Case study · Built by our founder
VocalMD
A telehealth app where patients log in with their hospital credentials, pull their real medical records, and consult US doctors over encrypted chat, voice, and video, all inside one app on iOS and Android.
The story
VocalMD predates Inseed. Our founder built it as the sole mobile engineer and mobile architect on a two-person build, under Rehan on the LaunchX engagement, years before Inseed existed. It is founder-portfolio work, not an Inseed client project, and it is the healthcare and compliance story the team leans on.
The product connects US doctors and patients for online consultations, and it carries the weight that comes with that: it handles protected health information, so HIPAA is a floor, not a nice-to-have. Patients needed to reach a real doctor, share their actual medical history, and talk over chat, voice, or video, without any of the plumbing leaking their data or pushing them off-platform to swap personal phone numbers and emails.
The brief was to make all of that feel ordinary. A patient should log in, see their records already there, pick a doctor, and start talking. Every genuinely difficult piece, the encryption, the record sync, the masked calling, had to disappear behind a screen that felt like any consumer health app.
What we built
The app shipped both sides of the marketplace in a single bare React Native codebase: the patient app for finding a doctor, syncing records, and consulting, and the doctor app for managing availability, dashboards, and patient conversations. Our founder owned the entire mobile surface end to end, from architecture through App Store and Play Store deployment, while a single backend engineer built the NestJS and PostgreSQL services behind it.
Rather than build real-time messaging, voice, and video from scratch, the app integrated GetStream so the whole doctor-patient conversation stayed inside VocalMD. Onboarding pulled a patient’s medications, conditions, and lab reports automatically through EPIC via FHIR, so people did not have to hand-type their medical history. Subscriptions and in-app purchases ran through RevenueCat.
Because the stakes were clinical, the compliance work was designed in, not bolted on. All sensitive data was end-to-end encrypted with the Virgil Security SDK so no PHI was exposed in transit, and doctor phone numbers were masked so patients could call without ever seeing a personal line.
Architecture
The mobile app is bare React Native (not Expo) in TypeScript, with Redux for app state and React Query for server state, and Firebase Auth for sign-in. The backend is NestJS on PostgreSQL, built by the one backend engineer on the team. That split let the mobile side move fast without waiting on a large services layer.
The compliance posture rests on three deliberate choices. First, end-to-end encryption of sensitive data through the Virgil Security SDK, so protected health information is never exposed in transit. Second, keeping every doctor-patient interaction inside the app through GetStream, which removes the off-platform sharing of personal contact details that most telehealth workarounds fall back on. Third, masked calling: doctors verify with their real number, but a native bridge to the Doximity Dialer iOS SDK means patients only ever reach a masked line.
The EPIC FHIR integration is the other load-bearing piece. Patients authenticate with their hospital credentials and the app pulls medications, conditions, and lab reports directly from the hospital record, which is what lets onboarding feel like a login rather than a data-entry form.
Selected screens
User journey
Stack
One decision worth telling
Doctors had to register their real phone number to verify their identity, but the moment a patient placed a call, that personal number was exposed. On a healthcare product that is not an acceptable leak, and there was no off-the-shelf React Native solution for it.
The fix was to drop down to native. Our founder wrote a custom React Native bridge to the Doximity Dialer iOS SDK, which masks the doctor’s number, and wired it into the app so patients could call a doctor directly without ever seeing a personal line. It is the clearest example of what the whole build required: reaching past the JavaScript layer into a native SDK to make a compliance requirement disappear behind an ordinary call button.
Outcome
What we would do differently
Most agencies skip this section. We include it because honest hindsight is the kind of credibility you cannot buy.
The masked-calling bridge to the Doximity Dialer SDK was the highest-risk piece, and it could only be exercised properly on a real device. A device-level test harness built at the start, rather than mid-flight, would have made each iteration on the native layer faster and cheaper to verify.
Hospital record systems do not all expose FHIR data the same way, so the mapping from a hospital login to clean medications, conditions, and labs is more of a moving target than it first looks. Budgeting for that variability up front, instead of hardening it per hospital, would have smoothed the record-sync experience sooner.
Encryption, masked calling, and on-platform communication were all designed in rather than bolted on, which was the right call. If anything, we would push that discipline even earlier: on a HIPAA product, the compliance primitives are the foundation every feature sits on, and settling them first removes a whole class of rework later.
Related work
Built by Inseed
Zero to App Store in under 4 months. Past 3,000 users in the next 3.
Read the case studyBuilt by Inseed
Vibe search shipped in 3 weeks. AI searches up ~200%.
Read the case studyHealthcare, encryption, native SDKs, health-record integrations. Tell us what you are shipping and we will tell you what the first four weeks can de-risk.
Book your audit