HollyConnect is the white-label coaching + telehealth backbone running HollyFit and HollyHealth. It runs your brand too. Multi-tenant by default, RBAC + audit everywhere, payments + pharmacies + labs already wired, and the surfaces ship with your tokens — not ours.
Three shapes of partner today. We're opportunistic about a fourth when the fit is right.
You've outgrown Notion + Airtable + Typeform stitched together. Move 50–500 clients onto one stack with phase-aware programs, lab dashboards, peptide stacks, and a coach-of-record SLA.
You started on Practice Better or Healthie and you're hitting the limits — no EPCS pathway, no real audit log, no multi-state licensing matrix, no own-auth migration plan. HollyConnect is HIPAA-aligned out of the box.
You sell hormones, peptides, GLP-1s, or coaching under your own brand. The platform underneath is fragile, the engineering team is spread thin, and the compliance burden is creeping. White-label HollyConnect — your brand, our backbone.
No long sales cycle. No 12-week build phase. The platform exists; we wire your tenant on top.
30-minute walkthrough of the actual platform — not a slide deck. We map your brand voice + tier structure + pharmacy partners + integrations against the HollyConnect surface area.
Brand tokens flow into every surface. Custom domain wired through Vercel + DNS. Pharmacy partners + state-licensure footprint + intake schemas configured. Migration assistance if you're moving off another stack.
Coaches and clinicians log in to surfaces themed in your tokens. Audit log + RBAC + EPCS + lab orders + insurance + payments are already wired. Reseller Slack channel for the first 90 days.
Every row below is wired into the platform today, used by HollyFit and HollyHealth. White-label tenants inherit the full stack — pick what surfaces you want to expose to your end users.
| Feature | Description | Since |
|---|---|---|
own-authOwn auth (scrypt + sessions) | HollyConnect-owned auth with email verification, password reset, rate-limit. Clerk swap-out path documented. | v7.6 |
rbacRBAC | ~35 permission catalog + 7 system roles. requirePermission() runtime guard. | v7.3 |
tenantMulti-tenant isolation | Every PHI-bearing row carries tenant_id. user_tenants for cross-tenant membership. | v7.0+ |
cross-consentCross-tenant consents | HIPAA-compliant prospective-only revocation. Field-scoped. | v7.0+ |
api-keysTenant API keys + rate limit | SHA-256 hashed bearer tokens, sliding-window rate limit (1000/hr/key default). | v7.3 |
| Feature | Description | Since |
|---|---|---|
schedulingSync video scheduling | Recurring availability + materialized slot cache + ICS calendar attach. | v7.2 |
video-visitsVideo visits (Doxy + Chime) | Doxy.me + AWS Chime providers behind one adapter. Live recording + retention policy. | v7.6 |
soap-notesSOAP notes + autosave scratchpad | Clinician scratchpad → finalized SOAP on End Visit. Audit-trailed. | v7.2 |
rx-erxDoseSpot e-Rx integration | Stub mode by default. Live with DoseSpot envs. EPCS gate refuses Schedule II–V without DEA + epcs_enabled. | v7.3 |
epcsEPCS controlled-substance pathway | 6-check gate (epcs_inactive / no_dea / no_video_encounter / state_restricted / consent_missing / two_factor_missing). | v7.5 |
lab-ordersLab orders (Quest + LabCorp) | ~20 panel definitions. Stub mode default; live with QUEST_API_URL / LABCORP_API_URL. | v7.4 |
lab-interpLab interpreter (AI) | Deterministic band classification + LLM-drafted narrative. Coach-gated, PHI-redacted. | v7.0+ |
icd10-cptICD-10 + CPT coding | ~50 ICD-10 + ~25 CPT seeded. canFinalizeVisit() gate ≥1 ICD-10 + ≥1 CPT. | v7.3 |
consentsE-signed consents | 5 system templates. requireConsent(slug) gate. IP + UA on every signature. | v7.4 |
| Feature | Description | Since |
|---|---|---|
formularyFormulary commerce (~1,400 SKUs) | 5 pharmacy partners, controlled-substance routing, state-restriction matrix. | v7.5 |
routingMulti-pharmacy routing | routePrescription() decides pharmacy + pathway + fallback chain by 6 factors. | v7.5 |
subscriptionsMed subscriptions + auto-refills | Inngest cron pass. Pause / resume / skip-next / cancel from one UI. | v7.5 |
paymentsPayment adapter abstraction | Stripe live; Adyen / Braintree / Recurly placeholders. webhook normalization. | v7.5 |
