Healthcare · Telehealth · E-commerce · Case study
Zeuss LLC: A HIPAA-aware telehealth platform and medical CRM on Azure
Telehealth platform case study: patient storefront, doctor and agent CRM, 20+ Azure microservices, pharmacy and payment integrations, HIPAA safeguards.
- Client
- Zeuss LLC offers hormone therapy, weight loss, hair restoration and lab testing programmes to patients across the United States through a digital telehealth service.
- Team
- 3 engineers, 1 designer
- Timeline
- 5 months to launch, then ongoing support
- Services
- Enterprise software, Cloud and DevOps, Web development
- 20+
- Microservices in the backend
- 37+
- Azure Functions for event processing
- 12+
- Third-party integrations
- 7+
- Dedicated MongoDB databases
In short
Zeuss LLC needed a complete telehealth business in software: a patient storefront with medical intake, a CRM where doctors review and approve treatment, and automated pharmacy fulfilment, all handling protected health information. We designed, built and deployed the platform on Microsoft Azure: three frontends, more than 20 microservices, 37 or more Azure Functions and 12 or more integrations, with encryption, audit logging and role-based access aligned to HIPAA technical safeguards.
Where they started.
- Sell regulated treatments online with medical questionnaires, identity verification and doctor approval before any prescription is fulfilled
- Give doctors, customer service agents and administrators one system with different workflows and strict access boundaries
- Coordinate an e-commerce platform, a pharmacy, a payment tokeniser, a helpdesk and marketing tools without brittle point-to-point code
- Handle protected health information with encryption, audit trails and secrets management that would stand up to review
- Keep patients informed by email and SMS at every step from order to shipment
The approach.
- Built three Astro and React frontends: a patient portal with checkout and dashboard, an internal CRM for doctors, agents and admins, and a lightweight sales storefront
- Designed an event-driven backend of REST microservices behind two Express API gateways, with Azure Service Bus topics and queues connecting 37 or more Azure Functions
- Implemented dynamic multi-page medical intake forms with conditional branching and a questionnaire engine with weighted responses
- Integrated 29next for orders and subscriptions, Spreedly for PCI-compliant payment tokenisation, Empower Pharmacy for fulfilment, Persona for identity verification and Jitbit for support tickets
- Applied HIPAA-aligned safeguards: AES-256-CBC encryption with PBKDF2 key derivation, Azure Key Vault secrets, Managed Identity, a complete HTTP audit trail, RBAC by route, CSRF protection, rate limiting and PII masking in API responses
- Delivered a doctor workflow with a backlog queue, FullCalendar scheduling, prescription management and blood-work requests, and an agent workflow for order processing and shipping
What shipped.
- Patient e-commerce storefront with treatment catalogue, intake forms, checkout, magic-link and Apple OAuth sign-in and abandoned-cart recovery
- Patient dashboard for subscriptions, orders, appointments, prescriptions, lab results and support
- CRM dashboard with doctor, agent and administrator workflows and a Progressive Web App for offline use
- Seven REST microservices for customers, orders, forms, questionnaires, tickets, subscriptions and audit events
- Event processing layer of 37 or more Azure Functions for orders, notifications, webhooks, users, audit and tickets
- Multi-channel notifications through MailerSend and Twilio
- Pharmacy integration with webhook-based status tracking and shipping management
- Compliance documentation pages including consumer health data privacy and telehealth consent
- Monitoring with Sentry, Application Insights and Winston, and analytics for marketing attribution
How the engagement ran.
Context
Zeuss LLC runs a direct-to-consumer telehealth service in the United States. A patient chooses a treatment, completes a medical questionnaire, verifies their identity, pays, and is reviewed by a doctor before a pharmacy ships the prescription. Every step touches protected health information and several outside companies. The client needed all of it as one platform, built to a standard that healthcare compliance reviews would accept.
We designed, developed and deployed the platform on Microsoft Azure, from the patient storefront to the pharmacy integration.
