Stream A · Product
Configuration from 90+ pre-validated modules. Integration of your clinical content and therapeutic logic.
Phase 01 · BUILD
Digital therapeutics, the way only a platform can build them.
From a finished therapeutic concept to a DiGAV-compliant, CE-marked product under MDR. 12 weeks for the Phase 1 block – instead of typically 9–18 months for custom development.
Why different
In custom development, the compliance stack is rebuilt for every product. The mHealth Suite brings it as shared infrastructure.
Classic medical device development is a project: custom architecture, custom regulatory work, custom post-market effort. The result is typically nine to eighteen months to CE marking and development costs that recur for every indication.
The mHealth Suite inverts the logic. It is a platform: indication-agnostic, modular, with compliance as part of the architecture. What is standardised below – data, security, documentation, BSI TR-03161 – gets configured above for your product. Therapeutic concept, content, interaction logic.
The difference isn’t incremental. It’s structural.
The timeline
Twelve weeks. Four parallel streams. One CE-marked product under MDR at DiGA compliance level.
Before kick-off
Intended purpose & therapeutic concept
Medical intended purpose, therapeutic logic, evidence strategy, regulatory pathway – DiGA fast-track, DiPA or MDR Class I/IIa. Upstream of the 12-week clock. The duration depends on your prior work; the 12-week clock only starts once this foundation is in place.
Responsible Customer + DUX
The twelve weeks · four parallel work packages
Not sequential – four streams run at the same time. That's why it's twelve weeks instead of typically 9–18 months for custom development.
Stream B · MDR documentation
Highly automated MDR technical documentation from the platform QMS. Plus clinical evaluation, risk management and Data Protection Impact Assessment for your product.
Stream C · Cybersecurity (per DiGA)
BSI TR-03161 assessment by a BSI-recognised testing body – product-specific, per DiGA. Required as a certificate since 1 January 2025 (Section 139e (10) SGB V); since 1 July 2025 a prerequisite for formal application completeness (DiGA Guide v3.6, ch. 3.4). The platform provides architecture and evidence; the assessment runs per product.
Stream D · CE marking under MDR
Conformity assessment, technical documentation, audit preparation. Class I (software without a measurement function): manufacturer’s Declaration of Conformity, CE mark self-affixed – no Notified Body on the product side. Class IIa: involvement of a Notified Body under MDR Annex IX – QMS audit and review of the technical documentation, Notified Body certificate. In parallel with development, not after.
After week 12
CE-marked under MDR, BSI-compliant, at DiGA level
Result: your product carries the CE mark under MDR (Class I: manufacturer’s Declaration of Conformity; Class IIa: additionally with Notified Body certificate) and has the test lab’s TR-03161 report as the basis for the BSI certificate; evidence for the BfArM data protection criteria is part of the QMS. Then, depending on the pathway, the study or evaluation concept and the BfArM application follow. The BfArM decides within three months of receiving the complete application; in justified cases the period can be extended by up to three months (Section 139e (3) SGB V). Launch, market introduction and reimbursement onboarding come after BfArM listing – not within the twelve weeks.
What's inside
90+ modules your product is composed from.
The modules are pre-validated, technically reviewed and operationally ready. They aren’t rebuilt per project – they are configured per project.
Health data & integration
Apple Health / Google Fit · Bluetooth medical devices · Electronic Patient Record (ePA)
Patient data management
Onboarding flows · patient profiles · questionnaires · GDPR consent · PIN and biometric lock
Clinical modules
Medication plans · training and exercises · vision and fitness tests · symptom diaries · pain monitoring
Regulatory & security
BSI TR-03161 architecture · MDR-compliant documentation · BfArM Data Protection Criteria (evidence part of our QMS) · data correction workflows
Community & engagement
Chatbot (FAQ) · challenges · notifications · surveys · social share
Telemedicine & care
Physician integration · pharmacy integration
Evidence with substance
Certified on process level, assessed per DiGA on product level.
