FR/ENBook a call
Book a call
Sector · Healthcare & Pharma

Healthcare application developmentand AI transformation, under HDS constraints.

We design, take over, and modernize high-performance health applications that are GDPR-compliant and hosted on HDS-certified infrastructure.

Discuss your healthcare project Free 48-hour pre-scoping
APHP logo
Protectus logo
SIFEM logo
01 — The healthcare & pharma context

A regulated sector

Highly sensitive patient data, HDS and GDPR requirements, legacy or no-code applications at their limit, and a constant tension between time-to-market and compliance.

Data that cannot afford mistakes

Patient records, imaging, results: the slightest leak compromises your liability and the trust of healthcare professionals. Security is not a luxury—it’s the foundation.

HDS and GDPR are non-negotiable

Certified health data hosting, access traceability, consent, right to erasure: the framework is strict, and it evolves. Better to build it in from the start.

Legacy systems that hinder care

Ageing business applications or no-code tools that can no longer handle the load or business rules: technical debt slows down teams and patients.

AI already in use, with no framework

Reports rewritten in a consumer tool, letters drafted from a personal account: AI has already entered the wards. Without a governed, available alternative, it is patient data that leaves.

02 — Two ways forward

Build a tool, or transform your teams.

Two distinct services that often combine, but rarely at the same time. Custom development when a tool is missing. AI transformation when a method, real usage and a framework are missing. Scoping exists precisely to settle that.

Custom development

Custom medical applications

Web and mobile, offline mode, care and patient pathways. Built for the field.

WebMobileOffline
Application development
Custom development

Migration & modernisation to a sovereign stack

Moving from a struggling no-code or legacy system to maintainable code, hosted in France. Gradual transition, with zero service disruption.

MigrationModernization
No-code to code migration
Custom development

Taking over existing projects

No-code or “vibe-coded” application to take over: audit, data security, migration to maintainable and compliant foundations.

AuditTakeover
Project takeover
AI transformation

Train and upskill your clinical teams

Paths segmented by role and by level, built on the ward’s real cases: what is allowed, what is not, and how to use it without any patient data leaving.

TrainingUpskillingChampions
AI transformation
AI transformation

AI assistants / RAG on your health data

Use your protocols and reports with sovereign or local models. AI prepares and cites its sources; the clinician decides. Your data never leaves.

RAGSovereign
AI assistants connected to your data
AI transformation

Automate administrative tasks

Letters, reports, scheduling, file follow-ups: the workflows that give hours back to clinical teams, without touching care itself.

n8nWorkflows
Automation
03 — Compliance & sovereignty

Compliance is not a checkbox.
It’s the foundation.

For a healthcare organisation, the real question is not “does it work?” but “where does my data go, who decides, and can I leave?”. The answers are the same whether we build an application or equip your teams with AI. Here they are, plainly.

Hosting on HDS-certified infrastructure

Your health data is hosted in France, on HDS-certified infrastructure. Depending on your needs: managed mode, or self-hosting under your institution’s direct control.

No data outside the EU, models included

No dependency on a non-European cloud, neither for the application nor for the AI: Mistral or local / self-hosted models. Your patient data and the documents submitted to the models stay in France.

GDPR by design

Data minimisation, traceable consent, right to erasure, processing register, anonymisation or pseudonymisation depending on use: GDPR is built in from design, never bolted on afterwards.

RLS on all tables

Row-Level Security at the database level: every access is filtered by role and institution. Data separation isn’t just application-level—it’s embedded in the engine.

AI prepares, the clinician decides

No procedure, diagnosis or patient pathway decided by a machine. AI drafts, retrieves a protocol, cites its source; a professional validates. It is a design principle, not an option.

Guaranteed reversibility

The code is yours, the data is exportable, the hosting is transferable. You’re never locked in with Scroll.

04 — Proof

Healthcare and pharma projects already in production.

From an international laboratory to hospital systems and medical imaging. Custom-built applications: the same foundation we reuse to deploy AI in a constrained environment.

International pharmaceutical laboratoryPharma · Over €3bn revenue · France & Spain
AI assistantAI ActGDPRMulti-country

An AI assistant embedded in the field teams’ sales enablement platform.

In production in France and Spain. The assistant is embedded in the existing business platform, with no redirect and no re-authentication — field adoption determined everything else. Deliberately sober architecture: a custom application proxy rather than an off-the-shelf orchestrator, so the in-house team can take over. Compliance handled with the DPO from the scoping stage, not as a final sign-off: transparency about the nature of the system, auditable logging, pseudonymisation, and a functional scope that excludes personal and health data by construction.

