HIPAA-Compliant Telehealth Platform for GLP-1 Clinics in the US and UK.
A telehealth platform running real clinics.
Techdome built a multi-tenant, HIPAA-compliant telehealth platform for a US and UK GLP-1 weight-management venture: 38 clinic tenants (10 operating at scale), 12,400+ patients, asynchronous chart review, US 50-state and UK prescriber licensing, e-prescribing into 503A pharmacies and split billing.
When the GLP-1 surge outgrew off-the-shelf software, we replaced four disconnected vendors with one clinical platform across the US and UK — asynchronous chart review, 50-state & UK GPhC/GMC licensing, e-prescribing into compounding pharmacies, and split-billing that settles at capture.
The clinical and technical bottlenecks.
A fast-growing US and UK digital health venture needed to scale past off-the-shelf software to run tens of distributed clinics across North America and Great Britain on high-volume GLP-1 protocols.
Disjointed Vendor Latency
Intake, charting, e-prescribing and billing sat in four systems that never shared a patient record.
Manual Pharmacy Routing
A coordinator picked a compounding pharmacy by hand, then re-keyed the prescription into its portal.
Multi-Tenant Scalability Block
Onboarding a clinic meant a code change and a migration, with no guarantee of record isolation.
Cold Chain Blind Spot
Temperature excursions surfaced when a patient reported a warm package — long past recovery.
One encounter, end to end, in six stages.
Scroll to walk the pipeline. The rail tracks where you are and shows the contract each stage emits.
Asynchronous patient intake with automated clinical rule checks.
Structured intake on a white-labeled PWA. The worker parses biometrics, checks BMI against protocol, and clears MEN2/MTC contraindications before anything reaches a physician.
- Payload format
- FHIR R4 JSON schema
- Encrypted
- Identity verification
- Stripe Identity API
- Verified
- Biometric validation
- BMI ≥ 30, or ≥ 27 with comorbidity
- Passed
- Contraindication screen
- MEN2 / MTC / pancreatitis ruleset
- Cleared
Deterministic jurisdiction matching against US State Boards & UK GMC/GPhC registries.
The prescriber must hold an active licence in the patient’s jurisdiction (US state medical board or UK General Medical Council). Routing matches residence against live provider registries and local async rules before assigning a queue.
- Jurisdiction matching
- Residence jurisdiction + geo signal
- State/Country verified
- Physician registry
- US NPI & UK GMC active licence
- Validated
- Telehealth ruleset
- US async & UK CQC/NICE rules
- Enforced
- Malpractice boundary
- US carrier & UK indemnity check
- Active
Synthesized clinical decision support with one-click signature.
A pre-compiled dossier — vitals, biomarkers, suggested titration step. Sign with a 21 CFR Part 11 signature, or escalate to synchronous video.
- Chart synthesis
- Pre-compiled vitals & lab trendlines
- Rendered
- Decision support
- Protocol titration step suggestion
- Automated
- Digital signature
- SHA-256 PKI timestamped signature
- 21 CFR Part 11
- Audit logging
- Append-only immutable audit stream
- Encrypted
Automated compounding prescription routing and EDI dispatch.
Signed orders dispatch over NCPDP SCRIPT EDI, or straight to a 503A partner over REST — selected on inventory, licensing and proximity.
- Message protocol
- NCPDP SCRIPT / EDI 10.6
- Validated
- Compounding hub
- Certified 503A facility selection
- Proximity matched
- Batch validation
- Certificate of analysis check
- Verified
- Transmission
- mTLS encrypted webhook gateway
- Dispatched
Continuous 36–46°F monitoring across the whole transit window.
Carrier webhooks and in-box loggers stream transit telemetry continuously, alerting the moment a package trends toward its limit — not after it breaches.
- Safe temperature zone
- 36°F to 46°F (2°C to 8°C)
- Continuous
- Insulated packaging
- Validated 48-hour cold box
- Verified
- Carrier ingestion
- Cold-chain telemetry webhook
- Real-time
- Patient alerting
- Automated delivery notice
- Triggered
Multi-party disbursement and 28-day titration triggers.
One charge, three destinations: professional fee, pharmacy wholesale, clinic margin — with the next refill scheduled in the same transaction.
- Subscription capture
- $233.00 recurring monthly
- Captured
- Physician group payout
- $45.00 professional fee
- Transferred
- Pharmacy fulfilment
- $115.00 503A wholesale
- Transferred
- Clinic platform margin
- $73.00 net to tenant
- Settled
The whole review fits on one screen.
A 45-second SLA is a layout problem before it is an engineering one. Hover a numbered entry to find it on the screen.
Run a 45-second review yourself.
Pick a queued patient, read the dossier, sign. The real decision surface, with synthetic records behind it.
Patient A-102
Texas (TX) · 38y · Female- Biometric
- BMI 31.2
- Derived at intake from structured telemetry
- Recommended protocol
- Semaglutide SQ
- Opening dose 0.25mg sub-Q / week
- Lab integration
- Sync verified
- Fasting glucose and lipid panel synced from lab partner
The coordinator role, replaced by a graph.
Adherence reminders, queue SLA monitors, lab callbacks and refill scheduling run as self-hosted workflows. Run the graph to watch an approved encounter propagate.
