Case study / CheckUp Asia · Singapore
A platform we did not build, made fit to run.
CheckUp Asia compares health screenings and medical packages across hospitals in Asia. It existed and it worked. A technical review in September 2026 said what it was not yet safe to scale, and we were brought in to close that list.
The brief
Forty-nine findings, and a date.
The review grouped its findings into six workstreams — security, correctness, testing, internationalisation, discoverability and the build itself. Most of them were the kind of thing that never shows on screen and decides everything: who a database row will answer to, whether a function checks that its caller is staff, whether anything at all proves a change did not break a booking.
What we did
Security
Row-level policies narrowed from public to authenticated and scoped to the columns each role owns. Admin routes guarded, passport data encrypted at the application layer, rate limits put on the AI endpoints, and three email functions that would relay for anyone closed. Postgres upgraded to collect outstanding patches.
Tests, from nothing
The project had no executable test suite. It now has Vitest, policy tests that prove one patient cannot read another's records, and Playwright end-to-end specs — gated behind their own env file so they can never point at production. The first full run was 43 of 43.
Accessibility
158 failures across 15 pages, taken to zero with no exceptions carried forward.
Twelve languages
Around 970 strings were hardcoded in the markup. They were extracted into a catalogue, the application was put behind locale routing, dates, numbers and currency were made locale-aware, and twelve languages were translated and switched on — more than the five the engagement originally scoped.
Being findable
Missing content answered HTTP 200 instead of 404, public pages shipped two title tags and duplicate social metadata, and the sitemap was generated in CI against the production database. All three fixed, search moved off a client-side catalogue load onto Postgres search, and results server-rendered.
A provider side
Hospitals had no way in. There is now a portal where a provider registers, works its own appointment requests, edits its services and prices, and sees its own analytics — plus an admin shell rebuilt around it.
Counted, not estimated
- 49
- findings in the September review, across six workstreams
- 78 / 81
- cards closed on the board at the time of writing
- 158 → 0
- accessibility failures across fifteen pages
- 12
- languages translated and live
This one is still open, and saying otherwise would be the easiest lie on the site.
Three cards are still moving: taking ownership of the deployment, the pull-request and decision record, and the catalogue content the platform needs before it is worth showing at scale. The last of those is a data job for the provider relationships rather than an engineering one, which is exactly why it is not finished — we can rebuild a service card, and we cannot write seven thousand prices we do not hold.
Visit CheckUp AsiaWhat we did
- Custom Software
- Security hardening
- Test automation
- Internationalisation
- Accessibility
Inherited something you are afraid to deploy?
Send us the repository and the thing you are most worried about. We will tell you whether it needs rewriting or just the twenty fixes nobody has had time for.
Start a project