FAQ
Questions we get before the first call
26 answers on regulatory scope, device connectivity, hosting and how we work, written for the engineering and regulatory teams who have to defend the decision internally.
Regulatory & compliance
What we certify, what we document, and where the line runs between our responsibility and yours.
Is your infrastructure compliant with EU/US regulations?
Our operation is ISO 27001 and ISO 27701 certified, and we support EU and US regulatory processes such as MDR, IVDR and FDA. Documentation follows the agreed software lifecycle and the regulatory context of your product, for example in line with IEC 62304. The conformity assessment of your device itself remains with you; we make the digital part of it easier to defend.
What exactly do your certificates cover?
ISO 27001 and ISO 27701 cover how mdeg works: our development, hosting and operations. They do not certify your device, and no supplier certificate can. What they do is remove a large part of the supplier evidence you would otherwise have to collect and defend during your own audit.
What documentation do we get for our technical file?
Documentation follows the agreed software lifecycle and regulatory context of your product: typically architecture and interface descriptions, software lifecycle records in line with IEC 62304, cybersecurity documentation and the verification evidence behind them. The exact scope is agreed per product and project phase. The MGDK comes fully documented according to IEC 60601 and IEC 62304, with pre-certified EMC/EMS tests.
Does adding a ConnectBox change our device classification?
That decision stays with you and your risk analysis, but the architecture can make it easier to argue. An external ConnectBox connects to your device through its existing interfaces, with limited changes to the device itself, which keeps connectivity largely outside your device electronics and firmware. Teams retrofitting an approved device often take this route for exactly that reason.
How do you handle patient data and GDPR?
Data protection is decided in the architecture, not bolted on afterwards: access control, data minimisation, separation of roles and traceability are part of the design from the first sprint. Our privacy management is certified under ISO 27701, and we sign a data processing agreement before any real data moves.
Where is our data hosted, and can we choose?
You choose. mdeg Cloud offers hosting options in the EU, US, Switzerland and the UK, either as a managed single-tenant private cloud or as a custom cloud for specific security or ownership requirements, including a buy-out option. Data residency is a configuration of your deployment, not a rebuild, which matters when a new market forces the question two years in.
Connectivity
Getting data off the device: interfaces, protocols, outages, and which ConnectBox fits your stage.
Can we use your connectivity solutions if we already have a cloud?
Definitely. Depending on the selected configuration, the mdeg ConnectBox and the Patient Hub communicate with mdeg Cloud or a customer-managed cloud, including your in-house infrastructure, via MQTTS and HTTPS with certificate-based security.
Which ConnectBox do we need?
It depends on how deeply you want to integrate. The external ConnectBox is a ready-to-use unit for existing devices, prototypes, clinical pilots and early market deployments, with limited changes to the device. The embedded module integrates connectivity more deeply into the next device generation. The ConnectOS software layer brings the technology directly into your own device architecture. Many teams start external and move to deeper integration as the product evolves, keeping the same path to the cloud.
Our device only has a serial port. Can you still connect it?
Yes, and it is a common starting point. The ConnectBox takes data in over UART, SPI, I²C, USB, serial or BLE and forwards it securely to the cloud, without a firmware redesign to get the first real reading out.
What happens when a device loses its connection?
The ConnectBox buffers and preprocesses data locally, so transmission stays reliable during temporary connection interruptions. Data is sent once the link returns. That is the difference between a gap in a clinical data set and a device that quietly stopped reporting, a failure mode worth designing for before the first trial.
Can we update device firmware in the field?
Yes, where it is included in the selected product configuration: the ConnectBox supports remote configuration and over-the-air updates, and the MGDK has OTA update capability built in. Updates run through the same controlled pipeline as the rest of the system, so each rollout leaves a record.
Which protocols and authentication do you support?
HTTPS for high-volume data and file transfer, MQTT over TLS for lightweight and low-latency applications. Devices authenticate with X.509 certificates. Where a project needs an additional protocol or security mechanism, ConnectOS is built to be extended rather than replaced.
Can patients use connected devices at home without Wi-Fi?
