A UK technology leadership partner, not simply a consultancy
Keza Studio is pleased to present this proposal to support SureReach Ltd's market entry into the United Kingdom healthcare market.
Having reviewed SureReach Ltd's objectives and discussed your ambitions for entering the UK digital health ecosystem, we believe the greatest value we can provide is not simply as a technology consultancy, but as your UK technology leadership and delivery partner.
Our role is to build the MVP and, alongside it, bridge the gap between where the prototype is today and the technical, regulatory and operational requirements of delivering digital healthcare solutions within the NHS and wider UK healthcare sector.
This will include assessing where any current or planned SureReach Ltd functionality falls within the UK medical-device regulatory framework overseen by the Medicines and Healthcare products Regulatory Agency (MHRA), particularly where software or AI functionality performs, supports or influences a medical purpose.
Where this is applicable, we will help SureReach Ltd establish its initial regulatory position, understand the likely technical and engineering implications, identify the documentation and evidence that may be required, and lay the groundwork for the device work planned for Years 2 and 3.
The outcome is a MVP that is secure, scalable, appropriately governed and ready for UK deployment, owned outright by SureReach Ltd, with the option of continuing UK technical leadership afterwards.
This proposal therefore outlines a three phase engagement: the full MVP build, UK technical and digital health readiness assurance carried out inside it rather than as a separate assessment stage, and an optional ongoing Fractional CTO / UK Technical Lead retainer after launch. The build and the readiness work run together over 10 to 12 weeks under a single all-in fixed fee of £12,000.
Proposal record
- Client
- SureReach Ltd
- Prepared by
- Keza Studio (Keza Studio Group Ltd)
- Author
- Francis
- Scope
- UK Technology Leadership, Digital Health Readiness & Full MVP Build
- Date
- 24 August 2026
- Version
- v1.2
What this engagement is designed to achieve
- 01Successfully establish its UK technology operation and set the foundation for expansion into other countries.
- 02Accelerate market entry into the NHS and wider UK healthcare market.
- 03Build the prototype into a standard MVP fit for UK healthcare deployment.
- 04Align the MVP with UK regulatory, clinical-safety, information-governance and security expectations.
- 05Establish an initial MHRA / Software as a Medical Device regulatory readiness where applicable.
- 06Complete the regulatory and operational groundwork in Year 2 for device introduction in Year 3.
- 07Improve software quality, scalability and operational resilience.
- 08Establish robust CI/CD, release-management and production-governance processes.
- 09Provide experienced UK technical leadership without the immediate need for a full-time CTO.
- 10Establish a prioritised roadmap for progressing from the current prototype to UK market readiness and entry into other markets (Portugal, Republic of Ireland, Finland, Liberia, DRC and Nigeria).
Build and assess together, then lead
UK Readiness Assurance, built into the build
Architecture, security, UK healthcare readiness and the initial regulatory position are reviewed as the MVP takes shape, and each finding becomes a build decision recorded once.
Included in the all-in fee
See what it coversFull MVP build
The MVP delivered across four stages under a documented IEC 62304 lifecycle, with all intellectual property vesting in SureReach Ltd on creation.
£12,000 all in, with Phase 1
See what it coversFractional CTO / UK Technical Lead
An optional retainer SureReach Ltd can take up at handover: ongoing technical leadership for the UK operation, held by the same person who led the build.
£800 per month
See what it coversBy the end of Phase 1, SureReach will know
- where the prototype is today;
- where it needs to be for the UK;
- what the major technical, regulatory and operational gaps are;
- what needs to happen first;
- which activities can be undertaken independently;
- which activities require specialist external support;
- and the likely investment and delivery roadmap required.
Technical Architecture Review
Reviewed
- Overall application architecture
- Cloud infrastructure
- Hosting environment
- Data architecture
- API strategy
- Scalability
- Performance
- Reliability
- Disaster recovery capability
The review will establish whether the current architecture provides a suitable foundation for UK deployment and identify areas requiring remediation or redesign.
