How we build software clinicians can trust
Clinical software earns trust slowly. This page explains how we build, test and release it, and where we stand on regulation today, including what isn't done yet.
How we work
Intended use comes first.
Before we build a clinical feature, we write down what it's for, who will use it and what it must not be used for. Every later decision is checked against that statement.
Clinicians stay in charge.
OncoSync surfaces guideline-referenced options and flags gaps in a case. The treating clinician makes the decision, and the record shows how it was reached.
Traceable logic before learned models.
Our first release uses rule-based logic that a clinician can trace back to its published source. Learned models will come later, and only when we have the evidence and the data governance to support them.
Specialist review, on the record.
Practising specialists walk through each clinical module. Every change they ask for is logged with the name of the person who made it and confirmed before formal validation.
Documented release gates.
Nothing clinical reaches production without passing a written release gate covering testing, clinical sign-off and traceability.
Synthetic data for pipeline testing.
We test our guideline pipeline with synthetic content, so third-party guideline material isn't used before permission is in place.
Where we stand today
We'd rather tell you exactly where we are than overstate it. Here's our current status.
| Area | Status | What it means |
|---|---|---|
| Medical device regulation (India) | In progress | OncoSync is being developed along CDSCO's pathway for software as a medical device, targeting Class C. It isn't registered or licensed by CDSCO yet. |
| Quality management system | In place, growing | We run a documented QMS with controlled documents, release gates and change records. It isn't certified yet. |
| ISO 13485 | Planned | Certification hasn't started. We'll publish the timeline here once it's set. |
| ISO/IEC 27001 | Planned | Not certified. We'll list our information-security controls here as each one is documented. |
| Data protection (DPDP Act 2023) | In progress | Consent and data-handling design for India's Digital Personal Data Protection Act is underway. |
| Clinical guidelines | Seeking permission | We're approaching guideline publishers for permission to encode their recommendations. No guideline body certifies or endorses OneHeal or its products. |
| Other markets | Planned | Regulatory submissions outside India will follow CDSCO. For Gulf projects, we map our controls to Saudi PDPL and NCA requirements. |
Medical device regulation (India)
In progressOncoSync is being developed along CDSCO's pathway for software as a medical device, targeting Class C. It isn't registered or licensed by CDSCO yet.
Quality management system
In place, growingWe run a documented QMS with controlled documents, release gates and change records. It isn't certified yet.
ISO 13485
PlannedCertification hasn't started. We'll publish the timeline here once it's set.
ISO/IEC 27001
PlannedNot certified. We'll list our information-security controls here as each one is documented.
Data protection (DPDP Act 2023)
In progressConsent and data-handling design for India's Digital Personal Data Protection Act is underway.
Clinical guidelines
Seeking permissionWe're approaching guideline publishers for permission to encode their recommendations. No guideline body certifies or endorses OneHeal or its products.
Other markets
PlannedRegulatory submissions outside India will follow CDSCO. For Gulf projects, we map our controls to Saudi PDPL and NCA requirements.
Standards we design to
We design our products and integrations around open healthcare standards, so data can move between systems without being re-keyed:
- HL7 FHIR R4, with mCODE as our primary conformance target for oncology data
- ABDM and NRCeS profiles for India's digital health ecosystem
- DICOM workflows for imaging
Designing to a standard isn't the same as being certified against it. We'll note formal conformance testing here once it's complete.
Security and privacy in practice
- Role-based access, scoped by speciality, site and case
- Two-factor authentication on clinician accounts
- An audit trail of activity on every patient record
- Personal data redacted from application logs
- Hosted on Amazon Web Services, with our own configuration and monitoring on top
The same discipline in our services work
Our integration and PMO projects follow the same habits: requirements traced to delivery, compliance matrices kept up to date, and every change agreed in writing through a change request before work starts.
This page is updated as our status changes. Last updated: October 2026. Questions about quality or regulation? Write to us at info@onehealtech.com.
Questions from your IT or security team?
Security questionnaires, data processing terms or architecture reviews — we'll get you what your team needs.