503A routing rule are — so compliance starts on day one, not after the audit.
- HIPAA & BAA
- EMR / EHR
- HL7 & FHIR
- e-Rx
- 503A fulfilment
- Cold chain