Clinical AI needs infrastructure most general-purpose clouds don't satisfy out of the box. We chose AWS as our sole cloud provider from day one because it checks every box.
AWS gives us managed ML tooling (SageMaker), replicated object storage (S3), managed databases (RDS), network isolation (VPC), and the access controls (IAM) clinical data governance demands — under one platform.
Every AWS service in the Qelvoro Tech stack does a specific job — nothing here is interchangeable.
Hosts the AI model for skin condition classification and severity scoring. Managed endpoints handle deployment, scaling, and low-latency inference — trained on clinical image datasets, so a small team doesn't run ML infrastructure by hand.
Holds every patient image and generated PDF report, each encrypted with AES-256 and locked down via bucket policies and IAM roles. Lifecycle policies move older records to Glacier cost-effectively without losing availability.
Stores all structured data — patient records, analysis results, notes, accounts, and clinic configs. Multi-AZ deployment keeps it available, with automated daily backups and point-in-time recovery by default.
Runs our web app server and REST API inside an Auto Scaling Group. Instances spin up automatically during peak clinic hours, keeping response times steady without over-provisioning off-peak.
Handles event-driven work: preprocessing images before inference, generating PDF reports, and sending notifications — triggered by S3 uploads and API Gateway requests. Pay-per-run pricing fits a lean, startup-stage budget.
IAM enforces least-privilege access across every resource — app roles, developer roles, and CI/CD pipelines each carry scoped policies. The app lives inside a VPC, with private subnets for the database and AI layers; only the load balancer sits in a public subnet.
Here's the path a single patient image takes through our AWS infrastructure.
The browser sends a secure POST request to the EC2 API server through an AWS Load Balancer. TLS terminates at the load balancer; CloudFront serves static assets globally.
The EC2 server writes the image to a dedicated S3 bucket with server-side encryption. RDS stores a pre-signed URL to the object, and an S3 event triggers a Lambda preprocessing function.
Lambda resizes and normalises the image, then submits it to a real-time SageMaker endpoint, which returns structured JSON with condition classification, severity score, and region coordinates.
Lambda writes the structured output to the patient record in RDS (PostgreSQL). All connections originate inside the VPC's private subnet — RDS is never exposed to the internet.
The API server retrieves the analysis from RDS and returns it to the browser. The clinician reviews, adds notes, and can trigger PDF generation via a second Lambda call — the finished PDF lands in S3 with a download link.
At this stage, AWS costs — especially SageMaker and RDS — are our biggest operating expense.
Our core value depends on AI inference running on SageMaker. A real-time clinical endpoint needs to stay up through clinic hours — that's measurable cost before we're generating subscription revenue.
AWS credits offset that pre-revenue spend directly — letting us run production-grade infrastructure, onboard pilot clinics at no cost to them, and keep iterating without infrastructure spend holding us back.
As subscriptions grow, the architecture scales with them — more EC2 capacity, additional SageMaker variants, higher S3 throughput. AWS credits let us prove out that scaling path during the pilot phase.
| AWS Service | Use Case | Est. Monthly |
|---|---|---|
| Amazon SageMaker | ml.m5.large inference endpoint × 2 | ~$180 |
| Amazon EC2 | t3.medium × 2, Auto Scaling Group | ~$60 |
| Amazon RDS | db.t3.medium, Multi-AZ PostgreSQL | ~$80 |
| Amazon S3 | Image storage + generated reports | ~$25 |
| AWS Lambda | Image preprocessing + report generation | ~$10 |
| AWS CloudFront | Static asset delivery + SSL | ~$12 |
| AWS IAM / VPC / KMS | Security, key management, networking | ~$8 |
| Total Estimated | ~$375 / month |
Estimates based on AWS public pricing for the ap-southeast-1 region. Actual costs will vary with clinic traffic volume.
Every S3 object is encrypted with AES-256; RDS storage uses AWS KMS-managed keys. Enforced at the infrastructure level, not application code.
All client traffic runs over HTTPS/TLS 1.2+. Internal VPC traffic uses SSL-enforced RDS connections and signed HTTPS requests to SageMaker.
RDS and SageMaker sit in private subnets with no public internet access. Security Groups let only application-tier instances reach the data layer.
Every application component runs under a scoped IAM role granting only the permissions it needs. Nothing uses root credentials or broad, catch-all IAM policies.
CloudTrail records every API call across the account. Application logs live in CloudWatch, and patient record access is also logged in the app database.
RDS automated backups run daily with 35-day retention and point-in-time recovery. S3 versioning is on for the images bucket, and Multi-AZ RDS gives automatic failover.
Our team is happy to go deep with clinic partners, investors, and cloud programme reviewers.
Get in Touch