Industries / Healthcare · Series 01

In healthcare, the interface carries consequence.

A vessel rendered slightly wrong teaches the wrong thing to someone who will later hold a scalpel. A record shown to the wrong account is a reportable breach with a name attached. A surveillance signal that arrives three days late is three days of transmission. None of that is a polish sprint. Each one was decided months earlier, in the architecture.

3-D patients from CT and MRI

Reviewed by surgeons

A national health platform

Live on a fixed date

200+ clients · 10 years

100% JSS · 4.9/5 Clutch

Thirty minutes on one product, live or in build. We map where protected health information moves today, which boundaries it crosses, who and what can read it, where the audit trail is thin, and what a real imaging or EHR integration would cost in time. You keep a one-page data-flow diagram and a short written note — written to go straight into a security review or a diligence pack.

Medical imaging workstation: sagittal, axial and coronal reference views on the left with a marked structure, and a real-time three-dimensional reconstruction of the ribcage, spine, vessels and pelvis on the right — Medical 3-D avatars · the case

What we build here — and what we are not.

Series 02
Scope

Healthcare software fails in a specific way: everyone agrees on the goal, nobody agrees on where the work stops. So here is the boundary, at the top of the page, before you spend twenty minutes finding out.

We build

The product

A digital-health, medtech or medical-education product that no vendor sells off the shelf — imaging and 3-D, a niche registry, a care-pathway tool for one condition, a training simulator.

We build

The integration layer

Clinical data in and results out: a FHIR R4 facade with US Core profiles over whatever the site actually speaks, an HL7 v2 path where ADT, ORM and ORU through an interface engine is the reality, DICOMweb where the images live in a PACS or VNA.

We build

One workstream

A defined slice inside a bigger programme, staffed with senior engineers you talk to directly, with the source, the infrastructure-as-code and the runbooks in your repositories from the first week.

We are not an EHR vendor and we are not bidding as a health-system prime contractor. We do not replace Epic and we do not lead a multi-year hospital transformation programme. We have not built an EHR, and nothing on this page is going to imply that we have. If that is what you need, the honest answer is that we are the wrong shop — and you have found that out in the first minute rather than the sixth week.

Six situations we are usually called into.

Series 03
6 findings

Not categories. Situations — described the way the person living through them would describe them on a first call.

01IM 1/6

The surgeon looks at it once.

You demo the training simulator to a clinical advisory panel. Four seconds in, someone says the vessel does not run like that, and the room stops listening. Everything after that — the interaction design, the curriculum, the pricing — is now irrelevant, and your engineers cannot tell you which of a hundred pipeline decisions caused it: the segmentation threshold, the smoothing pass, the decimation that took the landmark out, or a texture that makes tissue read as plastic.

02IM 2/6

The data cannot leave the building.

Your model needs imaging. The imaging sits in a hospital PACS behind an agreement that says it does not move, and the de-identification question — DICOM headers, burned-in pixel text, dates, rare diagnoses that re-identify by themselves — has not been answered by anyone willing to sign their name to it. Safe Harbor or Expert Determination is a decision nobody wants to own. So nothing gets built, and the pilot slips another quarter.

03IM 3/6

The integration is quoted in quarters, and it blocks everything.

You need clinical data in and results out. What you get is a marketplace listing, a sandbox, a per-organisation client ID, a security review and a go-live approval — repeated at every single customer site. The roadmap behind it stops moving. Meanwhile the site that actually wants you is still running HL7 v2 through an interface engine, and nobody on your team has read an ADT feed in their life.

04IM 4/6

Compliance arrives late and rewrites the architecture.

Two weeks before the pilot, the privacy officer asks where PHI is written, who can read it, what the audit log records, which subprocessors touch it, and whether the vendor will sign a BAA. The honest answers require changing the data model, the logging and the deployment target. There is no time to do any of it properly, so it gets done improperly and stays that way.

05IM 5/6

The date is a border reopening.

