What a health startup actually has to build before its first feature (and what you can skip)

Every health app starts the same way. You have an idea (a symptom tracker, an AI assistant for lab results, a remote-monitoring dashboard), and before you can ship the first screen that matters, you are designing a database for “a patient’s medical record”.

That is where months go. Here is the list we kept running into, and what we decided you should not have to build yourself.

The invisible backlog. Before the first real feature, a health product needs:

A data model for medical records (measurements, labs, conditions, medications, documents, with units, reference ranges and real measurement dates).
Standard codes: LOINC, ICD-10, ATC.
An API and its docs.
Patient-authorized access: consent that expires, can be revoked, and is visible to the person.
Audit and provenance: who wrote this value, and what it looked like before it was edited.
Lab data intake: HL7 v2 or CSV.
Test data that looks like real patients.

None of these is your product. All of them are required before anyone trusts it.

Use the standard instead of inventing one. HL7 FHIR R4… the catch is that running a FHIR server well is its own product. That is the part we built as Anpheros: a managed FHIR R4 record per patient, REST API, consent and provenance, hosted in the EU.

What the backend looks like on top of it. A code snippet from backend-ts (summary of a record + writing a weight with a LOINC code). Plus two practices worth copying even without Anpheros: it refuses a production key without ALLOW_LIVE=1, and it maps upstream errors to answers the UI can show (401 → 502, 429 → 503, request_id).

Try it in about ten minutes. The 30 synthetic patients, curl, npm install @anpheros/sdk / flutter pub add anpheros_sdk, and the other starters (lab, consent, ai-context).

What it is not, honestly. Not an EHR. Private beta, single-zone hosting, no contractual SLA, no ISO 27001 / SOC 2 / medical-device certification claimed. Production needs a verified organisation and a signed DPA.

It ends with a question to readers: what did they end up building from scratch in their own health project.