A full medical-tourism marketplace, built in eight weeks at half the budget
Vitality Access connects patients in the US and Canada with vetted medical providers abroad. Diffco defined the product strategy and built the entire platform with AI-accelerated engineering — eight weeks for a scope that normally takes three to four months, at a budget two times lower than the first estimate.
Where they started
Vitality Access is a commerce marketplace for cross-border care: patients in the US and Canada discover vetted clinics abroad, get introduced, pay a deposit, and get support along the way. It is not a medical provider and makes no clinical decisions.
The founder came to Diffco with a fixed budget and customer-facing designs only — Figma frames carried over from two earlier product directions, an AI health-coaching app and a US maternity-care app. There was no provider side, no staff side, no back office. The software the business would actually run on did not exist yet.
The first scope estimate came in at more than twice the available budget. The task was to define what the marketplace needs to operate, build all of it inside the budget, and get to launch fast.
How we approached it
April – June
Product strategy
We worked with the founder to define the product around the two things a marketplace depends on: correct handling of money, and strict control of who can see what. In-app chat and calls came out of scope for a structural reason rather than a budget one — providers have no logins, so there is nobody on the other side of the conversation. Formal HIPAA and SOC 2 certification was deferred on the record, with the initial security planning done and the architecture ready for it.
June
Admin first
The staff admin was built before the customer app, because it holds the configuration the business runs on: rates per clinic, rates per procedure, and deposits that are locked at the moment of payment so a later rate change never affects an existing booking.
June – August
AI-accelerated engineering
Diffco’s AI-native delivery model: AI agents generate features, tests and migrations; senior engineers own the architecture, review every change, and are responsible for payments and security. That is what compressed a three-to-four-month build into eight weeks and cut the cost in half.
Throughout
Shipped in vertical slices
Each slice went end to end — database, API, UI, tests — and was demoed in a preview environment, so the client saw working software every week rather than a single delivery at the end.
What we built
Customer marketplace
Browse vetted clinics and procedures, request introductions, pay deposits, and open support cases. Only providers the admin has marked vetted are published.
Staff admin panel
Provider and procedure management, vetting status, pricing per clinic and per procedure, booking and deposit tracking, support cases, and onboarding content — everything the team needs to run the business without engineering help.
Passwordless phone sign-in
Customers sign in with a one-time SMS code. The SMS is the easy part; identity resolution is not. Someone who signed up by phone and later arrives through Google has to be linked rather than forked — and only on an identifier the provider actually verified.
Stripe deposit flow
Stripe hosted Checkout handles the card, and an abandoned checkout can be resumed safely: the system searches for an already-succeeded payment before charging again, so a customer is never charged twice. Getting there meant finding a default nobody set. Deposits were completing and then hanging — paid, no redirect, booking stuck — because the payment-method list was unset, so Stripe served buy-now-pay-later alongside cards. Those settle asynchronously, so reconciliation stopped at “not paid” and the follow-up event went unhandled. We pinned the integration to cards, with a test that fails if the pin is ever removed.
Secure medical document storage
Photos and receipts attached to support cases live in a private bucket with access rules enforced by the database and checked again at the API boundary. The case owner and staff can open them; a signed-in user one path over cannot.
Bilingual platform
English and Spanish across the customer app, with a typed message catalogue that turns a missing translation into a build error rather than a mixed-language page.
AI assistant, scoped and priced — then cut
An AI assistant that guides patients through discovery, procedures and next steps was scoped and priced as a full agentic build, and cut by the client to hold the budget. The platform’s data model and access rules were designed so it can be added without reworking either; it was not built.
Architecture & stack
Two Next.js apps — customer marketplace and staff admin — on Vercel, sharing one Supabase project. Row-level security in the database is the access boundary, not a convention: neither app holds a privileged key, so a bug in application code cannot expose another user’s data. Stripe’s hosted Checkout takes the card, and an idempotent webhook is the only thing allowed to move a booking into a paid state.
- FrameworkNext.js 15, App Router, and React 19
- Server components keep pricing and fee calculation on the server, never in the browser.
- Data & authSupabase, with row-level security
- One set of access rules serves both apps, so there is no middle tier to keep in sync.
- File storageSupabase Storage, over Cloudflare R2
- The plan was R2 plus Cloudflare Images. Database-enforced access on medical attachments beat the CDN, and removed a vendor.
- PaymentsStripe hosted Checkout, over Elements
- Hosted keeps the PCI surface on Stripe’s side — worth more than design control on a build with no dedicated front-end budget.
- MessagingTwilio Programmable Messaging
- SMS codes for the passwordless sign-in, on the same Messaging Service the client’s A2P registration sits on.
- LocalizationA typed message catalogue, over next-intl
- Kept locale routing out of the auth middleware, and made a missing Spanish string a build error rather than an English sentence on a Spanish page.
- HostingVercel
- Two apps, one deploy path, and a preview environment for every vertical slice — which is what made a weekly demo possible.
Results
Development is complete — nothing outstanding — and launch is now the client’s call: she has paused it to January 2027 while she finishes a regulatory review in each target country. So there are no business numbers yet. What follows is what can be checked today.
Full platform
Customer marketplace and staff admin, development complete
Timeline
Eight weeks of development, for a platform that typically takes three to four months
Budget
2× lower than the first estimate, with nothing the business runs on cut
Payments
Deposit path verified end to end in the pre-launch environment, against Stripe test mode — checkout, webhook, booking state, notification — with the charged amount matching the configured rate to the cent
Double-charge protection
Resumed checkouts produce one payment, never two
Security
Row-level security as the access boundary; no privileged keys in either app; HIPAA and SOC 2 planned, with the architecture ready
AI assistant
Scoped and priced, then cut by the client to hold the budget; architecture ready
Next phase ready
Architecture prepared for in-app messaging and formal HIPAA / SOC 2 certification
Diffco built Vitality Access from the ground up — our medical travel marketplace, including AI-powered matching between patients and vetted providers abroad. They delivered on time, the design and user experience exceeded our expectations, and they’ve kept shipping improvements since launch. Responsive, easy to work with, and genuinely invested in our success. We’re continuing to work with them.
Racquel JosephCEO, Vitality Access