The service must be live when travel resumes or the surveillance mandate commences. Scope can move, quality cannot, and the date is not yours to negotiate — it belongs to a policy decision and, eventually, to a press conference. Then the protocol changes while the system is running, and you have to change it without taking it down.

06IM 6/6

The app was written as if the user were well.

Small type, a five-step flow, cheerful microcopy, an error state that says “Oops!”. The actual user is anxious, in pain, on a four-year-old phone, possibly using a screen reader, possibly reading their second language, possibly being helped by an adult child in another country. The consumer-app instincts that work everywhere else fail exactly the people the product exists for.

From slices to anatomy.

Series 04
Schematic

A stack of two-dimensional sections becomes a form you can rotate, and a surgeon decides in about four seconds whether the form is right. Everything between those two facts — the threshold, the contour, the mesh, the frame budget — is the engineering. Scrub through the stack and watch the form assemble.

Section, greyscale Segmentation contour Assembled surface

Schematic illustration. Every shape here is generated geometry drawn in the browser. It is not patient data, it is not derived from any scan, and it is not a diagnostic display — it exists to make one engineering argument legible. The same scrub works from the keyboard: focus the slider and use the arrow keys, Home and End. A full text description of each stage sits below for anyone who cannot use the interaction.

Read it as text instead

Twelve schematic axial sections are stacked from the top of the region to the bottom. On each section, a closed contour marks the structure of interest — drawn narrow at the first and last sections and widest in the middle, the way a structure genuinely enters and leaves a series. As the position moves down the stack, each contour is placed into the reconstruction beside it and offset in depth. With every contour placed, a surface is drawn across them and the result reads as a form rather than a pile of outlines. The decisions that make it clinically acceptable happen at exactly two points: where the contour is drawn on each section, and how much of it survives being simplified for real-time rendering.

Three pieces of evidence, and the plain limits of the set.

Series 05
3 cases

Imaging and real-time 3-D that clinicians review. A national public-health platform delivered to a fixed date. A high-volume behavioural-health product carrying sensitive personal data. That is the set — three cases, described properly, instead of twenty capability bullets.

Medical 3-D avatars — photo-realistic patients generated from standard medical images

Anchor case · Stealth-mode
Silicon Valley company

The product turns a patient’s own CT or MRI series into an interactive three-dimensional avatar a clinician can walk around, cut through and rehearse against, in 2-D, 3-D and VR viewers running in parallel. The hard part is not the rendering demo. It is that the output is reviewed by people who operate for a living, and their standard of proof is anatomical, not aesthetic.

The pipeline carries a DICOM series through windowing and threshold choices into segmentation, then to surface extraction and mesh generation, then to something that holds an interactive frame rate on hardware a teaching hospital actually owns. Every one of those stages is a place to lose the thing the reviewer is looking for. Decimate too hard and the landmark a surgeon navigates by is gone. Smooth too much and a vessel stops branching where it branches. Get the material response wrong and tissue reads as plastic, which is the fastest way to lose a room. So the engineering discipline is to make each trade-off explicit and reversible — a documented list of where fidelity was exchanged for performance, so a clinical reviewer can argue with a decision instead of guessing that something is off.

This is C++, imaging and real-time rendering work held to a clinical standard of review. It is built for training and rehearsal. It is not a diagnostic tool, it is not cleared for clinical decision-making, and we will not imply otherwise.

Input

Standard CT and MRI series

Output

Interactive 3-D patient in 2-D, 3-D and VR

Review standard

Anatomical correctness, judged by surgeons

Client

Named nowhere — the company is in stealth

Read the medical 3-D avatars case →

National epidemic control platform

National public-health platform
Fixed date

A national platform managing inbound travel and public-health protocols during the pandemic: traveller submissions, protocol enforcement, and the operational reporting behind both — at the scale of everyone entering a country. Read it here as a data-protection problem first. A health declaration is sensitive personal data by any definition, including GDPR Article 9; this system held them for an entire travelling population, and the population had no alternative route. That changes what “handled carefully” has to mean: minimum-necessary access, an audit trail that answers who read which submission, retention that ends, and a boundary drawn around every party that touches the data.

