I build clinical software for the Dutch and German healthcare market, and I run the infrastructure it lives on.
Since March 2025 that has meant Vocadoc: an AI documentation platform that listens to a consultation and drafts the record. It is in production with GGZ practices, EU-hosted, encrypted end to end. I wrote the first line of it and I still own the architecture, the release process, and the regulatory file.
Not the code. The code is the easy half.
The hard half is that a very small vendor cannot ship into European healthcare on engineering alone. It has to survive a procurement review, a DPA negotiation, a security questionnaire, and eventually an audit. So I learned that half too: NEN 7510 and ISO 27001 scoping, GDPR and UAVG in practice rather than in summary, the EU AI Act obligations that attach to a clinical documentation system, §203 StGB and what it means for German entry. I have drafted and negotiated the data processing agreements in three languages.
Most engineers who can build this cannot clear that. Most people who can clear it cannot build. Doing both from one desk is the actual thing I am selling.
Vocadoc runs on infrastructure I own and operate rather than on a managed platform. EU hosting and clinical data made that defensible. Honestly, I would have built it this way regardless: self-hosting is the part of this work I like most, and owning the whole stack from the firewall rule up is what makes the rest of it possible.
- Speech. A proprietary transcription engine, built in-house on PyTorch with TensorRT and purpose-built for clinical audio. Multi-site and horizontally scalable, with workers schedulable across the fleet and failover between sites, so capacity follows demand rather than sitting pinned to one machine. It is the piece of distributed systems engineering I am most attached to and the reason Vocadoc's latency is what it is.
- Product. Python and FastAPI on PostgreSQL and Redis, React on the front. Roughly 1,200 tests on the backend, which is the only reason a solo release cycle is survivable.
- Platform. Proxmox clusters across two sites, a WireGuard mesh that survives CGNAT, dual redundant edge gateways running HAProxy and ModSecurity, private container registries, centralised observability, offsite encrypted backups on a verified restore path.
- Access. Default-deny at every boundary, hardware-key-gated privilege escalation fleet-wide, an internal CA, no public SSH anywhere.
I have moved production between sites without dropping a request, and failed it back again.
Started writing code in 2015, in secondary school. Freelanced as Ayubi IT for five years doing web work and client projects. Studied Wirtschaftsinformatik at Heilbronn, moved to the Netherlands in 2023, and now read for a BSc in Artificial Intelligence at Radboud University while running the company. The degree is deliberately the slower track. Vocadoc is the priority.
My work lives in a self-hosted GitLab, so what is here is the subset that makes sense to open: standalone utilities, automation, and the occasional upstream fix. The commit graph is not a measure of anything and I would rather it were not read as one.
Neolyth, my consultancy, does the same work for other people: AI infrastructure, self-hosted platform operations, and getting small teams through the compliance wall standing in front of a regulated market.
If you are building in healthcare technology, or you need someone who can go from the firewall rule to the data processing agreement without a handoff, I am reachable.