FHIR to SCRIPT Converter
{
"messageId": "RX-TX-992148",
"format": "NCPDP_SCRIPT_10_6",
"pharmacyNcpdp": "503A-AUSTIN-HUB-01",
"dosageVial": "5mL Multi-Dose",
"refills": 3
}A peptide that warms up is a wasted dose.
In-box loggers and carrier webhooks stream transit telemetry continuously, so an excursion is predicted rather than reported.
- Safe zone
- 36–46°F (2–8°C)
- Packaging
- Validated 48-hour cold box
- Ingest
- Carrier webhook, real time
The alert fires on the trend, not the breach. At hour 31 the payload is still inside the safe band — which is the window in which a shipment can still be re-iced or re-routed rather than written off.
One database. Clinics that cannot see each other.
Every clinic's records share one table. Isolation is enforced by PostgreSQL, not application code — a query without a tenant context returns nothing rather than the wrong rows.
SET LOCAL app.current_tenant_id = 'tenant_01'; SELECT id, patient, rx, phi_data FROM clinical_encounters;USING (tenant_id =
current_setting('app.current_tenant_id'))Evaluated by PostgreSQL during query planning — before a row is handed back to the application.
Awaiting query
Awaiting query
The same rule, seen from the network console.
A network administrator sees every clinic they own on one screen, and nothing they don't. Commercial figures and tenant names are redacted here for the same reason this case study is anonymized.
Six tiers, from the edge to the encrypted row.
Select a tier to read the contract it hands the one below it.
PostgreSQL row-level security and envelope keys
PostgreSQL 15 · RLS · KMS envelope encryptionLogical tenant isolation enforced in the database itself rather than in application code. PHI fields are encrypted at rest under per-tenant envelope keys.
- Encryption at rest
- AES-256, per-tenant envelope keys
- Transit
- TLS 1.3 · mTLS between services
- Audit
- Append-only, tamper-evident stream
-- Tenant isolation, enforced by the engine
ALTER TABLE clinical_encounters ENABLE ROW LEVEL SECURITY;
CREATE POLICY tenant_isolation_policy ON clinical_encounters
FOR ALL
USING (tenant_id = current_setting('app.current_tenant_id', true)::uuid);
-- Session context, set before any query runs
SET LOCAL app.current_tenant_id = '018f2d91-4e78-7102-a1b2-c3d4e5f60708';Onboarded onto one shared platform with no per-tenant code branch — 10 of them operating at full scale.
- 12,400+Patient records under managementIsolated per tenant by row-level security
- 311Encounters approved / monthAsynchronous physician review, 45s SLA
- ~$76KPlatform revenue / monthAveraging ~$233 per encounter, split at capture
- < 1.2sSignature to pharmacy dispatchPreviously a manual re-key by a coordinator
This venture is described by sector and geography rather than by name, so publishing never waits on a client's sign-off. The figures are unchanged either way.
Telehealth platform development: questions buyers ask.
What is a GLP-1 telehealth platform?
It is the software a clinic uses to run GLP-1 weight-management care online: patient intake and eligibility checks, prescriber review, e-prescribing, pharmacy fulfilment and billing. This one does all of that on a single multi-tenant system for clinics in the US and UK.
How does the platform meet HIPAA requirements?
It runs on AWS HIPAA infrastructure under a signed BAA, each clinic is an isolated tenant with role-based access control, provider signatures follow 21 CFR Part 11 and every action goes to an append-only audit log. UK patients are covered by a UK GDPR architecture and a DPA.
How are patients checked for eligibility?
Intake is a structured questionnaire on a white-labelled progressive web app. The system checks BMI against the protocol (30 or above, or 27 with a comorbidity) and screens for MEN2, MTC and pancreatitis contraindications before anything reaches a physician.
How does prescriber licensing work across the US and the UK?
The prescriber must hold an active licence where the patient lives: a US state medical board licence or UK GMC registration. Routing matches the patient’s jurisdiction against live provider registries and the local asynchronous-care rules before assigning a queue.
How fast is the asynchronous chart review?
Physicians get a pre-compiled dossier of vitals, biomarkers and a suggested titration step, and the review is designed around a 45-second target. They sign with a cryptographic signature or escalate to a video visit.
How do prescriptions reach the pharmacy?
Signed orders go out over NCPDP SCRIPT EDI, or straight to a 503A compounding partner over REST. The pharmacy is chosen on inventory, licensing and proximity.
How are temperature-sensitive shipments monitored?
Carrier webhooks and in-box loggers stream telemetry through the whole transit window and alert when a package trends toward the 36 to 46°F limit, not after it breaks it.
How big was the team, and how long did the build take?
A dedicated pod of 33 engineers, architects and QA. The initial engagement was six months, and the pod has stayed on to scale the platform.
Building For Clinics Or Hospitals?
Our pods already know what a BAA, an NPI registry and a 503A routing rule are — so compliance starts on day one, not after the audit.
- HIPAA & BAA
- EMR / EHR
- HL7 & FHIR
- e-Rx
- 503A fulfilment
- Cold chain
Work with us
Case studies
- A Clinical Research Organization (CRO) & Life Sciences NetworkDecentralized Clinical Trial Recruitment, Patient Matching & HIPAA Audit Vault
- An Executive-Health Clinic GroupA Clinic Operating System, Re-Platformed Mid-Flight
- A Multi-Branch Clinical Diagnostics & Pathology NetworkA Cloud Operating System for Pathology Labs, Test Bookings & Instant Reports