Where the current prototype already has infrastructure or scalability modelling, we will review and validate that rather than unnecessarily recreating it, and extend it to address UK-specific requirements where appropriate.
Engineering Review
- Source-control strategy
- Code quality
- Coding standards
- Technical debt
- Test coverage
- Documentation
- Release processes
- Dependency management
- Change-control processes
- Build reproducibility
- Environment parity
- Traceability from requirement to release
Security Assessment
Security controls reviewed
- Identity and access management
- Infrastructure security
- Application security
- Secrets management
- Vulnerability management
- Logging and monitoring
- Backup strategy
- Security governance
- Privileged access
- Data encryption
- API security
- Production access controls
- Incident-management processes
Preparing SureReach for
- Cyber Essentials Plus
- NHS Data Security and Protection Toolkit
- NHS procurement expectations
- Appropriate penetration testing
- Security assurance expected of healthcare technology suppliers
Deployment & DevOps Assessment
- Source control and branching strategy
- Continuous Integration (CI)
- Continuous Delivery / Continuous Deployment (CD)
- Automated testing
- Release management
- Development, Test, UAT and Production environments
- Infrastructure as Code
- Configuration management
- Secrets management
- Deployment approvals and governance
- Software versioning
- Release traceability
- Rollback and recovery procedures
- Monitoring, logging and observability
- Production support processes
- Incident management
- Backup and disaster recovery
Our objective is to establish a modern DevOps capability that enables confident, repeatable and auditable deployments while reducing operational risk.
This becomes particularly important if any part of the SureReach Ltd product falls within medical-device regulation, because changes to safety-relevant software must be appropriately controlled, tested, documented and traceable.
The deployment pipeline will therefore be designed not simply for development speed, but to provide the foundations for the level of engineering governance expected within regulated healthcare environments.
UK Healthcare Readiness
- NHS interoperability requirements
- Clinical safety processes
- Applicability assessmentDCB0129
- Deployment considerationsDCB0160
- Information governance
- UK data-protection requirements
- Healthcare hosting considerations
- NHS procurement and assurance expectations
- DSP Toolkit readiness
- Cyber Essentials Plus readiness
- Accessibility considerations
- Future NHS integration opportunities
- Security governance
MHRA & Medical Device Readiness
This engagement
Foundation
Intended purpose drafted, likely qualification and classification direction established, and the IEC 62304 lifecycle and design history file opened so evidence accumulates from day one.
Year 2
Groundwork
Regulatory requirements and operational groundwork completed: documentation set built out, risk management and change control operating, quality processes and specialist support in place.
Year 3
Device introduction
Devices tested and introduced, supported by the evidence trail, clinical safety artefacts and supplier information prepared in the preceding years.
Activities
- 01Draft the MVP's intended purpose, target users, clinical context and intended claims.
- 02Assess whether relevant functionality may constitute Software as a Medical Device (SaMD) and identify the likely classification direction ahead of the Year 3 device introduction.
- 03Review the implications of clinical decision-support, monitoring, alerting and AI functionality where applicable.
- 04Design the MVP so the supporting technical evidence accumulates as it is built: software requirements, architecture, risk management, testing, traceability, cybersecurity, usability and change control.
- 05Set out the regulatory and operational groundwork to be completed in Year 2, and the engineering and documentation work it depends on.
- 06Identify where specialist medical-device regulatory support or conformity-assessment expertise will be required, and when it needs to be engaged.
Outputs
- Draft Intended Purpose Statement
- Initial MHRA / SaMD regulatory position
- Indicative qualification / classification direction
- Regulatory and technical documentation gap matrix
- Year 2 groundwork plan leading to Year 3 device introduction
Important boundary
The objective of this phase is to establish a clear initial regulatory position and practical roadmap. It does not include formal regulatory advice, MHRA registration, conformity assessment or delivery of a complete Class IIa / Class IIb certification programme. Where these are required, they will be separately scoped with appropriately qualified specialists.