What we built
- A patient storefront with categorised treatments, dynamic multi-page intake forms with conditional branching, secure checkout, passwordless sign-in and a Storyblok-powered blog
- A patient dashboard for subscriptions, billing, order tracking, appointments, prescriptions, lab results, plan changes and support
- A CRM with a doctor backlog, FullCalendar scheduling, prescription and blood-work management, agent order processing, Jitbit ticketing and administrator controls
- End-to-end subscription management through the 29next platform with Spreedly tokenised payments, refunds and multi-status tracking
- A notification engine of 11 Azure Functions sending email through MailerSend and SMS through Twilio
- Real-time pharmacy integration with Empower Pharmacy, including status history and shipping tracking
- Compliance pages: consumer health data privacy policy, telehealth informed consent, privacy, terms and cancellation policy
Architecture and stack
| Layer | Technology | Why |
|---|---|---|
| Frontends | Astro 4 with React 18 and 19, Tailwind CSS and SASS, Nanostores, Auth.js, GSAP, Workbox PWA | Fast server-rendered pages for patients; an offline-capable CRM for staff |
| API gateways | Express.js with JWT, sanitisation, CORS, rate limiting and audit logging to Service Bus | One entry point per audience with consistent security |
| Microservices | Node.js 20, Express 4, Mongoose 8, one MongoDB database per domain | Customers, orders, forms, questionnaires, tickets and subscriptions evolve independently |
| Events | Azure Service Bus topics and queues, 37 or more Azure Functions v4 | Asynchronous fan-out for orders, notifications, webhooks, users and audit |
| Secrets and config | Azure Key Vault, Azure App Configuration, Managed Identity | No credentials in code; label-based environment separation |
| Storage | Azure Blob Storage | Medical documents, images, blood-work results and ID uploads |
| Integrations | 29next, Spreedly, Empower Pharmacy, Persona, Jitbit, Nylas, Storyblok, Klaviyo, Brevo, Google reCAPTCHA Enterprise | Commerce, payments, fulfilment, identity, support, calendar, content and marketing |
| Observability | Sentry, Application Insights, Winston, Google Analytics, Hotjar | Errors, traces, logs and behaviour across the stack |
How we worked
Domain boundaries were fixed early: customers, orders, forms, questionnaires, tickets and subscriptions each became a service with its own database. Inter-service communication went through Service Bus from the start, which meant new capabilities such as SMS reminders or audit reporting were added as subscribers rather than as changes to existing code.
Security was treated as infrastructure. Key Vault and Managed Identity were in place before the first integration, the audit queue captured every HTTP request from day one, and Helmet, CSRF tokens and rate limits were applied at the gateways. Code quality ran through ESLint, Prettier and Husky pre-commit hooks, with Vitest and Jest on the frontends and Mocha and Chai on the services, and Git-based continuous deployment to Azure App Service.
Integrations were wrapped, not scattered. A receiver-events function normalises webhooks from 29next, Empower Pharmacy, Nylas and Storyblok into internal events, and OpenAPI-generated clients give the services type-safe access to external APIs. When a partner changes a payload, one function changes with it.
Scale and complexity
| Measure | Figure from the documentation |
|---|---|
| Backend microservices | 20+, including 7 REST services behind 2 API gateways |
| Azure Functions | 37+: 12 order, 11 notification, 9 receiver, 4 user, plus audit and ticket events |
| Frontend applications | 3: patient portal, CRM dashboard, sales storefront |
| Databases | 7+ MongoDB databases separated by domain |
| Third-party integrations | 12+ |
| Roles | Patient, Doctor, Agent, Administrator with route-level enforcement |
| Rate limit | 200 requests per 15 minutes per IP at the gateway |
What this means for your project
Healthcare software is an integration and compliance problem as much as a coding problem. This platform demonstrates the pattern that works: event-driven services with clear ownership of data, external systems connected through webhooks and message topics, and safeguards built into the gateways rather than bolted on.
If you are planning a telehealth, clinic or regulated e-commerce product, Innovation Insight can bring this architecture, the HIPAA safeguard mapping and the integration experience to your discovery phase.
What changed.
- Patients across the United States access hormone therapy, weight loss, hair restoration and lab testing through the platform
- Orders flow automatically from checkout to doctor review, pharmacy fulfilment and shipment notification
- Every state-changing request is audit-logged and PHI is encrypted at rest, with secrets held in Azure Key Vault
- The platform integrates 12 or more third-party services into one cohesive system
Questions about this project.
What HIPAA safeguards did the platform implement?
AES-256-CBC encryption with PBKDF2 key derivation for sensitive data at rest, JWT authentication with secrets in Azure Key Vault, Managed Identity for service-to-service calls, a complete HTTP audit trail in a dedicated database, role-based access for patients, doctors, agents and administrators, CSRF protection, rate limiting, HSTS, and automatic masking of PII fields in API responses.
How does a prescription move from order to delivery?
A 29next webhook is received by an Azure Function and published to Service Bus. The orders service records it, the doctor reviews and approves it in the CRM backlog, the order is submitted to Empower Pharmacy, pharmacy webhooks update status through Pending, Received, Processing and Complete, and the patient receives the tracking number by SMS and email.
Why an event-driven architecture rather than one application?
The business depends on external systems that emit events at their own pace: e-commerce, pharmacy, calendar and CMS. Topics with named subscriptions let one event fan out to user, notification and audit processing at once, each service keeps its own database, and Azure Functions scale with the load.