Yes, with the mdeg Patient Hub. Patients only plug it into power with a USB-C cable; it connects to the cloud via integrated 5G/LTE, independent of patient Wi-Fi or smartphones. Your device connects locally via Wi-Fi, BT, BLE or USB, and only pre-approved devices can join. Deployments need available LTE coverage.
Cloud & operations
What the platform gives you on day one, how it scales, and who keeps it running afterwards.
Can we use your cloud if we already have a device that is able to send data?
Absolutely. If your device or an existing software layer can send structured data, it connects directly to the mdeg API via HTTPS or MQTTS, whether it communicates via Wi-Fi, BLE, LTE-M or other protocols.
What does mdeg Cloud include out of the box?
The parts every connected medical product needs and nobody wants to build twice: device management with digital twins, user and customer management, data visualization, audit trails and logging of safety-related controls, post-market surveillance and GDPR-compliant roles. We maintain these as a shared code base, so your budget goes to the use case that makes your product yours. The full feature set is best seen in a demo.
Do we have to use your stack?
Not necessarily. Our primary hosting solution runs on exclusive infrastructure. Beyond that, the architecture follows your product, its stage and its operating requirements. We would rather pick the right foundation per project than push one architecture onto every use case.
Will it scale from a pilot to an international rollout?
That is the case it is designed for. Device fleets grow, new user roles and stakeholders need access, and applications start needing more languages and different data residency arrangements. We use modular architectures with proven building blocks to avoid both over-engineering at the start and bottlenecks later.
Who operates the system after launch?
We do, under a subscription that covers hosting, updates, monitoring, backup and recovery. New features are scoped as their own projects on top.
Working with mdeg
How a project starts, what it costs to find out, and what kind of partner you are getting.
Which building block should we start with?
It depends on your device, its environment and your product stage. Validating a use case: the Starter Kit. An existing device: ConnectBox with mdeg Cloud. Home care: the Patient Hub. A new biopotential or biosensor device: the MGDK. Requirements beyond standard building blocks: Engineering Services. Not sure yet? We define the right starting point with you in a first call.
How long does a typical project take?
With the Starter Kit, cloud and first connectivity are usually in place within days, and a functioning prototype or MVP within a month. For a full market-ready integration, we align with your development timeline and product roadmap, so connectivity evolves hand in hand with your device development.
What types of companies do you work with?
MedTech startups, SMEs and established manufacturers of medical and diagnostic devices, including teams developing SaMD and AI applications. mdeg only serves medical and diagnostic manufacturers.
How do we start without committing to a full architecture?
With the Starter Kit: one concrete use case, a pre-configured cloud with device and user management, device connectivity via the mdeg API (HTTPS or MQTTS) or a ConnectBox, and initial visualization, for a fixed price. Cloud and first connectivity are usually in place within days, a functioning prototype or MVP within a month.
What happens to the Starter Kit once we continue?
Validated features and insights are transferred into a broader mdeg solution: mdeg Cloud, MGDK or customized engineering, depending on your product architecture. The evaluation is a first stage, not a throwaway demo. BIOS Medical followed exactly this path: a functioning prototype of their implant in three months, used in a real pilot study and now the foundation for further remote patient monitoring applications.
What does it cost, and how do we find out?
A few short meetings, engineers included from the first one, and you receive a written work breakdown with the technical phases and a commercial offer for your case. We quote against a defined scope rather than an hourly promise, so the number you see is one you can plan against.
Are you an outsourcing provider?
No, and the difference shows up in year three rather than month one. An outsourcing provider delivers a scope and leaves. We stay on as the development, hosting, DevOps and consulting partner: architecture planning aimed at long-living products, regulatory and technical risks flagged early rather than discovered late, and the same team still there when the product changes.
Can we take the solution in-house later?
Yes. Where required, the solution and its documentation are prepared for handover to your internal organization. The custom cloud offers a buy-out option, and for the MGDK source-code access or an optional IP buy-out can be contractually scoped. The exact scope is agreed per project.
Still weighing it up?
Bring the question this page did not answer. Our engineers join from the first meeting, so you get a technical answer, not a callback.