A home-infusion pharmacy gave its delivery nurses a proof-of-delivery app that survives basement drops

Representative examplesEvery case study in this library is an illustrative composite of the kind of engagement we deliver — written to show our method and standards, not to name clients.

Where they started

Compounded medications leave this regional pharmacy's warehouse every morning in temperature-controlled boxes, carried by a small fleet of contract nurses who deliver to homes across two counties. The pharmacy's dispensing software ends at its dock door — after that, delivery is paper manifests and phone calls. Everything downstream of the sterile compounding line is governed by patient-privacy rules the compliance officer takes seriously, and the cold chain is clinically consequential: a warmed box is not a product, it is an incident.

What it was costing

Nurses delivered compounded medications with paper manifests and called the office to confirm each drop; a missed call meant a duplicated route the next day, and cold-chain disputes had no evidence trail.

What they could see

• The office called each nurse to confirm every drop, and an unanswered call meant rerunning the route the next day on speculation.
• Cold-chain disputes ended in the pharmacy's word against the receiving facility's, because there was no temperature or timestamp evidence.
• Route sheets were retyped into a spreadsheet by office staff each afternoon, and transcription errors produced occasional wrong-address deliveries.
• Nurses phoned the office from basements and garages to read out delivery details the office then re-entered.

The constraints we worked inside

• Deliveries happen in homes, basements, and garages — the app must capture proof with no signal and upload whenever connectivity returns.
• Health privacy governs every field; patient identifiers cannot persist on the device longer than the route.
• The dispensing software exports manifests as nightly spreadsheets; there is no live API.

What had been tried before

The office adopted a consumer e-signature app and asked nurses to capture signatures on it at each address.

It needed connectivity at the doorstep, captured nothing about temperature, and its terms gave the pharmacy no confidence about where patient-adjacent data was stored.

A check-call policy required nurses to phone a duty number after every delivery, logged by hand in a ring binder.

Calls slipped in basements and parking garages, the binder's entries went unverified, and the policy taxed exactly the nurses who were already doing things correctly.

What we proposed

We proposed an Android proof-of-delivery app that captures scans, signatures, and temperature readings to encrypted local storage the moment they happen, then syncs in batches whenever the network appears — coverage never blocks a delivery. The manifest carries tokenized patient references only, so names resolve server-side and a lost phone is an inconvenience rather than a reportable breach. A nightly ingest reconciles the dispensing software's spreadsheet exports against completed deliveries, surfacing every exception to the office each morning.

Just as important is what we ruled out, and why:

• A last-mile delivery SaaS platform — Its proof model stored patient-identifiable delivery records on the vendor's servers indefinitely — a direct conflict with the pharmacy's data-minimization stance — and it had no cold-chain evidence fields.
• Querying the dispensing software directly — It exposes no API; its nightly spreadsheet export is the entire integration surface, so any solution had to treat the export as the system boundary rather than fight it.
• Ruggedized dedicated scanner hardware with a vendor app — Nurses use personal phones across two counties; issuing and tracking hardware for a contract workforce was a logistics and cost problem larger than the software one.

How the work ran

Delivered by the systems pod — mobile engineer + automation specialist over 7 weeks, with working increments reviewed with the client every week.

The stack, and the reasoning

Kotlin

The nurse fleet is Android across a wide range of personal devices; Kotlin native gave camera, storage, and background behavior without a compatibility layer.

CameraX

Barcode capture had to work in dim basements with cheap cameras and give nurses torch control; CameraX handles device variation we would otherwise have hand-rolled.

Encrypted Room

Patient references live on the device only for the duration of a route; encrypted local storage with route-end purge is what makes the lost-phone story true.

Hilt

The sync engine, ingest reconciliation, and capture flows had to be testable in isolation before they touched patient data; dependency injection kept the modules honest.

Nightly ingest pipeline

The dispensing software's spreadsheet export is a fixed constraint; turning it into a reconciling pipeline converted that constraint into the control point for delivery integrity.

What went wrong

How we worked together

Cadence

A Monday morning route-review call with the pharmacy manager and lead nurse, walking the previous week's reconciliation exceptions line by line.

Client side

The compliance officer owned the privacy review and signed the data model; the lead nurse owned field workflow; three pilot nurses across urban and rural routes fed back weekly.

Decisions

Anything touching patient data went to the compliance officer in writing and came back signed; workflow choices were settled on the Monday call or trialed for one route-week.

They provided

Nightly manifest exports from the dispensing software, a privacy review of every field and flow, nurse devices for the pilot, and time shadowing two full routes.

What changed

The headline: every route in the pilot region confirmed in-app, with reconciliation exceptions reviewed each morning — Paper manifests → app-verified deliveries, read from Delivery reconciliation report. A second check: cold-chain disputes unresolved for lack of evidence since rollout at 0.

The morning exception review replaced the afternoon phone tree. The office starts the day knowing exactly which deliveries completed, which need a call, and which cold-chain readings deserve a second look — before the nurses leave, not after the dispute. Nurses stopped performing proof for the office; the app records the work they were already doing. The compliance officer now shows the data model to auditors as evidence of practice rather than a promise of it, and the dispensing team trusts the delivery numbers in its own reports.

The result was read from Delivery reconciliation report against the pre-engagement baseline over the stated window, with a guardrail check on cold-chain disputes unresolved for lack of evidence since rollout. Where platform-reported numbers and business outcomes differ, this record says which layer it is quoting.

What they own now

• Google Play account, signing keys, and the app's release process
• Encryption key management and route-end purge runbook reviewed with the compliance officer
• The nightly ingest pipeline with its reconciliation dashboard and exception taxonomy
• A device provisioning guide for onboarding contract nurses onto personal phones
• An incident contact sheet linking app alerts to the office's on-call routine