- Bits & Pretzels
- Munich, Germany
- September 28-30.
Making regulated MedTech software
safe to change, build and trust
safe to change, build
Making regulated
MedTech software
safe to change,
build and trust
For MedTech and LabTech companies, we modernize legacy systems, build regulated software and turn around troubled projects. For the investors backing them, we assess the technology behind the deal.
No pitch, just a conversation about your software and what it needs.
20+ YEARS
MedTech & LabTech software expertise
SENIOR-LED
Technical ownership
US & EUROPEAN
Delivery Experience
The software that runs your business is the one you’re most afraid to touch
In regulated healthcare, the systems that matter most carry years of clinical logic, compliance evidence and hard-won validation. That’s exactly what makes them so hard to change: touch one part and you can reopen a question that was settled years ago. Over time the safest-seeming option becomes to leave it alone, until leaving it alone becomes the bigger risk.
Whether you’re evolving a live system, recovering a slipping project or evaluating technology before a deal, the hard part is rarely the code. It’s understanding what can change, what must remain stable and how to move without putting continuity, compliance or patient safety at risk.
Six ways we help you move critical software forward safely
Legacy software modernization
Your system works, but it’s aging, costly to maintain and risky to change. We modernize it in phases, without the downtime or the rebuild everyone assumes you need.
Software risk assessment
You know something has to change, but not where to start or what it’ll cost. We map the real risks and hand you a prioritized roadmap of what to fix, and in what order.
Technical due diligence
For investors and acquirers. Financial due diligence won’t tell you whether the software can carry the business plan. We give you an independent read on the asset behind the deal.
Regulated software development
Building medical software means compliance, documentation and validation at every step. We build it in from day one, so every release is audit-ready, not a last-minute scramble.
Software project recovery
A critical project is slipping, ownership is unclear and adding people isn’t helping. We bring structure and accountability back, and get delivery under control.
AI readiness assessment
You know AI could help, but not where to start – or whether you’re even ready. We find the use case that’s worth building first, ground
Understanding first, code second
Most software problems in regulated healthcare aren’t really code problems: they’re decisions made without a clear enough picture. So before we change anything, we make sure we understand the system, the risks and the regulatory reality around it.
Then we work the way these systems demand: in controlled phases, not big-bang rewrites. Each phase has a clear outcome and decision point: assess, prioritize, then act. You reduce risk before committing further, while the system keeps running throughout.
Critical systems we’ve kept safe, compliant and moving
Case study
A life-critical system, still running a decade on.
After a previous rewrite failed, we stepped in to stabilize a transfusion platform used across hundreds of hospitals, modernized it in place and have kept every release FDA-ready since – the latest cleared in 90 days.
Case study
From fragile MVP to a platform regulators trust.
A respiratory health platform started as an early MVP, never built for regulatory scrutiny. We rebuilt it with documentation and traceability from day one. It’s now logged 2.7 million readings, stayed stable for nearly a decade and earned formal NICE recognition.
Case study
A complex platform, made safe to change again.
Gpi USA’s blood donor and lab platform had grown fragmented, with an aging Java and SQL Server stack that was risky to modernize. Instead of a blind rebuild, we worked risk-first. Today three customers rely on it in daily operations.
Case study
Structure and predictability for a century-old pharmacy.
BRD, an equine pharmacy serving 1,800+ vets across the U.S. and Puerto Rico, was running on a neglected platform with real technical debt. We brought structure to a workflow-heavy build, catching problems before they reached the client.
Partners & Certifications
Not sure where to start? That’s exactly what the first call is for.
Tell us about the system you’re worried about: the one that’s aging, slipping, or too critical to touch. We’ll help you figure out what it actually needs, and whether we’re the right team to help. No pitch, no obligation.
Frequently Asked Questions about regulated MedTech and LabTech software
What does BrightHills specialize in?
BrightHills is a senior software engineering and advisory partner for MedTech and LabTech companies. Since 2003, we have helped teams assess, modernize, build and recover critical software, and we support investors and acquirers with MedTech-specific technical due diligence.
Where should we start if we know our software needs to change, but do not know what is genuinely risky?
Start with a software risk assessment rather than committing immediately to a rebuild or large development program. We examine the system, its dependencies, technical debt, regulatory constraints and delivery risks, then turn the findings into a prioritized roadmap with clear decision points.
Can legacy MedTech software be modernized without a complete rebuild?
Often, yes. We first identify which parts of the system are genuinely risky, which can remain stable and where change will create the most value. Modernization can then proceed in controlled phases, protecting validated behavior and keeping the system operational wherever possible.
How do you build compliance into software development?
We use a compliance-by-design approach. Requirements, traceability, risk management, documentation, verification, validation and controlled change management are built into everyday delivery, so regulatory evidence is created alongside the software instead of being reconstructed before an audit or submission.
Can BrightHills take over a delayed or poorly documented software project?
Yes. We begin by making the project recovery process understandable: its technical state, architecture, backlog, dependencies, delivery blockers and ownership gaps. We then establish a realistic recovery plan, clarify responsibilities and rebuild predictable delivery before adding further capacity.
Do you provide technical due diligence for MedTech investors and acquirers?
Yes. We provide independent technical due diligence for MedTech and LabTech transactions. We assess the software architecture, codebase, security, scalability, delivery capability and regulatory evidence, then translate the findings into deal risk, likely remediation effort and post-transaction priorities.
How do you approach AI in regulated healthcare?
We start with the business problem, not the technology. An AI readiness assessment evaluates potential value, data readiness, technical feasibility and regulatory risk, helping you select a focused first use case that can be tested safely before making a larger investment.
How does an engagement with BrightHills start?
Start by completing the short contact form and telling us a little about the system and the decision in front of you. We’ll get back to you to arrange an introductory call. If there is a fit, we’ll define the most responsible next step, which may be an assessment, a roadmap or a clearly scoped delivery phase. There is no pitch and no obligation.