Cloud Systems and Backends for the Healthcare Sector, hosted in Germany and the EU
We develop and operate cloud-based backends and platforms for the healthcare sector, ranging from scalable patient and research applications to regulated medical devices. Secure, compliant with the GDPR, and hosted in Germany and the EU. Certified to ISO 27001 and ISO 13485.
Are you planning a Cloud System for the Healthcare Sector?
Then you’ve come to the right place.
We develop secure, scalable backends and platforms hosted in Germany and the EU that are GDPR-compliant, and—if you’d like—we’ll guide you through the process of obtaining approval for your medical device.
Architecture & Development
We design and develop your cloud backend: APIs, data models, identity and access management, and infrastructure as code. Scalability, data protection, and data sovereignty are built into the architecture from the very beginning.
Operations & Migration
Upon request, we can manage your system: monitoring, backups, incident response, and scaling. We can migrate existing setups to Germany or the EU without disrupting ongoing operations.
Security & Data Protection
QuickBird Medical is ISO 27001-certified for the development of cloud infrastructure in the healthcare sector. We implement information security and data protection in accordance with the GDPR, and when selecting a cloud provider, we look for recognized certifications such as ISO 27001 or C5 (certificate), depending on the regulatory requirements.
Interoperability
We integrate your system with the digital health infrastructure, such as the telematics infrastructure with services like ePA, e-prescriptions, and GesundheitsID, as well as secure communication via KIM and TI-Messenger. We use established standards such as FHIR, HL7, and DICOM for data exchange.
An Overview of Your Hosting Options
There is no single “right” cloud. We operate in a vendor-neutral manner and design independent cloud solutions that meet your security needs, scalability requirements, and procurement and data protection guidelines.
Clouds from Germany and the EU
Providers under full European control, operated in German or European data centers. In Germany, for example, StackIT from the Schwarz Group, T Cloud Public (formerly Open Telekom Cloud), IONOS, or Hetzner. For maximum data sovereignty.
U.S. Cloud Providers with Key Sovereignty
The major U.S. providers (hyperscalers) supply the computing power, while the cryptographic keys remain under your control in Germany. This is possible through solutions such as the AWS European Sovereign Cloud, Microsoft Cloud for Sovereignty, or the Sovereign Cloud powered by Google Cloud (via T-Systems).
On-Premises and Private Cloud
Operation in your own data center or a dedicated data center. Suitable when regulatory or contractual requirements mandate fully isolated operation.
Our Approach
1. Analysis & Requirements
We assess your security needs, regulatory requirements, and scalability needs. Based on this, we determine the appropriate hosting and data sovereignty model.
2. Architecture & Design
We design the cloud architecture, work with you to select a provider, and define data residency, key management, and the security strategy.
3. Development & Migration
We develop the system or migrate your existing setup; for medical devices, we provide documentation in accordance with the MDR, IEC 62304, ISO 13485, and other relevant standards.
4. Operations & Record Keeping
Upon request, we can handle the operation and provide the documentation you need for audits, approvals, and contract awards.
Our Approach
1. Analysis & Requirements
We assess your security needs, regulatory requirements, and scalability needs. Based on this, we determine the appropriate hosting and data sovereignty model.
2. Architecture & Design
We design the cloud architecture, work with you to select a provider, and define data residency, key management, and the security strategy.
3. Development & Migration
We develop the system or migrate your existing setup; for medical devices, this is documented in accordance with IEC 62304 and includes risk management in accordance with ISO 14971.
4. Operations & Record Keeping
Upon request, we can handle the operation and provide the documentation you need for audits, approvals, and contract awards.
Real-World Case Studies
Two projects that demonstrate how we implement secure, scalable systems for the healthcare sector.
ORIKO
BfArM-listed digital health product (DiGA) in accordance with the MDR, certified according to BSI TR-03161. Available on the market as an MDR medical device, integrated with the ePA and authenticated via GesundheitsID.
What really sets us apart
ISO 13485 certified
Quality management in accordance with ISO 13485, compliant with the MDR requirements for medical device software.
ISO 27001 certified
Certified to ISO 27001 for information security. Experts in cybersecurity and data protection for health information.
External Placing on the Market
Upon request, we will assume the role of the legal manufacturer and bear regulatory responsibility under the MDR.
Certified Cloud Providers
We host exclusively with providers that hold recognized certifications and attestations: ISO 27001, ISO 27017, ISO 27018, and C5 (Type 1 and 2).
FAQ
Can we completely outsource the development and operation of the cloud system?
Yes. Upon request, we can handle the design, development, and operation. You retain full control over your product and your data.
What does “key sovereignty” actually mean if we want to use a hyperscaler from the U.S.?
The actual computing power is provided by the hyperscaler. However, the cryptographic keys used to encrypt and decrypt your data remain under your control and are stored in a separate key management system in Germany (for example, based on the “Bring Your Own Key” principle or through an external key management service). As a result, your data is stored on the hyperscaler’s servers only in encrypted form. Without your keys, it cannot be accessed in plain text—not even by the provider itself or in response to government access requests, such as those under the U.S. CLOUD Act. You retain full control: you grant access and can revoke it at any time. This allows you to combine the scalability of a hyperscaler with true data sovereignty.
Does our application have to be a medical device under the MDR?
No, that depends on the intended use of your overall product and must be evaluated on a case-by-case basis. Here you will find our guide to help you determine whether your product falls under the definition of a medical device according to the MDR: Go to the guide
We develop and operate cloud systems for the entire healthcare sector, ranging from patient and research platforms to regulated medical devices. If your application is a medical device, we also provide the necessary regulatory documentation and adhere to the processes within our ISO 13485-certified quality management system.
Can you migrate an existing system from a U.S. cloud?
Yes. We plan and oversee the migration without disrupting ongoing operations. There are two sovereign models to choose from: a cloud with data residency in the EU or specifically in Germany, where your data is stored exclusively in European/German data centers; or a sovereign cloud (Sovereign Cloud), for example in the U.S., where the encryption keys remain under your control and neither the provider nor the U.S. government has access to the data.
Do you support integration with telematics infrastructure, hospital systems, or medical practice systems?
Yes. We integrate your system with ePA, GesundheitsID, and the telematics infrastructure, and implement connections to HIS and PVS systems using standards such as FHIR, HL7, and DICOM.
Are you Planning to Implement a Cloud System?
Our team can assist you with the architecture, development, migration, and operation of your cloud systems in the healthcare sector. Contact us to schedule a no-obligation initial meeting.