AP-HPPublic health · Hospital

Smart pre-consultation for AP-HP

An anonymous patient journey that turns waiting room responses into a structured medical report, accessible to the doctor via QR code.

ProtectUsHealthcare · No-code to code migration

Hospital RFID system rewritten for a dozen facilities.

Migration from Bubble to Next.js 15 + Supabase, self-hosted with OVH. Reversible switch, cabinet by cabinet, with no disruption to care services.

Next.js 15SupabaseOVHSelf-host
protectus.eco ↗
SIFEMMedical imaging · Women's health

dPEI Pocket — endometriosis scoring for radiologists.

Web and mobile medical application (iOS/Android) with offline mode and PDF generation. Deep pelvic endometriosis scoring; anonymised data processed by region.

WebiOS / AndroidOfflinePDF
05 — Stack & Method

A stack built to last and to be audited.

Modern, maintainable, hireable. Traceable end to end: every access is logged, every deployment is tested. And AI that stays in its place — sovereign, supporting, never deciding.

Front

Next.js
React
TypeScript

Back / Data

Supabase
PostgreSQL
RLS

Hosting

Scalingo (HDS)
Data in France
Self-host

Security

Encryption
Access logging
GDPR

AI

Mistral
RAG
Local / self-host

Quality

CI/CD
Non-regression tests
Code review
06 — Starting small

We never start with a big project.

A first, tightly scoped perimeter, delivered and measured before any long-term commitment — that is how our most demanding clients started with us.

  1. A scope, not a programme

    One specific service, care pathway or internal tool, scoped with your teams: a patient triage tool, a department dashboard, an assistant on your internal protocols.

  2. 4 to 6 weeks, measured

    Scoping, build, go-live on HDS-certified infrastructure, then measurement of the time saved or the service delivered. A human decides at every step.

  3. Then scale up, if it holds

    The scope widens based on what has been measured — never on a promise.

    Proof: our first project with a major public healthcare institution started on a bounded scope before being rolled out more widely.

Define your first scope Hosting on HDS-certified infrastructure · data in France · full reversibility
07 — FAQ

Frequently asked questions

Your questions, our answers

HDS (Health Data Hosting) is a mandatory French certification for hosting personal health data. It enforces strict security, confidentiality, and traceability guarantees. In practice: any application storing patient data must rely on HDS-certified infrastructure. We host your applications on HDS-certified infrastructure in France.

In France, on HDS-certified infrastructure. No data leaves the European Union. Depending on your needs, in managed mode or via self-hosting under your establishment’s direct control.

Yes, by design: data minimisation, traceable consent, right to erasure, processing register, Row-Level Security at the database level. GDPR compliance is built in from the outset, not added later.

Yes, under three conditions we systematically enforce. Models run in France: Mistral, or locally/self-hosted on HDS-certified infrastructure—nothing is sent to public services. Usage is limited to preparation (drafting, retrieving protocols, summarising files), never clinical decision-making. Every response cites its sources for verifiability. This is precisely what replaces the unregulated AI already used in services.

Yes. We audit the existing solution (legacy, no-code, or AI-generated code), secure the data, then migrate it to a maintainable, compliant foundation in stages—without service disruption.

Data encryption, Row-Level Security on all tables, access logging, anonymization based on use case, and systematic code reviews. Security isn’t a final step—it’s built into the architecture.

Yes — that is actually how we start. A first, bounded scope — a care pathway, a department or an internal tool — delivered in 4 to 6 weeks on HDS-certified infrastructure, then measured. Scaling up is decided on what was measured, never on a promise.
Noel Vignacq
Your contact

Noel Vignacq

Commercial Director

Your contact knows the constraints of health data: HDS hosting, traceability, human validation.

Talk to Noel

“We were looking for a partner able to migrate our Bubble application after several scalability issues. Scroll delivered a gradual migration, with no downtime, on an interoperable stack, and transferred the knowledge to us along the way. The result: latency divided by 4 and “legacy” reduced to zero.”

Jean-Robert AgherJean-Robert Agher (LinkedIn profile, opens in a new tab)Head of Innovation · ProtectUs
Let’s discuss

A healthcare application to build, or teams to train on AI? Start with the free 48-hour pre-scoping: you will know where to begin before committing.

Contact details
20 Rue des Taillandiers
75011 Paris
Response within 24 business hours.

Resources

Recommended guides

In-depth resources explaining the choices, methods and challenges behind this service.

Proof

Related case studies

Delivered projects showing this expertise in real-world contexts.

Explore further

Related services

Complementary expertise for building a coherent delivery path.