Security & Compliance Foundations

Workflow: 5-Role Clinical CRM

Before: Staff needed to handle patient records, signed consent, blood-test results, and GP letters across different roles — without paying for off-the-shelf software and without messy spreadsheets.

Outcome: Staff swap paper and spreadsheets for one tidy system with a full record of every action. Reading blood tests from a photo saves real time per patient, and locked consent means the clinic is legally covered from day one.

System: One system covers the whole patient visit: a guided intake form, signed consent that locks once it's done, AI that reads blood-test results straight from a photo, GP letters and invoices generated for you, and a record of every action for your protection. Each staff member only sees what their job needs.

Workflow: Locked Down and Built to Stay Up

Before: A site holding scholarly work, member accounts, and donation details can't go live with a serious security hole or a shaky setup. The code it started from had a critical flaw that let attackers take over accounts, plus weak bot protection and no safety net for outages.

Outcome: The site goes live with no known critical holes and several layers of protection — bots and abuse blocked up front, everything kept apart so a problem in one place can't spread, and automatic backups and monitoring that catch trouble before anyone notices.

System: Closed a critical hole that let attackers take over accounts without a password (rated CVSS 9.1), and added layers to keep bots and break-in attempts out. The setup runs in isolated containers with off-site backups, round-the-clock uptime monitoring, and a process that ships updates safely and the same way every time.

Workflow: Patient Records Built to NHS Standards

Before: Clinical software built on a sloppy records structure can't talk to NHS systems and won't pass review. Getting this right first is the hardest, most important call — fix it later and you rebuild everything.

Outcome: A records foundation that fits NHS systems and holds up under review — built once, correctly, before any screens. Everything else in FlapTrack is built on top of it.

System: Patient records covering the whole flap-surgery journey, built to the standard the NHS uses. Safety checks live inside the records themselves, so bad data can't sneak in. Each hospital only sees its own patients — that separation is locked in by the structure, not left to app code to remember.

Workflow: Automatic Red/Amber/Green Safety Alerts

Before: Deciding whether to call the surgeon now or wait can't hang on gut feel — that's inconsistent and slow. A safety call this important needs clear rules that always fire the same way and can't be talked out of.

Outcome: Safety alerts that fire the same way every time, leave a clear trail, and can be reviewed by a Clinical Safety Officer without reading any code.

System: Reads the bedside observations and gives a Red, Amber, or Green result using fixed safety rules — no guessing, no AI making it up. The same readings always give the same answer, and every alert scenario has a test proving it still works. The rules run on the server, so the result can't be faked or skipped from the app.

Workflow: Clinical Homework & NHS Approval Plan

Before: Health software that doesn't understand the real clinical work, or have a plan for NHS approval, fails at the first review. That groundwork has to come before any product code.

Outcome: The clinical and approval groundwork is written down and checkable: it reflects real surgical practice, and the route to NHS approval is clear to reviewers, investors, and clinical partners.

System: Built on how 20 flap types are actually monitored across 3 specialties, grounded in 5+ peer-reviewed papers and NHS guidance, with 24+ rival systems studied. A plan maps out every NHS approval the product will need and where it stands on each — none earned yet, but the path is written down, not guessed.