Healthcare
Patient-facing sites, booking and intake flows, and clinic systems built with accessibility and data protection designed in rather than added later.
What we build for healthcare
Most healthcare work divides into two. There is the public side, where a site has to load quickly on a poor connection, be readable by a screen reader and let someone book without calling. And there is the operational side, where a clinic needs scheduling, records and reporting that its staff can actually use during a busy morning.
Privacy is an architecture decision
Health data attracts the strictest treatment under every regime Tankar builds for. Consent, purpose, retention and deletion are designed into the data model at the start, because retro-fitting them means rewriting the parts that already hold the data.
Typical engagements
The systems Tankar builds for healthcare, as deliverables rather than adjectives.
- Fast, accessible brand and clinic websites with content the marketing team edits
- Appointment booking and patient intake flows that work on a low-end phone
- Clinic and practice operations dashboards for scheduling, records and reporting
- Patient portals for results, documents and secure messaging
- Integrations with practice management, laboratory or pharmacy systems where an interface exists
- Consent, retention and deletion handling built into every form that collects health data
Compliance notes
The rules that shape a build in this sector and how they are handled in the system rather than in a policy document.
| Requirement | How we build for it |
|---|---|
| HIPAA-aware | For US clients, systems that touch protected health information are designed with the HIPAA safeguards in mind, including access control, audit logging, encryption in transit and at rest, and minimum necessary access. The covered entity remains responsible for its own compliance programme, and a business associate agreement is agreed with your legal adviser before any such data is handled. |
| GDPR and UK GDPR | Health data is a special category under GDPR and UK GDPR, so it needs an explicit lawful basis, a documented purpose, a retention period that is enforced in the system, and a route for a patient to obtain or delete their record. |
| India DPDP Act 2023 | Health data is personal data under the Digital Personal Data Protection Act 2023. Consent is recorded with its purpose, data is limited to what the service needs, and deletion is possible rather than theoretical. |
| WCAG 2.2 AA | Patients include people using a screen reader, a keyboard or a magnified screen. Accessibility is tested on every release rather than claimed, because a booking form that fails on a keyboard is a booking that does not happen. |
Representative work
Case studies relevant to this sector. Only outcomes with a source are shown.
Tell us what you are building.
NDA on request. Written estimate within 48 hours of a scoped call. Reply within one business day.