The second half of the problem is that the rules changed while it was running. Protocols were rewritten by policy, sometimes at short notice, and the platform had to follow them without a maintenance window — which is an architecture decision made long before the first change request, not an operational heroic. And the launch date belonged to a border reopening, so the negotiable variable was scope, never quality and never the day.

Scale

Everyone entering the country

Data

Health declarations — sensitive personal data

Constraint

A date set by policy, and protocols that moved

Read the case →

Relationship-support platform — memberships, expert sessions and behavioural programmes at scale

Client confidential
Wellbeing, not clinical care

Placed accurately: this is not a clinical system

Memberships, scheduled sessions with experts, structured behavioural-science programmes and cohorts, plus the whole operational layer underneath — scheduling, content delivery, progress, billing and support — running at consumer volume. There is no diagnosis in it, no treatment, and no clinical record. It is wellbeing and behavioural support, and we are not going to let a section heading blur that line.

What it is honest evidence of: that we build sensitive, personal, high-volume products for people talking about the hardest parts of their lives, with the access control, the retention rules and the tone that requires — and that we know exactly where the boundary between wellbeing software and clinical software sits, because knowing it is the reason we can be trusted on the other side of it.

Bring one product. We will map where the data actually goes.

Series 06
PHI flow review

Thirty minutes, an engineer on the call rather than a sales team. If you are imaging- or simulation-led rather than platform-led, take the same slot as an integration feasibility review instead: what it would take to get from your imaging source to a rendered asset a clinical reviewer would accept. Same half hour, same one-page artefact, one booking flow. It is not a sales demo, not a capability deck, not a compliance audit, and not legal advice.

What we are engaged to do, what it usually takes, and what you hold at the end.

Series 07
7 engagements

Timelines are ranges, and they are estimates from people who have been wrong before. Everything in the third column is an artefact you keep — in your repositories, your cloud account, your diligence pack — whether or not the engagement continues.

Clinical 3-D, imaging and simulation

Anatomy from real imaging that a clinician will accept, running at interactive frame rates.

Typically8–20 weeks
to a reviewable prototype

The pipeline from DICOM series through windowing, segmentation and surface extraction to a renderable asset; the rendering layer itself; and a documented list of every place fidelity was traded for performance, so a clinical reviewer can argue with the decision instead of guessing at it. Range depends on the anatomy and, mostly, on the state of the source data.

HIPAA-aligned platform architecture, in your own environment

A system whose PHI flow you can draw on a whiteboard and defend in a review.

Typically6–14 weeks
to a production-ready slice

Deployment into your cloud tenancy or on-premise estate; encryption in transit and at rest; role-based access control with least privilege; an append-only audit log recording actor, subject, action and timestamp; consent and retention handling; infrastructure-as-code in your repositories; and a written PHI data-flow document your privacy officer can take into a review as-is.

FHIR and EHR integration layers

Clinical data in and results out, without the integration owning your roadmap.

Typically6–16 weeks
to a first live site

A FHIR R4 facade with US Core profiles over whatever the site actually speaks; an HL7 v2 path for ADT, ORM and ORU where that is the reality; terminology mapping to SNOMED CT, LOINC, RxNorm, ICD-10-CM or CPT treated as a maintained artefact rather than a one-off script; sandbox-to-production runbooks; and sequencing that keeps the rest of the product moving while site approvals grind. Longer across a fleet — each site is its own approval.

Public-health and population-scale platforms

A service that opens on a date set by policy and keeps working when the rules change.

Typically10–16 weeks
to a public launch

A critical path with scope negotiated down to what must exist on day one; a modelled surge profile; a degradation plan for every dependency; protocol logic that can be changed without a redeploy; and operational reporting that serves the duty team and the person briefing a minister on the same afternoon.

