Healthcare software · med-spa · Remote
Med-spa software where compliance is the architecture
Software for a med-spa, built under HIPAA. Compliance here is not a checklist applied at the end, it decides where data lives, who can reach it, what gets logged and what may leave the system, and every one of those is an architectural decision made before the first screen.
What we delivered
- Custom med-spa software design and development
- HIPAA-compliant handling of protected health information
- Client
- Androganics
- Duration
- Project
- Year
- 2026
The situation
Where they started
HIPAA changes what the software is allowed to be. Where protected health information is stored, who can access it, how access is logged, and what may be sent to a third party are all constrained, and a marketing pixel that would be unremarkable elsewhere can be a violation here.
A med-spa is simultaneously a clinical setting and a consumer business. It needs the booking and marketing conveniences of the latter without either touching protected information in a way the former forbids.
What we did
Three moves that mattered
- 01
Compliance decided in the architecture
Data location, access control and audit logging were settled before feature work. Retrofitting HIPAA onto a working application means rebuilding it, because the requirements land on exactly the decisions made first.
- 02
A hard boundary around PHI
Marketing and analytics are kept strictly outside the protected boundary. Conversion measurement stops at the point where it would require knowing something about a patient, which is a real limitation and the correct one.
- Next.js
- React
- TypeScript
The result
What changed
- Med-spa software operating under HIPAA constraints.
- A defined boundary between the marketing surface and protected health information.
- Launch status and outcome figures have not been supplied yet.
Services used
What this engagement drew on
Same problem?
Most of these start with a free audit
Two days, no cost, and you keep the findings regardless of what you decide.
More case studies
Lyfework.io
Running delivery for an agency, across seven disciplines
Zen Medicine
Tracking, creative and a follow-up system that runs itself
Mold Shark
Paid, organic, social and video under one set of numbers
Fireside
Pipelines, automations and templates built around the real process
Nexus
A task management platform, built as a product