We cover both BSI standards relevant to the DiGA market – TR-03185 on the process level (our software development process is certified), TR-03161 on the product level (every DiGA is assessed individually; our DiGAs assessed so far passed without conditions). For you that means: both evidence levels are prepared before your project begins.
BSI TR-03161
Assessed per DiGA
DiGAs assessed so far: passed without conditions.
Cybersecurity · certified per DiGA.
BSI TR-03161 is awarded per DiGA – not per organisation. The DiGAs on our platform assessed so far passed without conditions.
BSI TR-03185
First certified 17 July 2026
First company to hold this process certificate.
Secure software development lifecycle.
DUX Healthcare was the first company to hold a BSI process certificate based on TR-03185: BSI-K-TR-0900-2026, issued 17 July 2026, valid until 16 July 2029. The certified scope is the software development process for digital health applications (DiGA). Under a BSI procedure (pilot since February 2026), product updates no longer require TR-03161 re-certification as long as a valid TR-03185 certificate is held and surveillance audits are passed (BSI, 4 February 2026).
Baseline
ISO 13485
Quality management for medical devices – certified (TÜV Hessen)
The math
In-house development versus mHealth Suite.
| Traditionelle Entwicklung | mHealth Suite | |
|---|---|---|
| Phase 1 to CE marking | typically 9–18 months (custom) | 12 weeks |
| Development cost | bespoke estimate | standard rate for the standard scope |
| MDR · DiGA · BSI · GDPR | has to be built up | architecture and evidence built into the platform, assessed per product |
| Architecture | rebuilt per indication | indication-agnostic, modular |
| Legacy · existing DiGAs | not transferable | migratable as DiGA transfer |
| International expansion | repeated infrastructure investment | on the same platform; internationally, DUX is in market entry |
Who you are
Four ways into BUILD.
For pharma
Adherence-focused companion apps for Rx medication.
Companion apps that connect telemedicine and integrated patient journeys with your existing patient support program architecture. Not marketed as a DiGA – but integrated as an adherence-supporting building block of your product.
For startups
Time-to-market your cap table will like.
No in-house build-up of regulatory infrastructure. No 9–18-month lead time to CE marking as in custom development. Instead: your clinical concept, configured to a CE-marked product. Twelve weeks. Predictable cost.
For DiGA manufacturers
DiGA transfer when compliance in-house is becoming unmanageable.
If your in-house development no longer keeps up with the updated BfArM review criteria or BSI TR-03161: we migrate your existing DiGA into the mHealth Suite. The migration is notified to the BfArM as a significant change (Section 139e (6) SGB V); the migrated version needs a new TR-03161 certificate.
For international DTx manufacturers
Market entry Germany without your own regulatory team.
You have a DTx in the US, UK or APAC and want to enter the German statutory health insurance market. We re-implement on an MDR/DiGAV basis – as platform and development partner, not as manufacturer of the DiGA.
Pricing
Standard rate for the standard scope.
The mHealth Suite is operated as a leasing model. You pay setup and ongoing operations – no hidden licence or platform fees, no milestone negotiations.
The platform engagement
Setup
€100,000
one-off
Product development and initial configuration, MDR documentation, documentation for the clinical evaluation and the manufacturer’s Declaration of Conformity, release management through go-live.
Operations
€15,000
per month
Further development on regulatory changes, hosting and operations, technical support, compliance maintenance, continuous security updates. Minimum term twelve months, payable in advance.
Optional
on request
Regulatory Concierge
Consulting package: intended purpose, risk management, clinical evaluation, preparation of the Declaration of Conformity. If you don’t want to carry the regulatory work in-house.
In addition, as a third-party service: external manufacturer service for market placement of the SaMD, currently €28,000 per year (optional). Customer-specific functionality on request.
Next step
Thirty minutes. Your intended purpose. An honest assessment.
A short conversation: whether the mHealth Suite fits your project and, if so, where we would start.
Book a call with Christoph