Patient and member experience, with accessibility taken seriously

Software that works for someone who is unwell, interrupted, or being helped by a relative.

Typically8–14 weeks

WCAG 2.2 AA tested with actual assistive technology rather than a scanner score; flows validated on old low-end devices and poor connections; plain-language content; and interface states designed for anxiety and interruption rather than for a demo. Two extra clicks per encounter is a rejection, and it is treated as one.

Document and record intelligence, with a clinician in the loop

Structure pulled out of referral letters, discharge summaries, prior-authorisation packets and scanned faxes.

Typically4–10 weeks
to a measured pilot

Extraction with per-field confidence; a review interface where a clinician confirms or corrects before anything is committed; a labelled evaluation set built from your documents with accuracy reported on them, not on a vendor sample; and corrections that feed back into the system instead of evaporating. Messy documents and messy operational data are our strongest general capability, and this is where it lands in healthcare.

Scoped AI work, with validation and a named human decision-maker

Narrow, evaluated, documented — and stopped early if the evaluation says stop.

Typically4–8 weeks
to a go / no-go

A defined task with a measurable success criterion; an evaluation set built from your data; a documented failure profile including where the model is confidently wrong; prompt and model versioning; and an architecture where a person decides and the model assists. If the honest answer after the evaluation is “this does not work well enough yet”, you get that in writing — and that is a successful engagement, not a failed one.

Next to the hardware

Volumetric capture rigs, headsets and imaging pipelines being demonstrated at Immerse Global Summit in Miami. We go to the places where this hardware is argued about, because the constraint that decides a clinical 3-D project is almost never the algorithm — it is what the capture produced, what the headset can hold at frame rate, and what the room will let you plug in.

Scanning rig · Immerse Global Summit, Miami

What we practise, and what we do not hold.

Series 08
Register

The left column is engineering we perform on the work. The right column is status we do not have. Both are on the page because a vendor who only publishes the left column is asking you to discover the right one yourself, later, in front of your own privacy officer.

Practices we perform

Deployment inside your environment — your cloud tenancy, your VPC or your on-premise estate, so PHI does not need to move to us at all.
Encryption of PHI in transit and at rest, with key handling that lives in your account rather than ours.
Role-based access control with least privilege, and access reviewed as part of the work rather than at audit time.
An append-only audit log recording actor, subject, action and timestamp — designed in at the schema, not bolted on when someone asks for it.
Consent and retention handled explicitly, including the part where data actually stops existing.
De-identification done properly where development allows it: DICOM headers, burned-in pixel text, dates, and the rare-value problem that re-identifies a record all by itself.
A written PHI data-flow document as a deliverable, agreed before the schema exists and handed over as an artefact in its own right.
Named engineers under NDA, working with you directly — no account-manager layer between you and the people writing the code.
Architecture signed off by a senior architect before development starts, on every project.
We will sign a BAA for engagements where we are a business associate.

Status we do not have

We are not HIPAA-certified — and neither is anyone else. HIPAA has no certification scheme. A vendor showing you a HIPAA badge is telling you something about their marketing, not their security.
No SOC 2. We do not hold one and we will not imply that we do.
No ISO 27001. Same answer.
Nothing we have built is a regulated medical device. No FDA clearance, no CE marking, no other regulatory approval — on any of it.
The 3-D avatar work is for training and rehearsal. It is not for diagnosis and not for clinical decision-making.
No award badges. We hold none, so none appear on this site.
The relationship-support platform is not clinical care — no diagnosis, no treatment, no clinical record.
Anything we have not confirmed, we do not claim. If a security practice you need is not written in the left column, ask on the call and you will get a straight yes or no rather than a brochure sentence.

The things you are already thinking.