AI Governance
- AI governance
- Model management
- Model versioning
- Model change control
- Clinical risk
- Transparency
- Auditability
- Data provenance
- Human oversight
- Responsible AI practices
- Testing and validation
- Monitoring of model performance
- Potential MHRA implications where AI functionality has a medical purpose
Particular attention will be given to how changes to models are governed where those changes could affect clinical outputs.
Readiness Assurance Outputs
- 01Findings and decisions record, one living document maintained through the build
- 02Architecture decision records, written as the decisions are taken
- 03Security remediation log, closed out inside the build
- 04Independent penetration test report and verified remediation
- 05Deployment pipeline and release governance documentation
- 06Initial MHRA / Software as a Medical Device regulatory position
- 07Draft intended purpose and regulatory positioning summary
- 08Regulatory and clinical safety evidence gap matrix
- 09Year 2 to Year 3 device readiness plan
- 10Technical and regulatory risk register
- 11Design history file and traceability records at handover
Scope Boundaries
The all-in fixed fee of £12,000 covers the MVP build and the readiness assurance carried out inside it, including regulatory scoping, gap analysis and the roadmap described above. There is no separate assessment fee.
The pre-build assessment is significantly reduced. Because Keza Studio builds the MVP, findings are applied as build decisions and recorded once, rather than produced as a standalone review with its own report programme.
It does not include delivery of an end-to-end Class IIa or Class IIb medical-device certification or conformity-assessment programme.
Where these activities are required, Keza Studio can help SureReach Ltd coordinate the programme and technical workstreams, working alongside appropriately qualified regulatory, clinical, quality and conformity-assessment specialists.
Separately scoped, not included in Phase 1
- Full medical-device technical documentation programme
- Class IIa / Class IIb conformity assessment
- Approved Body engagement and fees
- MHRA fees
- Formal regulatory / legal opinions
- Implementation and certification of an ISO 13485 Quality Management System
- Full clinical evaluation programmes
- Clinical investigations
- UK Responsible Person services
- Formal medical-device registration or regulatory submissions
- Specialist regulatory consultancy
- Independent clinical-safety services
- Specialist testing or certification
The full build
Because Keza Studio owns the build, the readiness work no longer needs to run as a separate assessment stage with its own report suite. It is significantly reduced and baked into the build price: architecture, security, UK healthcare readiness and the initial regulatory position are reviewed across the four stages, and each finding is applied as a build decision and recorded once in a findings and decisions record. That is what brings the all-in fee to £12,000 for the same 10 to 12 week delivery. The fractional CTO retainer is optional and begins after launch, once the MVP is in SureReach Ltd's hands.
Stage 1
Weeks 1-3
Foundations
- Documented software development lifecycle stood up under IEC 62304, with the design history file opened on day one
- Cloud accounts, environments, infrastructure as code, CI/CD and audit logging
- Architecture decision records for the data model, alerting pipeline and integration surface
Stage 2
Weeks 3-6
Core MVP
- Patient and cohort data model, consent and access control
- SureReach alert logic implemented as a versioned, testable service with full traceability
- Clinician and administrator interfaces, notification delivery over email and SMS
Stage 3
Weeks 6-9
Assurance
- Automated test suite with traceability from requirement to test to release
- Independent penetration test, vulnerability remediation and a disclosure route
- Clinical safety artefacts prepared for the Clinical Safety Officer to review and sign off
Stage 4
Weeks 9-12
Launch and handover
- Production cutover, runbooks, monitoring, alerting and on-call handover
- Technical documentation pack: design history file, traceability records and inputs to the Clinical Evaluation Report
- Knowledge transfer to the SureReach team, with source code and infrastructure in SureReach owned accounts
Team shape
- Technical lead and architect (the same person available for the optional fractional CTO retainer, for continuity)
- Two senior full stack engineers across application, data and integration work
- Cloud and infrastructure engineer for hosting, CI/CD and observability
- Quality and documentation support for the IEC 62304 record set
All-in fee
£12,000
One fixed fee covering the readiness assessment and the build as scoped above, delivered over 10 to 12 weeks and invoiced against the four stages. Cloud hosting, email and SMS are paid directly by SureReach Ltd and are modelled in the running cost estimator.
