Idea to installable MVP in 10 to 15 working days
Two productized sprints. Real deliverables on a real calendar. The scope is on this page, the price is on this page, and the engagement ends on the day it says it does.
Fixed price, fixed window
You see the number before you sign. The number does not move during the sprint.
AI-native delivery
AI-assisted implementation compresses repetitive work; one senior engineer remains accountable for every architecture and release decision.
Code is yours on day one
Repo, infra, and accounts live in your org from the start. No handoff cliff at the end.
Pick the sprint that fits
Both tiers are real productized engagements. Same engineer, same repo ownership, same working-software demo cadence. Pick HIPAA only if you have the required vendor arrangements and need the technical safeguards configured from day one. Compliance itself is on you and your counsel — I ship the technical setup, not certifications.
MVP Sprint
One core workflow to TestFlight + Play Internal in 10 working days. Bounded scope, fixed price, no SOW theater.
In scope
- One user role, one core workflow, and up to six core screens
- Flutter app for iOS + Android from one shared codebase
- Supabase backend (Postgres + auth + storage)
- One sign-in method: email magic link, Google, or Apple
- One paid integration: Stripe, Twilio, or SendGrid (pick one)
- TestFlight build and Play Internal track submission
- Linear board access for the duration of the sprint
- Recorded working-software demos on days 5 and 10
- Repository in your GitHub organization from day one
Not included
- Custom design system or brand identity work
- Additional user roles, core workflows, or admin dashboard
- Native iOS or Android platform modules (Swift / Kotlin)
- HIPAA controls (see HIPAA tier below)
- App Store / Play marketing assets, screenshots, copy
- Production-grade observability, on-call, or SLAs
HIPAA MVP Sprint
Everything in the MVP Sprint, plus a BAA-eligible technical setup so your clinical pilot starts on infrastructure that is ready for compliance work, not blocking it.
In scope
- Everything in the MVP Sprint
- Configuration of your eligible Supabase plan after required BAA arrangements
- AWS account hardening (encryption-at-rest on S3, IAM least-privilege baseline)
- Audit-log schema and Postgres Row Level Security policies
- Inventory of services in the data path (Supabase, AWS, your auth provider) — a list, not legal advice
- Technical handover doc: what was configured, exact AWS / Supabase resources, and the open technical items your security counsel should review
Not included
- Any compliance attestation, certification, or legal sign-off
- Compliance memos, gap analyses, or risk assessments — those belong with your counsel or a HIPAA consultant
- Signing or negotiating BAAs with your vendors on your behalf
- Third-party HIPAA audit
- SOC 2 Type 1 or Type 2
- Penetration test (I can recommend a vendor)
- Full HITRUST or ISO 27001 program
Payment schedule
Two invoices on a 50 / 50 split. The final half is tied to installable builds and handover you can verify.
- 1
50% on kickoff
Triggers repo creation, Linear board access, and the first working-software demo on the calendar.
- 2
50% on TestFlight + Play Internal handover
Final invoice clears when you have working builds in TestFlight and Play Internal, plus the agreed handover documentation.
What if scope changes?
In a 10- or 15-day sprint, scope changes are not a free variable. If you ask for something that is not on this page, I will tell you within one business day whether an equal-size item can be swapped or the request needs a follow-up engagement.
Equal-size swaps are free before implementation of the affected item begins. Once it is in progress, changing it means removing equivalent work or quoting a follow-up.
Net-new scope (a second integration, a custom design pass, a new platform target) gets quoted as a separate engagement so the sprint stays on its rails.
Frequently asked questions
Why is this so much cheaper than a typical agency SOW?+
Two reasons. First, the scope is genuinely bounded: one user role, one core workflow, up to six core screens, one integration, and one sign-in method. Second, AI-assisted implementation compresses repetitive work while one senior engineer remains responsible for architecture, review, testing, and release.
What if my idea does not fit the scope?+
Then this is not the right offer. The point of a packaged sprint is that the scope is real. If you need a custom design system, native modules, or a multi-region rollout from day one, book a call and I will scope a custom engagement instead.
Do I own the code?+
Yes. The repo is created in your GitHub org on day one. Supabase and AWS accounts are yours. You can stop working with me and keep building after delivery with no licensing or platform lock-in.
What happens after the sprint ends?+
You have a TestFlight build, a Play Internal build, the repo, and the infrastructure. You can keep building in-house, scope a follow-up sprint, or pause to gather user feedback. There is no auto-renewing engagement.
Does the HIPAA Sprint make my product HIPAA compliant?+
No, and you should be wary of anyone who tells you it does. HIPAA compliance is an organizational program, not a deliverable a vendor can hand you in 15 working days. What I ship is the technical foundation: configuration of your eligible Supabase plan after required BAA arrangements, AWS encryption and least-privilege IAM, audit-log schema, RLS policies, and a written inventory for your security counsel or HIPAA consultant to review. Certification, policy work, BAA negotiations, and the ongoing program remain yours.
Book a 20-minute intro
I will use the call to confirm scope fit. If your idea does not fit either tier, I will say so on the call instead of sending you a six-week SOW.
Calendar not loading? Email hello@hlt3.studio and I will send a direct link.