The context
A public medical research organisation wanted to put laboratory work directly at the service of sensitive surgical procedures. Algorithms developed by its research teams can predict blood flow and, from that, help a practitioner compare several possible approaches before going into theatre.
The subject came with two non-negotiable constraints. The data involved is among the most sensitive that exists, and the computation had to be usable on the timescale of preparing an actual procedure, not on the timescale of a scientific publication.
What we did
We built the platform connecting practitioners and researchers.
- End-to-end encryption between practitioner and researcher, designed so that the platform operator itself cannot read the exchanged content. That is an architectural constraint rather than a configuration option: it is decided at the beginning or never.
- Key management in two distinct layers, with AWS KMS for the infrastructure one: encryption at rest for storage, backups and logs, key rotation, and an audit trail of key usage. That is the layer an auditor comes to inspect. It grants no access to the content exchanged between practitioner and researcher, whose keys stay at the two ends and are never sent to the platform. Conflating the two layers is the mistake that turns end-to-end encryption into plain encryption at rest.
- Industrialisation of the prediction algorithms coming out of the laboratories, so they run reproducibly and traceably on AWS rather than on a researcher’s workstation.
- 3D visualisation of blood flow in motion, in the browser: the practitioner watches the flow unfold over time and rotates the model, instead of reading a table of values. That is what makes the computation usable when preparing an operation, because a surgeon reasons about an anatomy, not about tabulated velocities.
- Compliance work for CE marking, the software falling within the medical device scope: design traceability, risk management, and control over which versions reach a practitioner. We designed the platform so that this evidence is produced by the system itself rather than reassembled by hand at assessment time.
- The application journeys on both the practitioner and researcher sides, including collection of the data the computation needs, designed to be understandable by both profiles.
- Isolation, auditability and retention periods appropriate to health data, with the corresponding evidence.
The outcome
Algorithms that lived in a research environment became a tool usable while preparing an intervention, without the research team having to turn itself into an operations team.
This is the kind of project where the architecture is only worth anything if it is beyond reproach on confidentiality: a health platform that leaks is not a degraded platform, it is a platform that has to be switched off.