Scale roadmap
Year 1
Up to 50,000
patients on the prototype
Pilot testing, no paying patients
Architecture
Single region, managed Postgres, queue backed alerting, single application tier sized for pilot load
Operations
Baseline SLOs, daily backups tested by restore, manual capacity review
Regulatory
IEC 62304 lifecycle in place, design history file live, DSPT submission supported
Indicative running cost
Indicative: £588 to £1,175 per month
Year 2
144,500
patients on the prototype
First paying cohorts, regulatory groundwork for devices
Architecture
Read replicas, caching layer, multi AZ redundancy across the data tier
Operations
Alerting and dashboards per service, capacity reviews each quarter
Regulatory
Design history file maintained through change control, risk file updated per release, device regulatory and operational groundwork completed
Indicative running cost
Indicative: £1,345 to £2,690 per month
Year 3
622,514
patients on the prototype
National scale, devices tested and introduced
Architecture
Service separation for the alerting pipeline, event streaming, warm standby
Operations
On call rotation, incident review process, load testing before each major release
Regulatory
Clinical Evaluation Report inputs complete, supplier information ready for the Approved Body, device introduction supported
Indicative running cost
Indicative: £5,454 to £10,907 per month
Year 4
1,323,517
patients on the prototype
Europe market expansion
Architecture
Partitioned data tier, regional isolation, asynchronous batch processing
Operations
Load test gates in CI, performance budgets enforced, automated failover drills
Regulatory
Post market surveillance data feeding the risk file, periodic safety reporting
Indicative running cost
Indicative: £12,078 to £24,155 per month
Year 5
2,964,423
patients on the prototype
African market entry, multi region resilience
Architecture
Multi region active capacity, capacity planning baked into the roadmap
Operations
Continuous performance budget, cost per patient tracked as an engineering metric
Regulatory
Annual lifecycle and quality reviews, audit ready documentation at all times
Indicative running cost
Indicative: £26,967 to £53,935 per month
Capacity work is planned a year ahead of the volume, so the architecture change lands before the patients do. The indicative running costs come from the same model as the estimator further down this proposal.
Regulatory and clinical compliance
IEC 62304 software lifecycle
In the agreementKeza Studio develops under a documented software development lifecycle consistent with IEC 62304, applied at the rigour required for a Class IIa device, covering planning, requirements, architecture, implementation, verification, release and maintenance.
Technical documentation handover
In the agreementWe produce and hand over the technical documentation supporting the regulatory roadmap: the design history file, traceability records from requirement through to verification, and the technical inputs to the Clinical Evaluation Report.
ISO 13485 alignment
In the agreementWe work in alignment with ISO 13485 as it applies to software suppliers, including document control, change control, competence records and supplier obligations.
Clinical Safety Officer sign off
In the agreementThe SureReach Clinical Safety Officer has the right to review and sign off safety relevant design decisions before release. No safety relevant change ships without that sign off.
Conformity assessment co-operation
In the agreementWhere a SureReach partner or a UK Approved Body requires supplier level information during conformity assessment, we provide it, including access to our lifecycle records and to the engineers who did the work.
Data, security and access
No live patient data in development
In the agreementKeza Studio does not access live patient data during development. We build and test against synthetic or properly anonymised data sets, consistent with UK GDPR and the NHS Data Security and Protection Toolkit.
Data processing terms
In the agreementWhere any processing of personal data is unavoidable, it happens only on documented instruction from SureReach Ltd as controller, under written processing terms covering purpose, retention, sub processors, international transfers and deletion.
