JD
Talk

Hybrid CTO + CMO · Healthcare

One person who can build the system and fill it.

This is not a résumé. It is one patient, followed from the first search to the paid claim, through software I designed and marketing I ran. Flip the lens above to read it as a CTO, a CMO, or both.

Follow the patientSkip to contact

The loop

One patient. Eight steps. I built every one of them.

Each stop shows what the system does, why it exists, and what I did on the technology side and the marketing side. Everything on screen is synthetic. Nothing here is a client or a patient.

Found In production

A patient asks Google, or an AI, who to trust.

Most practices are invisible at the exact moment someone decides. Answers now come from AI summaries as often as from ten blue links.

CTO lens

Server-rendered Next.js sites generated from one config file. Metadata is tested because a page's own tags can silently erase the layout's, and no one notices until traffic drops.

CMO lens

Answer-engine optimization on every site: structured data, an llms.txt, FAQ and author markup, and a blog pipeline with scanners that fail the build when a post reads like a machine wrote it. Landing pages are built per service line and per state, not one generic page.

Clicked In production

The click is measured, within the law.

Ad platforms reward conversions you can report. Health regulators punish the ones you should not have collected.

CTO lens

One consent module per site. Global Privacy Control is honored on both classes, a declined visitor still gets a cookieless conversion ping where the law allows it, and a probe from a US network proves the EU and US paths really behave differently.

CMO lens

Two consent classes. Health sites are opt-in; everything else is notice plus opt-out. Click IDs and UTMs are captured first-party. Offline conversions flow back to the ad platforms. ROI is judged blended, revenue divided by spend per audience, because click attribution is only a lower bound.

Reached In production

A lead can never be lost.

A failed form or a missed call is a patient who goes elsewhere. For a practice, it can be a person who needed care.

CTO lens

Saving to the database and sending the email are independent. Success if either works, an error only if both fail. Spam is stored and flagged, never emailed, never dropped, and a honeypot alone is never enough to flag, because browser autofill fills them on real patients.

CMO lens

Every phone click is logged first-party. Call tracking is built to be HIPAA-safe. The lead email tells the practice which button and which campaign brought the person.

Enrolled In production

The patient joins, on the practice's own address.

Independent practices (concierge, direct primary care, cash-pay, telehealth-first) need membership, paperwork and payment done in one sitting.

CTO lens

A multi-tenant patient portal and EHR. Tenant resolved by subdomain or custom domain, row-level isolation, signing built in rather than rented from an e-signature vendor, agreements with any term and optional re-signing, and payments through one white-label gateway behind an adapter.

CMO lens

Every practice gets its own portal address and enrollment page, with plans and renewals it configures itself. The patient never sees our name.

Seen Live demo, pilot practices

The visit runs on infrastructure we own.

Video vendors are a per-minute tax and one more compliance dependency.

CTO lens

Self-hosted video on an SFU with our own signaling and TURN. Live captions, an interpreter seat, keyboard-only join, and accessibility checks in CI. Designed for HIPAA and SOC 2 from the first commit.

CMO lens

Telehealth comes with every practice from day one, so the pitch is that the visit is already set up, not another tool to go buy.

Documented Built, opt-in

AI drafts the note. A clinician signs it.

Documentation is the complaint clinicians raise first, and an unsupervised model in a medical record is the risk administrators raise first.

CTO lens

The AI scribe is off by default, consent is captured per visit, audio is retained for zero days, and an unsigned draft never becomes a record. Every change an assistant proposes to a practice's configuration waits for a person to confirm it.

CMO lens

Time handed back to the clinician is the story the practice tells its own patients, and its own staff.

Proven Live demo

Anyone can audit it, including us.

A health system is judged on what it can prove after something goes wrong.

CTO lens

Append-only audit and impersonation logs. Soft delete everywhere, with a written list of every hard delete and why. Health data is retained at least six years. Every demo runs on synthetic data and refuses to start against anything not marked demo. WCAG 2.2 AA is a test, not a promise.

CMO lens

Trust sells. The privacy policy, accessibility statement and disclosures come from the same config that powers the site, so they never drift from reality.

Collected revenue flows back to step one: the next dollar of marketing is judged on what the last one actually paid.

Why it exists

Starting a practice means buying ten things from ten vendors who do not talk to each other.

Credentialing in one place, licensing in another, then a website, paperwork, an EHR, a portal, video, billing, payments, marketing. Every seam is a place a patient or a dollar falls through. Doctor Rebrand is the decision to build the seams out.

  • Credentialing
  • Licensing
  • Website
  • HIPAA paperwork
  • EHR
  • Patient portal
  • Telehealth
  • Billing
  • Payments
  • Marketing

Who we market to, and what each of them is afraid of

  • The physician leaving employmentWants to own the practice, fears the paperwork between resignation and first patient.
  • The nurse practitioner going independentHas the skills and the license; needs credentialing, billing and a brand at the same time.
  • The therapist or counselorNeeds privacy, scheduling and payment to feel effortless to patients who are already stressed.
  • The telehealth-first clinicLives or dies on state rules and consent, and on how fast a visit can start.
  • The membership and cash-pay practiceSells trust directly to the patient, so the website and portal are the product.
  • Allied healthOT, PT, speech, dietitians, optometry, podiatry. Different rules, same need to be found and paid.

Twenty-three professions have their own sourced pages, with the rules that actually apply to them: state telehealth law, compacts, board restrictions. Where a board forbids a service from filing on a clinician's behalf, the page says so and we do not sell it.

System map

The platform, as a map you can poke.

Choose a module. Its neighbors light up. Every connection runs through an adapter, so any vendor behind it can change.

For a health system

The same loop, at a larger scale.

A health system has the same four jobs a one-doctor practice has. It just has more people to disappoint when one of them breaks.

  • Patient acquisitionAnswer-engine visibility, paid media judged on collected revenue, and call and form attribution that survives privacy law.
  • Digital front doorOne portal for enrollment, forms, messaging, visits and payment, under the system's brand, on its own domain.
  • Audit postureImmutable logs, retention rules written down, tenant isolation tested, and a compliance trail a surveyor can read.
  • Vendor economicsConsolidate the ten-vendor sprawl, keep best-of-breed where it earns its place, and swap any of them behind an adapter.

First 90 days

What I would do in the seat.

Listen and map

CTO
  • Inventory every system that touches a patient or their data, with owner, cost and contract date.
  • Read the last security risk assessment and the last audit finding.
  • Find where PHI leaves the building: ad pixels, analytics, forms, call recordings.
CMO
  • Trace the patient journey from first search to first visit and mark every handoff that loses a person.
  • Audit how the system appears in AI answers, local search and maps.
  • Pull cost per booked visit by service line, not by channel.

Operating rules

What I will not compromise on.

  1. Never lose a lead.Storage and email fail independently. Success if either works.
  2. A person confirms every AI change.The assistant proposes. The practice applies.
  3. Soft delete by default.Every hard delete is on a written list with a reason.
  4. Synthetic data only outside production.Demos refuse to start against anything not marked demo.
  5. Integrate, do not replace.Big vendors sit behind adapters, so contracts change without rewrites.
  6. Accessibility is a test.Axe checks, keyboard-only paths and reduced-motion are in CI.
  7. Agents write, tests judge.I run AI-assisted engineering with a suite as the referee, never trust.
  8. Say what is built.Every module here is labeled in production, demo or in build.

Talk

Let's put the loop to work for your patients.

One conversation. I will bring the questions I would ask in the first week, and you bring the system you worry about most.

Email Justin