Reference build 01 · Healthcare
Telehealth Platform
Remote consultation with append-only audit trails and FHIR interoperability from day one.
What we'd be solving.
A clinic network wants remote consultations without losing the audit position it holds for in-person care. Every record access must be provable years later, the platform has to exchange data with an existing EHR, and a dropped video call cannot lose the clinical note.
The approach
Four decisions that shape everything else.
- 01
Separate the audit store from the app database
Access events are written to an append-only log that the application has no permission to update or delete. The operational database stays fast and mutable; the audit record becomes evidence rather than data.
- 02
A translation layer, not a shared model
FHIR R4 resources are mapped at the boundary into an internal domain model. Letting FHIR shapes leak into application code is what makes these systems impossible to change later.
- 03
Notes persist independently of the call
Clinical notes autosave to durable storage on a separate path from the WebRTC session, so a network failure costs the video and nothing else.
- 04
Consent modelled in the schema
Access is derived from an explicit consent relationship with validity windows and delegation, evaluated in the query layer rather than checked in controllers.
Telehealth Platform, in one picture.
- 01Consultation clientVideo session plus note-taking
- 02APIConsent evaluated in the query layer, not in controllers
- 03App databaseOperational and mutable — fast, and not the evidence
Deliberately off the main path
- Audit storeAppend-only. The application holds no UPDATE or DELETE on it.branches from 02 API
- Clinical notesAutosaved on a path separate from the WebRTC session, so a dropped call costs the video and nothing else.branches from 02 API
- FHIR R4 boundaryResources mapped into an internal domain model at the edge, never used as the model itself.branches from 02 API
What we rejected
The alternatives, and why they lost.
Anyone can list the technology they chose. What tells you whether a team can be trusted with your system is whether they can explain what they didn't choose.
| Option rejected | Why it lost |
|---|---|
| Storing audit events in the primary Postgres instance | The application would hold UPDATE and DELETE on its own audit trail, which undermines the point of having one. |
| Building video transport in-house | WebRTC infrastructure is a specialism with real operational cost. A managed provider with a signed BAA is the better trade. |
| Using FHIR resources as the internal domain model | FHIR is an interchange format. Modelling the application on it couples every feature to a spec you do not control. |
Other reference builds
Keep reading.
Start here
Tell us the problem.
We'll be honest about the fit.
A first conversation costs nothing and is useful even if you go elsewhere — you'll leave with an architecture opinion and a realistic sense of scope.
- Reply within 24 hours
- No sales sequence