A clinical AI product needs infrastructure that meets requirements most general-purpose clouds don't satisfy out of the box. We chose Amazon Web Services as our sole cloud provider from day one because it's the only platform that checks every one of these boxes.
AWS gives us managed AI/ML tooling (SageMaker), globally replicated object storage (S3), managed relational databases (RDS), compliant network isolation (VPC), and the identity and access controls (IAM) that clinical data governance demands — all under one unified platform.
Every AWS service in the Qelvoro Tech stack does a specific job — nothing here is interchangeable.
Amazon SageMaker hosts the AI model responsible for skin condition classification and severity scoring. Its managed endpoints handle deployment, automatic scaling, and low-latency inference. The model was trained on clinical image datasets and runs as a real-time inference endpoint, which means a small engineering team doesn't have to run ML serving infrastructure by hand.
Amazon S3 holds every patient skin image and generated PDF report. Each object carries AES-256 server-side encryption, and access is locked down through S3 bucket policies and IAM role assignments. S3's 99.999999999% durability and lifecycle policies let us move older patient records to Glacier cost-effectively without losing availability.
Amazon RDS running PostgreSQL stores all structured application data — patient records, analysis results, clinical notes, user accounts, and clinic configurations. Multi-AZ deployment keeps it available across the region, and automated daily backups with point-in-time recovery run by default. RDS's managed model removes the operational overhead of patching, failover, and backups.
Our web application server and REST API run on Amazon EC2 instances inside an Auto Scaling Group. During periods of heavy clinic traffic — typically morning hours — additional instances spin up automatically. That keeps response times steady without over-provisioning during off-peak periods, which matters directly for startup cost management.
AWS Lambda handles our event-driven work: preprocessing images before SageMaker inference, generating PDF reports once analysis completes, and sending asynchronous notifications. Functions trigger off S3 upload events and API Gateway requests. Since Lambda only costs money when it actually runs, it fits a lean, startup-stage compute budget.
AWS Identity and Access Management (IAM) enforces least-privilege access across every AWS resource. Application roles, developer roles, and CI/CD pipelines each carry scoped IAM policies. The whole application lives inside an Amazon VPC, with private subnets for the database and AI inference layers — public subnets host only the load balancer. VPC Security Groups restrict traffic to defined port and protocol rules.
Here's the path a single patient image takes through our AWS infrastructure.
The browser client sends a secure POST request to the API server on Amazon EC2 through an AWS Application Load Balancer. TLS terminates at the load balancer, and CloudFront serves static assets globally.
The EC2 API server writes the raw image to a dedicated S3 bucket with server-side encryption (SSE-S3). RDS stores a pre-signed URL referencing the image object key, and an S3 event triggers an AWS Lambda preprocessing function.
The Lambda function resizes and normalises the image, then submits it to a real-time Amazon SageMaker endpoint. The endpoint runs the trained CNN inference model and returns structured JSON containing condition classification, severity score, and region coordinates.
The Lambda function writes the structured AI output to the patient record in Amazon RDS (PostgreSQL). All database connections originate from within the VPC's private subnet — RDS is never exposed to the public internet.
The EC2 API server retrieves the completed analysis from RDS and returns it to the browser client. The clinician reviews findings, adds notes, and can optionally trigger PDF report generation via a second Lambda invocation. The finished PDF lands in S3 with a download link returned.
At this stage, AWS costs — especially SageMaker endpoints and RDS instances — represent our biggest operating expense.
Qelvoro Tech's core value depends entirely on AI inference running on Amazon SageMaker. A managed endpoint capable of real-time clinical inference needs to stay up through clinic hours, which means measurable cost before the company is generating subscription revenue.
AWS credits offset that pre-revenue infrastructure spend directly, letting us keep production-grade infrastructure running, onboard pilot clinics at no cost to them, and keep iterating on the product without infrastructure spend holding us back.
As clinic subscriptions grow, the architecture scales with them — more EC2 capacity through Auto Scaling, additional SageMaker endpoint variants as models improve, and higher S3 throughput as image volume grows. AWS credits let the team build and prove out that scaling path during the pilot phase.
| AWS Service | Use Case | Est. Monthly |
|---|---|---|
| Amazon SageMaker | ml.m5.large inference endpoint × 2 | ~$180 |
| Amazon EC2 | t3.medium × 2, Auto Scaling Group | ~$60 |
| Amazon RDS | db.t3.medium, Multi-AZ PostgreSQL | ~$80 |
| Amazon S3 | Image storage + generated reports | ~$25 |
| AWS Lambda | Image preprocessing + report generation | ~$10 |
| AWS CloudFront | Static asset delivery + SSL | ~$12 |
| AWS IAM / VPC / KMS | Security, key management, networking | ~$8 |
| Total Estimated | ~$375 / month |
Estimates based on AWS public pricing for the ap-southeast-1 region. Actual costs will vary with clinic traffic volume.
Every S3 object is encrypted with SSE-S3 (AES-256). RDS storage uses AWS KMS-managed keys. Encryption is enforced at the infrastructure level — bucket and instance configuration, not application code.
All client traffic runs over HTTPS/TLS 1.2+. Internal service-to-service traffic inside the VPC uses SSL-enforced connections to RDS and signed HTTPS requests to SageMaker endpoints.
The RDS database and SageMaker endpoints sit in private subnets with no public internet access. VPC Security Groups let only application-tier instances reach the data layer.
Every application component runs under a scoped IAM role granting only the permissions it needs. Nothing uses root credentials or broad, catch-all IAM policies.
AWS CloudTrail records every API call across the AWS account. Application-level access logs live in CloudWatch Logs, and patient record access events are logged in the application database as well.
Amazon RDS automated backups run daily with 35-day retention and point-in-time recovery enabled. S3 versioning is on for the images bucket, and Multi-AZ RDS deployment provides automatic failover if an instance fails.
Our team is happy to go deep with clinic partners, investors, and cloud programme reviewers.
Get in Touch