Idea to working app in 21 to 30 days
Two productized sprints. Real deliverables on a real calendar. The scope is on this page, the price is on this page, and the engagement ends on the day it says it does.
Fixed price, fixed window
You see the number before you sign. The number does not move during the sprint.
AI-native delivery
One senior engineer plus an agent fleet does the work that took a five-person team in 2022. The price reflects that.
Code is yours on day one
Repo, infra, and accounts live in your org from the start. No handoff cliff at the end.
Pick the sprint that fits
Both tiers are real productized engagements. Same engineer, same repo handover, same Friday demo cadence. Pick HIPAA only if you need infrastructure provisioned in BAA-eligible mode from day one. Compliance work itself is on you and your counsel — we ship the technical setup, not certifications.
MVP Sprint
Idea to TestFlight + Play Internal in three weeks. Bounded scope, fixed price, no SOW theater.
In scope
- Flutter app (iOS + Android), one shared codebase
- Supabase backend (Postgres + auth + storage)
- Email + OAuth sign-in (Google or Apple, your pick)
- One paid integration: Stripe, Twilio, or SendGrid (pick one)
- TestFlight build and Play Internal track submission
- Linear board access for the duration of the sprint
- Weekly Friday demo on Zoom (recorded)
- Source code + repo handover on day one
Not included
- Custom design system or brand identity work
- Native iOS or Android platform modules (Swift / Kotlin)
- HIPAA controls (see HIPAA tier below)
- App Store / Play marketing assets, screenshots, copy
- Production-grade observability, on-call, or SLAs
HIPAA MVP Sprint
Everything in the MVP Sprint, plus a BAA-eligible technical setup so your clinical pilot starts on infrastructure that is ready for compliance work, not blocking it.
In scope
- Everything in the MVP Sprint
- Supabase Team plan provisioned in BAA-eligible mode
- AWS account hardening (encryption-at-rest on S3, IAM least-privilege baseline)
- Audit-log schema and Postgres Row Level Security policies
- Inventory of services in the data path (Supabase, AWS, your auth provider) — a list, not legal advice
- Technical handover doc: what was configured, exact AWS / Supabase resources, and the open technical items your security counsel should review
Not included
- Any compliance attestation, certification, or legal sign-off
- Compliance memos, gap analyses, or risk assessments — those belong with your counsel or a HIPAA consultant
- Signing or negotiating BAAs with your vendors on your behalf
- Third-party HIPAA audit
- SOC 2 Type 1 or Type 2
- Penetration test (we can recommend a vendor)
- Full HITRUST or ISO 27001 program
Payment schedule
Three invoices, on a 40 / 30 / 30 split. Each one ties to a concrete milestone you can verify with your eyes.
- 1
40% on kickoff
Triggers repo creation, Linear board access, and the first Friday demo on the calendar.
- 2
30% at mid-sprint demo
Paid against the Friday demo where the core flow is running end-to-end on a real device.
- 3
30% on TestFlight + Play Internal handover
Final invoice clears when you have working builds in TestFlight and Play Internal, and the repo is fully transferred.
What if scope changes?
In a 3-week sprint, scope changes are not a free variable. If you ask for something that is not on this page, we will tell you within 24 hours whether it fits inside the sprint, costs extra, or needs to wait for a follow-up engagement.
Small swaps (Stripe instead of Twilio, Google OAuth instead of Apple) are free as long as we are still inside week one. After week one, swaps cost a fixed change-order fee of $500 and may push the demo by a few days.
Net-new scope (a second integration, a custom design pass, a new platform target) gets quoted as a separate engagement so the sprint stays on its rails.
Frequently asked questions
Why is this so much cheaper than a typical agency SOW?+
Two reasons. First, the scope is genuinely bounded: you pick one paid integration, one auth method, one mobile platform target (Flutter ships both). Second, AI tooling has compressed the work. We are not pretending a four-person team is on this; one senior engineer with the right agents can land this scope in three weeks.
What if my idea does not fit the scope?+
Then this is not the right offer. The point of a packaged sprint is that the scope is real. If you need a custom design system, native modules, or a multi-region rollout from day one, book a call and we will scope a custom engagement instead.
Do I own the code?+
Yes. The repo is created in your GitHub org on day one. Supabase and AWS accounts are yours. You can fire us and keep building on Friday of week three with no licensing or platform lock-in.
What happens after the sprint ends?+
You have a TestFlight build, a Play Internal build, the repo, and the infra. Most clients either keep building in-house, hire us on a separate retainer, or pause to gather user feedback before the next sprint. There is no auto-renewing engagement.
Does the HIPAA Sprint make my product HIPAA compliant?+
No, and you should be wary of anyone who tells you it does. HIPAA compliance is an organizational program, not a deliverable a vendor can hand you in four weeks. What we ship is the technical foundation: Supabase provisioned in BAA-eligible mode, AWS hardened with encryption-at-rest and least-privilege IAM, audit-log schema, RLS policies, and a written inventory of what was set up so your security counsel or HIPAA consultant can review it. The certification, the policy work, the BAA negotiations, and the ongoing program are on you. We will not write your compliance memos.
Book a 20-minute intro
We will use the call to confirm scope fit. If your idea does not fit either tier, we will say so on the call instead of sending you a six-week SOW.
Calendar not loading? Email contact@hlt3.studio and we will send a direct link.