Can you follow IEC 62304?

Yes. We work to IEC 62304 within your procedures: a development plan, requirements, architecture, a SOUP list, verification records and traceability, scaled to your software safety class. Your quality team approves the records and owns the design history file.

How do you handle device cybersecurity?

We plan it from the first sprint: threat modeling, an SBOM kept current with every release, authenticated device and API connections, encrypted data and a process to monitor and patch vulnerabilities after launch, documented for your submission.

Clinician working at a laptop in a medical device office, with a device companion app sync status and an IEC 62304 records checklist

Healthcare / MedTech and Devices

Medical device and SaMD software development

Device makers need companion apps, cloud platforms and SaMD built with the records regulators review, by a team that works inside their quality process. Agnotic Technologies builds medical device software with requirements traceability, risk-aware design and cybersecurity planned in from the start.

15-Minute Scoping Call

IEC 62304

Software life cycle activities and records

SaMD

Software that is a medical device on its own

BLE · FHIR

From device data to the clinical record

Trusted by global innovators

Industry Overview

What is medical device software development?

Medical device software development is building software that is part of a device, connects to it, or is a medical device on its own (SaMD), together with the life cycle records regulators review. Agnotic Technologies builds companion apps, cloud platforms and SaMD for device makers, working inside the manufacturer's quality management system.

What you are building

Which kind of device software do you need?

Device software comes in several forms, each with its own risks and records.

Companion apps

Mobile apps that pair with a device and show its data.

Reliable Bluetooth pairing and reconnection
Readings stored offline and uploaded later
Clear guidance for patients at home

Software as a Medical Device

Software with a medical purpose that is not part of a hardware device.

Intended use and software safety class defined early
Traceability from requirements to tests
Records that fit the regulatory submission

Connected device platforms

Cloud services that receive, store and analyze device data.

Device identity and secure data ingestion
Fleet and update management
Data for postmarket monitoring

Clinical integration

Getting device data to clinicians where they work.

FHIR Observations into the EHR
Remote monitoring program workflows
Alerts that reach the right clinician

Industry Challenges

What cybersecurity do regulators expect for connected devices?

For devices that include software and can connect to the internet, section 524B of the FD&C Act sets cybersecurity requirements for premarket submissions. We design for them from the first sprint.

A plan to monitor, identify and address postmarket cybersecurity vulnerabilities and exploits.
Processes that provide reasonable assurance the device and related systems are cybersecure, including updates and patches.
A software bill of materials covering commercial, open source and off-the-shelf components.
Threat modeling and security risk assessment documented as part of the design, not added before submission.

Our Approach

How do we build companion apps and cloud platforms for devices?

Device data has to arrive complete, correct and on time, from the patient's home to the clinician's screen.

Reliable connection

Bluetooth pairing, reconnection and offline buffering tested across the phones your patients use.

Data integrity

Timestamps, units and device identifiers kept intact from the device to the database.

Clinical delivery

Device data mapped to FHIR Observations for EHRs and remote monitoring programs.

Capabilities

What do we build for MedTech companies?

Software around the device, from the patient's phone to the cloud and the clinic.

Device companion apps

iOS and Android apps for pairing, readings, guidance and reminders.

Device data cloud

Secure ingestion, storage and processing of device readings.

Clinician portals

Views of device data, trends and alerts for care teams.

Update and fleet management

Tracking device and app versions and delivering approved updates.

Remote monitoring integration

Device data delivered into remote patient monitoring programs.

Postmarket data

Usage, error and complaint data organized for postmarket surveillance.

Engineering Stack

Which standards and technologies do device projects use?

The standards and platforms we work with on medical device software.

Standards

IEC 62304ISO 14971IEC 62366-1FHIR R4

Connectivity

Bluetooth Low EnergyMQTTHTTPS

Apps

SwiftKotlinReact Native

Backend

PythonNode.jsPostgreSQL

Infra

AWSAzure

Working inside your QMS

How do we work inside your quality management system?

We follow your procedures and produce the records your quality team needs. Your team approves them and owns the design history file.

IEC 62304 activities, the records we produce and who approves them
IEC 62304 activity	What we produce	Who approves
Development planning	A software development plan aligned with your QMS procedures	Your quality team
Requirements	Software requirements traced to system requirements and risk controls	Your product and quality teams
Architecture and SOUP	Architecture description and a list of software of unknown provenance with versions	Your engineering lead
Verification	Unit, integration and system test records traced to requirements	Your quality team
Risk management	Software inputs to your ISO 14971 risk management file	Your risk management owner
Problem resolution and change	Tracked defects and controlled changes for every release	Your change control board

Measured Impact

What should device software teams measure?

Measures that show the software is reliable and its records are complete.

Sync

Successful syncs

Device readings that reach the cloud, divided by readings taken.

Latency

Time to clinician

Time from a reading on the device to its appearance in the clinician view.

Traceability

Requirements with tests

Software requirements linked to at least one passing verification test.

Vulnerabilities

Open known vulnerabilities

Known vulnerabilities in SBOM components, by severity and age.

My Lauren Maternal Health Platform | Built by Agnotic

A HIPAA-ready maternal health platform enabling remote patient monitoring, care coordination, and personalized engagement from pre-pregnancy through postpartum.

