Healthcare software development where the regulatory map came first.
Emerald Healthcare arranges planned surgery at accredited Indian hospitals for families who cannot be in India to organise it. We designed the consent and record-release model and mapped the Indian statutory surface before writing product code. The platform itself is not built, and the live site says so.
- Client
- Emerald Healthcare
- Sector
- Medical travel · India
- Our role
- Consent, records and intake design
- Status
- In build
A patient abroad, deciding
- Condition and history shared once
- No account, no portal, no standing store
Consent recorded per recipient
- Nothing released without a signed release
- Every unfinished capability fails closed and says so
- Statutory map drawn before product code
Coordination, not care
- Only what that hospital needs to quote
- The facilitator never diagnoses or treats
Designing the consent model before the platform is what keeps the build honest: the software cannot release something the paperwork never authorised.
The commercial model is structural rather than promised. The patient pays the facilitator nothing at any point. Every hospital on the panel pays the same standard per-case fee, agreed in writing before it joins. Treatment money moves directly from the patient to the hospital, so the facilitator never touches it.
The intended product is a case-file pipeline: a family photographs whatever paper they already have, in whatever language it is in; it is translated into one file; a registered physician signs that file for completeness; and at least three accredited hospitals answer the identical file, at equal visual weight. What exists today is the public site, the compliance architecture and the data-handling design.
Every unfinished capability fails closed and says so
The messaging line is not connected yet, and every button that would use it says so in the page rather than failing quietly. The enquiry form asks for a patient's name, country, phone number and medical reports, so it is labelled a demonstration: submission is blocked, and the page states that nothing was sent or stored.
A form that looks live and silently discards a child's scans is a data-protection incident with a nice typeface on it. The same rule keeps the site out of the search index until the line answers and mail is deliverable, and keeps every number off it: no patient counts, no testimonials, no ratings. The one worked example is labelled a sample.
Consent is recorded per recipient, and nothing is released unsigned
Consent here is not a checkbox that permits a database write. It is timestamped before any processing, and the record of when it was given is itself retained. Release is per-recipient: records reach a hospital only after the patient has approved that hospital by name. Withdrawal is available at any time, without a reason.
Where a hospital already holds a copy, the patient is told so and given that hospital's contact, rather than promised an erasure the facilitator cannot perform. Every file release is signed by a registered physician, and the page states what that signature means — the file is complete and legible, not a diagnosis and not a second opinion.
The statutory map changed the product, not the documentation
The Indian legal surface was researched and written up before any schema was drawn: research against current law, not legal advice. Two data-protection regimes are live at once — DPDP obligations bite from 13 May 2027, and the SPDI Rules 2011, under which health data is already sensitive personal data, bind until then.
Four of the findings changed the structure rather than a document:
- The fee is paid by the hospital entity, never to an individual doctor.
- Treatment money never passes through the facilitator, which is what avoids payment-aggregator licensing.
- Only the treating hospital can issue the invitation letter the medical e-visa requires.
- GST at 18% is a real cost to the hospital, which cannot reclaim it.
What transfers to your build
- Ship it fail-closed or not at all. A form that looks live and discards submissions is worse than one labelled a demonstration.
- Consent is per-recipient or it is not consent. Blanket permission collected at signup cannot survive a withdrawal request.
- Your deploy root is a publication decision. Pointing a host at your working folder publishes every file in it at guessable URLs.
- A layout rule can carry a commercial promise. A grid of one column or three, never two, outlives copy promising equal weight.
Common questions
What does healthcare software development involve before any code is written?
On a regulated-adjacent build: which data-protection regime binds you today rather than in two years, how your fee structure reads to the conduct rules governing the clinicians on the other side, and which third parties sit on your conversion path and so need contractual commitments rather than product work. Here that map was written before the product design, and it changed the consent model, the fee structure and the hospital agreement.
Does a health product built in India in 2026 have to comply with the DPDP Act yet?
Two regimes are live at once. The DPDP Act 2023 and its Rules, notified 14 November 2025, are phased, with the substantive obligations enforceable from 13 May 2027. Until then the SPDI Rules 2011 remain the binding baseline, and health data is already sensitive personal data under them. Build to the stricter of the two now — retrofitting a consent trail onto live patient records is the expensive version. This is research against current law, not legal advice.
Can a medical-travel facilitator charge the patient a fee?
It can, but the structure designed here deliberately does not. The patient pays nothing; every hospital on the panel pays the same standard per-case fee, agreed in writing before it joins. The fee therefore does not vary by which hospital is chosen, so the patient never has to wonder whether the recommendation was bought. It is papered as a services agreement for enumerated deliverables, paid by the hospital entity and never to an individual doctor.
What is the Medical Invitation Letter, and why does it affect product design?
Since 1 April 2025 the Indian e-Medical visa requires a system-generated Medical Invitation Letter, and only the treating hospital can issue it. A third party therefore sits directly on the path between a patient deciding and a patient travelling. The answer is contractual rather than technical: the hospital agreement needs a turnaround commitment on the letter, and the product has to show the patient where the request currently sits.
This is what Healthcare software development looks like before there is a product to demo: the consent model, the release gates and the statutory map written down first.