Telehealth & Compliance for a 90+ Location Med Spa Network

The software problem

Physician oversight groups run on software that was never built as a system. Intake lives with one vendor, video with another, and documents with a third, and none of them are connected. Providers re-enter what patients have already typed, clearance notes travel by email, and protocols and orders live in cloud drives.

The group is legally accountable for a hundred locations and has no single place to see them.

Nine months looking for a builder

This directorship concluded the workflow was the constraint on the business. They spent nine months trying to get it built properly first, and turned down two rounds of vendors: smaller shops layering configuration onto systems they couldn't reach at the code level, larger firms priced past what a group this size could justify.

Then they hired a solo engineer, and the first platform was in production two weeks later, built from scratch.

What I built

Three platforms on a shared backend, inside about two months:

• Clinic telehealth — intake flows straight into the provider view; clearance notes generated and delivered in-system
• Network compliance — chart review, version-controlled protocols and standing orders, order tracking, clinic support queue with escalation
• Direct-to-patient — patient-facing service on the same scheduling backend, anticipated in the data model from week one

Guardrails on patient data

The platform runs to roughly 250,000 lines of code, maintained solo, heavily AI-assisted, and carrying patient data. Four controls hold it in place:

• Every change ships through human sign-off; nothing reaches production without it
• A deterministic hook blocks all model writes to the production database
• Production read tooling runs on a credential that cannot access PHI tables
• Patient data on a self-hosted AWS stack under BAA, with PHI and clearance-note access logging

Seven months in

All four partner nurse practitioners now work in the system daily, seeing roughly 100 patients a week, with 1296 visits completed since launch. Over that period there have been no security incidents and no data loss.

The system has absorbed roughly two full-time administrative workloads. The person who once administered the old platform is now free for other work, and the business lead — whose phone once rang constantly with clinic problems — reports it has gone quiet.