shippingShipping poll cron | Every 6h: pharmacy adapter getShippingStatus → transmitted/shipped/delivered events. | v7.5 |
marginMargin reporting | MTD KPI + SKU breakdown + pharmacy mix + 6-month subscription cohorts. | v7.5 |
tiers4-tier subscription gating | Self-Guided / Coached / Couples / Concierge with tier-aware feature flags. | v7.0+ |
| Feature | Description | Since |
|---|---|---|
notificationsNotification dispatch (email/SMS/push) | Inngest cron 1m. Resend + Twilio + Expo Push. Per-user/kind/transport opt-ins. | v7.0+ |
messagesCoach-client messaging | Tier-rate-limited. Inbox Copilot pre-computes priority + draft reply. | v7.0+ |
webhooks-outOutbound webhooks (HMAC-SHA256) | 19 event types. Stripe-style signature header. Exponential backoff to 5 attempts. | v7.3 |
rest-apiPublic REST API + OpenAPI | /api/v1 hand-written OpenAPI 3.0.3. /me, /patients, /visits, /prescriptions, /audit-log. | v7.3 |
| Feature | Description | Since |
|---|---|---|
auditAppend-only audit log | Tenant + actor + entity + action + metadata. CSV / JSON streaming export. | v7.0+ |
audit-searchAudit search + saved queries | GIN index on metadata JSONB. 4 saved compliance queries pre-baked. | v7.3 |
phi-redactionPHI redaction in logs | Structured logger redacts before write. Sentry capture sees redacted-meta only. | v7.6 |
encryptionWearable token encryption (AES-256-GCM) | WEARABLE_TOKEN_KEY + per-row key_version for staged rotation. | v7.6 |
licensingMulti-state clinician licensing | 50 states + DC + PR pre-seeded. findEligibleClinicians() routes by patient state. | v7.3 |
edi-837pEDI 837P claims encoder | Production-grade X12 5010. Round-trip validation via decode999Ack + decode277CA. | v7.6 |
| Feature | Description | Since |
|---|---|---|
wearablesWearables (HealthKit / Whoop / Oura / Garmin) | Per-vendor adapter, daily snapshot table, vendor-agnostic UI. | v7.4 |
insuranceInsurance (Change Healthcare 270/271) | Eligibility + claims shape. Stub mode by default. | v7.4 |
intakePer-category intake schemas | 11 declarative schemas with branching, validation, required consent refs. | v7.5 |
video-recordingVisit recording lifecycle | consent → record → available → soft-delete → hard-delete + retention cron. | v7.4 |
sentrySentry observability | Lazy-loaded @sentry/nextjs. setSentryCapture() forwards post-redaction. | v7.6 |
mobileMobile API + Expo Push | Typed mobile client. Push token registry + per-user opt-in matrix. | v7.4 |
Every tenant carries its own brand_tokens, its own state-licensure footprint, its own pharmacy partners, its own subscription tiers, its own webhook endpoints. A user can belong to N tenants — coaching practice + telehealth org + B2B reseller — without re-authenticating.
Read own-everything-principle.md for the architectural rule that drives every vendor decision: every vendor is a pipe behind a HollyConnect-branded API.
Spin up a white-labeled coaching tenant from a parametrized template. Includes brand-token theming, intake-schema set, peptide-stack catalog.
Skip Doxy and DoseSpot. AWS Chime SDK already wired (stub mode); live mode flips on Q3. Surescripts direct certification removes the DoseSpot intermediary.
Per-tenant region pinning for PHI: us-east, us-west, eu-west. Backed by per-region Postgres + per-region blob storage.
We sell tenants, not seats. Three rough shapes — actual fees scale against your patient volume + which surfaces you turn on.
Capped at 5 partners through 2026-Q3. Founder rate locked for the life of the tenant. Dedicated platform-engineering Slack channel for the first 90 days. Migration assistance from Practice Better / Healthie / Spruce / custom builds.
Talk to us →Standard onboarding pacing (re-opens ~60 days post-launch). Per-tenant base fee + per-active-patient overage. Surfaces are à la carte: you turn on what you use, you pay for what you turn on. All compliance machinery (audit log, RBAC, EPCS gates) is always-on.
Get a quote →Multi-region data residency, white-glove migration, custom vendor integration (your pharmacy partner of choice, your lab vendor, your payment processor). Annual contract with a committed engineering allotment. Talk to us early.
Schedule a call →We white-label HollyConnect for coaching practices and telehealth organizations already shipping production health products. If that's you, talk to us.
partnerships@hollyworld.com →