Series 09
8 answers

What you are thinking	Our answer
“You are not HIPAA-certified.”	Nobody is — HIPAA has no certification scheme, and any vendor showing you a HIPAA badge is telling you something about their marketing. What we can do is sign a BAA, deploy into your environment rather than ours, encrypt PHI in transit and at rest, enforce role-based least-privilege access, keep an append-only audit log of who touched which record and when, and name the specific engineers under NDA who will have access. We also do not hold SOC 2 or ISO 27001, and we will not imply otherwise.
“PHI cannot leave our environment.”	Then it does not. We deploy into your cloud tenancy, your VPC or your on-premise estate, and we work against de-identified or synthetic data wherever development allows. Before any code is written we agree the data classification, the PHI flow and which boundaries are crossed — and that document is a deliverable in its own right, not a slide.
“We need a clinical-grade partner, not a web shop.”	Then judge us on the imaging work: standard medical images taken through segmentation and mesh generation into photo-realistic interactive 3-D patients that surgeons review for anatomical correctness. That is C++ and real-time rendering engineering held to a clinical standard of proof, not a marketing site with a login on it.
“Our EHR integration will take a year.”	It might, and no honest partner will promise otherwise — marketplace approval, a per-site security review and a go-live slot are outside anyone’s control. What we do is stop it blocking everything else: a FHIR facade behind which the product keeps developing, an HL7 v2 path for sites that are not ready for anything else, and the site-approval sequence run in parallel rather than in series.
“We tried an outside dev shop and it failed.”	Usually for one of three reasons: nobody senior stayed on it, the code came back undocumented, or the compliance requirements were treated as someone else’s problem. You get direct access to the engineers doing the work with no account-manager layer, architecture signed off by a senior architect on every project, and everything — source, infrastructure-as-code, migrations, runbooks — in your repositories from the first week.
“You are in Europe.”	Fluvius USA Inc is a US entity in Sacramento, California, and contracts on US paper. We work EU hours with a US-morning overlap, so a US team has live hours every working day and work continues while you sleep. Our delivery record includes a national government health platform in the Caribbean — remote delivery into a regulated environment is not a new problem for us.
“Can you talk about us afterwards?”	Only at the level of a technology stack and the roles on the team, and nothing beyond that without your written consent. Confidentiality is mutual and it does not expire when the engagement does.
“Who owns what you build — including anything a subcontractor touches?”	You do, at every stage: source, documentation, infrastructure and credentials. The transfer is worldwide, with no time limit and no territorial limit, and anyone we bring onto the work assigns their intellectual property to you in writing before they touch it — the clause most agreements leave out, and the one that matters on the day you raise or sell.

Where we turn up

Fluvius is a US company led from Ireland, with senior engineers across Europe and clients from digital-health startups to a national public-health programme. The reason we are in the room at immersive-technology and imaging events is narrow and practical: this work is decided by hardware, capture quality and frame budgets, and those are not things you learn about from a datasheet.

Georgiy Gres, founder of Fluvius, holding his attendee badge for the Immerse Global Summit in Miami Beach, Florida — Georgiy Gres, Founder & CEO · Immerse Global Summit, Miami

Not ready to talk? Take the questions with you.

Series 10
Doc PR-22

Gated checklist · PDF · 5 sheets

Before your first PHI review: 22 questions a privacy officer will ask your engineering team

Data flow, encryption, access control, audit logging, de-identification, subprocessors, BAAs and retention — in the order a privacy officer actually asks them, with the reason each one separates a real answer from a confident one, and a column to write your own answer in. Use it on your own team before someone else uses it on you.

One product, thirty minutes, one page you keep.

Series 11
PHI flow review

Bring a product that is live or in build. We map where protected health information moves through it today, which boundaries it crosses, who and what can read it, where the audit trail thins out, and what an imaging or EHR integration would really cost in time. Imaging- or simulation-led instead? Take the same slot as an integration feasibility review.

You keep the one-page data-flow diagram
An engineer on the call, not a sales team
Usable directly in a security review or diligence pack
Not a demo, not an audit, not legal advice