Security testing before go live
In the agreementAn independent penetration test is completed before go live, findings are triaged by severity, and agreed remediation is verified before release.
Vulnerability disclosure
In the agreementWe establish a vulnerability disclosure route and reporting obligations, with defined response times by severity and a duty to notify SureReach of any suspected incident without delay.
Access control and audit
In the agreementLeast privilege access to SureReach owned cloud accounts, individual named accounts with multi factor authentication, and an audit trail of access and changes.
Intellectual property and confidentiality
IP ownership remains with SureReach
In the agreementIntellectual property in the MVP, in its entirety, remains with SureReach Ltd. Keza Studio claims no ownership interest in the product we build for you.
Unambiguous assignment on creation
In the agreementAll source code, algorithms, documentation and design outputs produced under this engagement vest in SureReach Ltd on creation, with a present assignment of all such rights and no dependency on final payment for the assignment to take effect.
Pre-existing Keza tools and frameworks
In the agreementThe assignment extends to any pre-existing Keza tools or frameworks incorporated into the build. Where we retain background IP in a general purpose component, SureReach receives a perpetual, irrevocable, worldwide, royalty free licence back to use, modify and sublicense it as part of the MVP.
Moral rights waiver
In the agreementEach individual Keza Studio developer who contributes to the build waives their moral rights in the work, to the extent waivable in law, and we secure that waiver as a condition of anyone joining the project.
Non-infringement warranty
In the agreementWe warrant that the delivered code does not infringe third party intellectual property rights, that all third party components are used under compatible licences, and we maintain a bill of materials so licence positions are auditable.
Alert logic as protected trade secret
In the agreementThe SureReach alert logic methodology is named in the agreement as trade secret material owned solely by SureReach Ltd. It is not shared with any external party, is not reused in any other engagement, and access is restricted to named individuals bound by confidentiality.
Most of these obligations already sit in our General Services Agreement. On acceptance of this proposal we draft the full agreement tailored to this build, covering IP assignment, licence back of background IP, moral rights waivers, the non-infringement warranty, the alert logic confidentiality provisions, change control, continuity and termination. The summaries on this page state our commitment in plain English; the agreement is the operative document.
How we work together
Change control
In the agreementAny change to scope, cost or timeline is raised as a written change request setting out the change, the impact on price and schedule, and the regulatory consequence. Work on the change starts only once SureReach approves it in writing.
Key person risk and continuity
In the agreementNamed individuals are recorded in the agreement, no single person holds undocumented knowledge, and a nominated deputy shadows the technical lead. Source code, infrastructure definitions and documentation live in SureReach owned accounts throughout, so delivery can continue without us.
Termination for non-delivery
In the agreementSureReach may terminate for material non-delivery against agreed milestones, following written notice and a defined remedy period, with payment due only for work accepted to that point.
Termination on change of control
In the agreementSureReach may terminate if control of Keza Studio changes, with an orderly handover of code, documentation and credentials at our cost.
Reporting cadence
In the agreementA weekly written progress note, a fortnightly demonstration of working software, and a monthly review against milestones, budget and risk.
Track record
Regulated healthcare software
Founder led companies bringing a clinical product into a regulated market, needing a documented lifecycle and evidence an Approved Body or NHS buyer will accept.
Pilot to national scale
Prototypes moving from a pilot population to national volumes, where the data tier, notification pipeline and cost per patient all have to be re-engineered as the numbers grow.
International delivery
Founders building for more than one country, where the same product has to hold up across different markets and regulatory contexts. Recent international work includes Jett Holland-Parker (Starlit Whispers) and Sunkanmi Ayenimo (EduBrighter), with references available on request.
Prototype to market ready product
Organisations with a working prototype that now needs to be rebuilt to a standard a regulator, a health system buyer and an investor will each accept.
