Healthtech Software Development at Startup House: Compliance-First Projects and Results

Key facts at a glance

• Compliance frameworks we build under: HIPAA, GDPR, ISO 27001 (compliant)
• Flagship healthcare client: Siemens Healthineers, with a sales platform active in more than 60 countries, supporting 5,000+ sales representatives
• Healthcare MVP: Simon Care Management, a test-ready mobile app for dementia care, built with patients and caregivers
• AI in clinical settings: all our AI products use RAG architecture, answering only from the client's approved data, with every response traceable to a source document
• Data policy: patient data is never used to train AI models

What compliance-first actually means

In healthcare software, compliance is either an architecture decision or a retrofit. We build it in from day one: full data encryption at rest and in transit, role-based access controls, audit logging, and SSO integration are part of the initial design, not a hardening phase before launch. Startup House is ISO 27001 compliant, and for regulated healthcare work we map to your HIPAA and GDPR requirements depending on the use case.

That approach shows up differently in each project. Here is what it looked like in practice.

Siemens Healthineers: a global sales platform in 60+ countries

The client: Siemens Healthineers AG, headquartered in Erlangen, Germany, a leader in medical devices. Partnership since May 2020, running for more than 6 years.

The challenge: Support the Digital Sales Companion serving more than 5,000 sales representatives worldwide. The product had to pull data from multiple corporate sources and integrate tightly with existing enterprise applications from day one.

What we built: Mobile and web applications supporting the daily work of the global sales force, built by a 30-person Startup House team. The architecture uses TypeScript, microservices for global scalability, GraphQL, and Elasticsearch for fast, scalable search. A Neo4j graph database proof of concept delivered 10 to 100x faster responses than the previous PostgreSQL setup.

The results: The product is active in more than 60 countries. In his review, Program Manager Holger Rohden noted on-time deliveries, scope kept, and quality above expectations.

Read the Siemens Healthineers case study

Simon Care Management: a dementia care MVP tested with patients and caregivers

The client: Simon Care Management (USA/UK), an application supporting people with dementia and their caregivers. Cooperation from April 2023.

The challenge: Deliver a functioning MVP focused on core features, with an interface adapted to the needs of people with dementia. Accessibility was not a checklist item here. It was the product requirement.

What we built: A three-stage agile process: scoping with user testing and estimates, MVP development, then extensions including a notification system. The numbers behind the build: 8 development sprints, 7 user testing sessions with patients and caregivers, and 2 detailed prototypes, one designed for caregivers and one for patients. The stack: TypeScript, React Native, and MobX on the frontend, a Node.js REST API on the backend, running on Google Cloud Platform, with Google Places autocomplete and real-time location tracking.

The results: A test-ready MVP mobile app, distributed to beta testers through TestFlight, with product insights collected through Amplitude.

Read the Simon Care case study

Doogie: proving HIPAA-grade AI architecture in 2 months

Doogie is different from the projects above: it is an internal showcase application we built to demonstrate what compliance-first AI development looks like, not a commercial product. In 2 months from kickoff, a 12-person team delivered a working AI health guidance app with 0.1-second response times, built around ChatGPT integration.

The architecture is the point: HIPAA and HITRUST-aligned design, Kubernetes RBAC for access control, two-factor authentication, multi-year log retention for auditing, continuous penetration testing, encryption at rest and in transit, and automated backups with point-in-time recovery, on a cloud-agnostic setup that also supports bare metal.

Read the Doogie case study

AI in healthcare without hallucinations

Generative AI in a clinical setting has one non-negotiable requirement: the system cannot invent answers. Every AI product we deploy in healthcare uses Retrieval-Augmented Generation (RAG). The AI answers questions using only the client's approved clinical data, documentation, and verified datasets, never public internet sources. Every response is traceable back to a specific source document.

Our healthcare AI toolkit includes:

• KnowHub, an AI-powered knowledge portal that turns institutional knowledge into a secure assistant for employees and patients, answering 24/7 based solely on verified documents, in any language.
• SmartSearch, semantic search that understands medical intent instead of matching keywords, and returns a proof of fact with each result.
• InProduct AI, a copilot for MedTech SaaS companies that integrates with the codebase and generates real-time technical documentation.
• Legacy system modernization, a conversational AI layer on top of existing clinical systems, so doctors and nurses can query data in plain language while the core clinical logic stays intact.

Two policies apply to all of them. Patient data is never used to train AI models, and all AI processing happens within the client's secure environment, governed by existing access policies and SSO.

How long does healthcare software take to build?

Based on our delivery practice: MVP timelines depend on scope and the amount of user testing. AI products like KnowHub or SmartSearch can go live in as little as 2 weeks once the data is prepared. Timelines are scoped precisely after a discovery call.

About Startup House

Startup House is a 50-person, cross-functional software development team based in Warsaw, Poland, established in 2016, with 100+ products shipped, a client NPS of 75, and clients on 5 continents. We build healthcare software for MedTech companies and health SaaS platforms.

Building in healthcare? Book a 30-min call.

FAQ

How does Startup House handle HIPAA and GDPR compliance in healthcare software?

Compliance is built into the architecture from day one: full data encryption at rest and in transit, role-based access controls, audit logging, and SSO integration. Startup House is ISO 27001 compliant. Our Doogie showcase demonstrates a HIPAA and HITRUST-compliant architecture, and in client projects we map to your HIPAA and GDPR requirements depending on the use case.

How does Startup House prevent AI from giving incorrect answers in clinical settings?

All healthcare AI products are built on RAG (Retrieval-Augmented Generation). The AI answers only from the client's approved clinical data and verified documents, never from public internet sources, and every response is traceable to a specific source document.

Is patient data used to train AI models?

Never. Proprietary data and patient records are not used to train public or shared AI models. All AI processing happens within the client's secure environment under existing access policies.

How long does it take to build a healthcare application?

AI products like KnowHub or SmartSearch can go live in as little as 2 weeks once the data is prepared. Timelines for custom healthcare applications depend on scope and are set after a discovery call.