Case Study

Read the case study

My Lauren Maternal Health Platform | Built by Agnotic

LERA Health: Compliant Women’s Health App Platform

A women’s health product experience focused on guided care journeys, education, and compliance-aware workflows to support long-term engagement.

Case Study

Read the case study

Use Cases

What kinds of device software do we build?

Device categories where companion apps, cloud platforms and SaMD meet.

Home monitoring devices

Blood pressure monitors, scales and pulse oximeters for remote monitoring.

Glucose monitoring

Companion apps and data platforms for glucose monitoring programs.

Wearable sensors

Continuous signals from wearables turned into clinical data.

Digital therapeutics

SaMD that delivers a therapy through software.

Home-use therapy devices

Apps that guide and record therapy sessions at home.

Clinical decision software

Software that analyzes device data to support clinicians.

Integrations

Which systems do we integrate for device makers?

Connections between devices, phones, clouds and clinical systems.

Devices

Bluetooth Low Energy devices

Phones

Apple HealthKitHealth Connect

EHR

EpicOracle Health (Cerner)

Programs

Remote monitoring platforms

Compliance-First Development Services Backed by Global Standards

We build secure, scalable products designed for privacy, interoperability, and regulatory readiness from day one across every sector we serve.

Health Insurance Portability and Accountability Act

Protect PHI with privacy-first architecture, encrypted storage and transmission, and strict access controls.

Fast Healthcare Interoperability Resources

Enabling standardized health data exchange through standards-based API mappings.

Our Edge

Why Global Leaders Choose Us

We combine deep technical expertise with industry-specific knowledge to deliver solutions that aren't just functional, but transformational.

Enterprise-Grade Security

We implement rigorous security protocols and compliance standards (HIPAA, GDPR, SOC2) across all industrial solutions to protect sensitive data.

High-Performance Scaling

Our architectures are built to handle massive data loads and user bases, keeping performance steady whether you're serving ten or ten million.

Accelerated Time-to-Market

Using our suite of internal tools and proven frameworks, we reduce development cycles and get your product to market 40% faster.

Embedded AI Integration

Beyond simple wrappers, we build deep-learning integrations and predictive analytics directly into the core of your industry-specific workflows.

Engagement Model

How does an engagement with a device maker work?

We align with your design controls from the first meeting. Timing depends on scope and safety class, and we agree it on the scoping call.

Scoping call

We agree intended use, scope, safety class assumptions and the records you need.

Planning in your QMS

A development plan written to your procedures and approved by your quality team.

Build with traceability

Requirements, design, code and tests linked as we go, not reconstructed later.

Verification

Verification records and the SBOM prepared for your design history file.

Release and support

Controlled releases, vulnerability monitoring and maintenance under agreed terms.

Facts and sources

Which rules shape medical device software?

Short facts on the regulations behind device software, each linked to its official source.

Section 524B of the FD&C Act requires premarket submissions for cyber devices to include a plan to address postmarket vulnerabilities and a software bill of materials.
Source: 21 U.S.C. 360n-2 (US Code)
FDA's Quality Management System Regulation in 21 CFR Part 820 incorporates ISO 13485:2016 by reference.
Source: 21 CFR Part 820 (eCFR)
Section 520(o) of the FD&C Act lists software functions excluded from the device definition, which helps decide whether software is regulated as a device.
Source: 21 U.S.C. 360j (US Code)
The HIPAA Security Rule requires administrative, physical and technical safeguards for electronic protected health information.
Source: 45 CFR Part 164 Subpart C (eCFR)

Voice of success

We don't just build products; we forge lasting partnerships. See how we've helped industry leaders transform their vision into technical reality.

“I can clearly see how Agnotic has a unique way of handling end-to-end development. They are always active on quick chat and provide support quickly.”

Aaron Phelan

Founder, Benchmark

“Agnotic combines deep technical expertise with strong domain knowledge. They understand the business context, anticipate challenges, and make collaboration smooth and effective.”

John Pasmore

Founder, Latimer

“Agnotic is the best technical team we evaluated. Their engineering excellence made our work dramatically easier and allowed us to stay focused on what matters most for maternal care outcomes. They took full ownership of the technical execution, and we are always happy to continue working together.”

Kim Smith

Founder, My Lauren

Related services

Where can device makers start with us?

Detailed pages for the services MedTech companies ask us about.

FDA SaMD compliance

What SaMD rules mean for the software you build.

BLE medical device integration

Bluetooth device pairing and data capture.

IoMT connected devices

Connected device platforms for healthcare.

Remote patient monitoring software development

Device data, care team workflows and billing support for RPM programs.

Telemedicine platform development

Virtual visit platforms with scheduling, video and EHR integration.

EHR software development

Custom EHR modules and platforms built around clinical workflows.

HIPAA requirements for software teams

The safeguards we build into every healthcare product.

The Same Engineering Patterns, Across Other Industries

The technical patterns behind this platform translate naturally into adjacent verticals.

AI

Apply private LLM and RAG architectures to clinical knowledge bases.

Education

Extend secure platform engineering to medical education and CME workflows.

Gov & Research

Power national health datasets and population health initiatives.

Frequently Asked Questions

ISO 13485 certification applies to the manufacturer's quality management system. As your software development partner we work inside your QMS as a supplier, following your procedures and producing the design, verification and change records it requires.

Industries