Keza Studio portfolio, including L'Oréal, HP and NatWest Bankline
Regulated and high volume delivery
Work delivered under security review and compliance sign off for financial services, consumer and enterprise platforms, including transaction processing at scale, high availability targets, accessibility requirements and audited release governance across millions of users.
Evidence that the engineering practice holds at the volumes the scale roadmap anticipates, and that the assurance posture NHS procurement and information governance teams look for is something we already work under.
NHS Blood and Transplant
NHS DonorPath
A secure mobile tool that replaced paper forms for specialist nurses across more than 260 hospitals, digitising 18,000 forms a year, reducing paperwork by 70% and saving the NHS up to £300,000 annually.
Directly comparable to the SureReach build: regulated healthcare data, time-critical clinical workflows, national-scale deployment, and a documented, auditable system that NHS buyers can trust.
Technology Strategy
- Own and maintain the UK technology roadmap.
- Define technical strategy.
- Review architecture decisions.
- Ensure scalability.
- Support product planning.
- Guide technology investment decisions.
- Balance commercial priorities with technical delivery.
- Coordinate technical priorities arising from UK healthcare and regulatory requirements.
- Ensure that regulatory considerations are incorporated into product and technology decisions where applicable.
Engineering Leadership
- Coordinating development activities.
- Defining sprint priorities.
- Reviewing technical designs.
- Conducting architecture reviews.
- Supporting code-quality initiatives.
- Managing technical risks.
- Providing technical mentoring where appropriate.
- Establishing engineering standards.
- Improving documentation.
- Coordinating remediation work.
- Acting as the technical bridge between management and engineering.
DevOps & Platform Engineering
- CI/CD pipeline implementation and optimisation
- Automated testing strategy
- Release governance
- Infrastructure as Code
- Environment management
- Cloud architecture optimisation
- Platform monitoring and alerting
- Operational resilience
- High-availability planning
- Incident-management processes
- Release traceability
- Rollback processes
- Production-change governance
UK Healthcare Technology Leadership
Ongoing coverage
- NHS digital and technology standards
- NHS procurement readiness
- Clinical-safety processes
- DCB0129
- DSP Toolkit readiness
- Cyber Essentials Plus preparation
- Information governance
- Healthcare interoperability
- Security governance
- MHRA and medical-device considerations where applicable
- Engineering coordination
- Architecture governance
- DevOps and deployment governance
- Stakeholder engagement
- Technical reporting
- UK healthcare technology leadership
- Regulatory delivery coordination where applicable
The investment
Phases 1 and 2 · all in, fixed fee
New in v1.2£12,000
One fixed fee covering the full MVP build with UK technical and digital health readiness assurance built into it, no separate assessment fee, delivered over 10-12 weeks under a documented IEC 62304 lifecycle, with all intellectual property vesting in SureReach Ltd on creation. Invoiced against the four build stages.
Reduced from £16,384: because Keza Studio owns the build, the pre-build assessment is significantly reduced and its remaining substance is priced inside the build.
Phase 3 · optional retainer
£800per month
Fractional CTO / UK Technical Lead, available after launch if SureReach Ltd wants ongoing leadership. Optional, taken up at handover, outside the all-in fee and reviewed periodically.
Cloud hosting, email and SMS are third party costs paid directly by SureReach Ltd and are modelled in the running cost estimator below. The optional retainer is billed monthly only if taken up. Any specialist work outside this scope is quoted separately and agreed before commencement.
Figures quoted in v1.2, 24 August 2026. Exclusive of VAT.
Running cost estimator
The estimator below is an indicative model for budgeting. It uses the same modelling approach as our earlier AWS cost estimates, rebased on patient volume. Figures are on-demand list prices and exclude reserved instance or committed use discounts, which typically reduce compute and database costs by 30 to 40 per cent once volumes are predictable. Actual costs will vary.
Estimate, not a quotation
The figures below are an indicative model for budgeting. They are based on published on-demand list prices, the assumptions you choose and a GBP conversion rate. They are not a quotation or commitment from any cloud provider, and actual costs will vary with usage, discounts and negotiated rates.
Assumptions
Redundancy
Lowest cost, single availability zone
Indicative monthly run cost
Estimate£1,731per month
range £1,298 to £2,597 · £20,774 per year
Active patients
36,125
Notifications
144,500
SMS
43,350
Cost per patient / month
£0.012
| Service | Low | Expected | High |
|---|---|---|---|
| Application compute2 units, Single AZ | £83 | £111 | £166 |
| Load balancing1 balancer | £15 | £19 | £29 |
| Database1 node plus storage | £70 | £94 | £141 |
| Object storage282 GB of documents | £4 | £5 | £8 |
| Data transfer741 GB outbound | £40 | £53 | £79 |
| Backup and DRSnapshots and retention | £16 | £22 | £33 |
| Monitoring and loggingMetrics, traces, log retention | £37 | £50 | £75 |
| SMS gateway43,350 messages | £1,027 | £1,370 | £2,055 |
| Email service101,150 messages | £6 | £8 | £12 |
| Estimated monthly total | £1,298 | £1,731 | £2,597 |
Estimate based on selected assumptions. For budgeting and planning only.
About these figures
- Indicative model for budgeting. Not a quotation or commitment from any cloud provider.
- Based on published on-demand list prices for the London region, converted at the rate shown.
- Excludes reserved instance, committed use, enterprise-negotiation or spot discounts, which typically reduce compute and database costs once volumes are predictable.
- Message costs assume UK mobile numbers and the quoted email volumes.
- Actual costs will vary with usage, provider pricing changes and negotiated rates.
See the "About these figures" note above for the assumptions and limitations behind this model.
Additional Consultancy
- Medical-device regulatory expertise
- Quality-management expertise
- Clinical-safety expertise
- Clinical-evidence expertise
- Cybersecurity testing
- Penetration testing
- Accessibility testing
- Interoperability expertise
- Approved Body / conformity-assessment support
Why Keza Studio
Keza Studio combines extensive software engineering leadership with practical experience delivering secure, scalable digital solutions within regulated environments.
Our focus is not simply delivering technology, it is ensuring technology supports business growth, operational excellence and successful market adoption.
For SureReach Ltd, this means bringing together the MVP build, technology strategy, deployment maturity, UK healthcare readiness and regulatory coordination into one coherent programme under a single fixed fee.
You own the result outright. Source code, infrastructure definitions and documentation sit in SureReach owned accounts throughout, so the MVP and its evidence trail are yours from the first commit.
By acting as SureReach Ltd's UK technology leadership partner, we will help establish the governance, engineering capability, regulatory readiness and deployment maturity required to scale confidently into the UK healthcare market.
Next steps
- 01Confirm project scope, product boundaries, timelines and execute General Service Agreement.
- 02Schedule stakeholder and technical workshops.
- 03Conduct an intended-purpose and UK regulatory-scoping workshop.
- 04Stand up the documented lifecycle, environments and delivery pipeline in Stage 1.
- 05Build the MVP across the four stages, with the readiness assessment running alongside.
- 06Establish the initial MHRA / medical-device regulatory position where applicable.
- 07Review architecture, security, deployment and UK healthcare readiness as the MVP takes shape.
- 08Present findings, decisions and priorities to SureReach Ltd leadership at each stage.
- 09Agree any separately scoped specialist regulatory work required.
- 10Hand over the MVP and, if SureReach Ltd wishes, take up the optional Fractional CTO / UK Technical Lead retainer.
We look forward to supporting SureReach Ltd as a long-term strategic technology partner and helping establish a successful, secure, scalable and appropriately governed presence within the UK healthcare sector.
Keza Studio (Keza Studio Group Ltd) · Francis · 24 August 2026 · v1.2