# HAD Digital — The Owner's Journey
### Protect the idea → Register in France → Approve & test → License & market

**Owner's playbook for:** Dr Kais Al Dabbagh (concept originator & clinical authority)
**Written in the owner's voice, as the decision-maker driving each stage.**
**Date:** 6 September 2026 · **Companion to:** MVP_PLAN.md / MVP_EXECUTION_PLAN.md (autoclaw build track runs in parallel)

---

## 0. The strategic reality — read this first

Before any registration or marketing, three facts determine everything about this journey:

1. **HAD Digital is not "just software."** Because it auto-grades patient symptoms (CTCAE v5.0, grades 1–5) and fires urgent/emergency alerts that drive therapeutic decisions, it meets the definition of a **medical device software (MDSW)** under EU Regulation 2017/745 (MDR), per **MDCG 2019-11 rev.1 (June 2025)**. Under **Rule 11 (Annex VIII)** that puts it at **Class IIa minimum** (Class IIb arguable if a missed emergency alert could cause serious deterioration). Marketing it as "wellness/coordination only" is **not a credible strategy** — symptom interpretation + clinician alerting is explicitly a medical purpose, and selling an unclassified device in France is an offence (Art. 5 MDR; CSP R.5211-9).

2. **The gate to market is the CE mark via a Notified Body** — a realistic **18–30 months** and **€100k–€250k** for a small team (Notified Body fees alone: €20k–60k initial + €10k–25k/yr surveillance). Since **28 May 2026**, EUDAMED registration is mandatory before placing a device on the EU market.

3. **Nobody can "steal the idea" itself — but they can steal everything the idea is made of.** Ideas, algorithms and CTCAE mapping logic are **not** protected by copyright (only the code's expression is). My protection stack must therefore be: **copyright (code) + trade secret (grading rules) + trademark (name) + optional patent (the technical pipeline) + contracts (NDAs/assignments)** — built *before* the first demo, pilot, or publication.

**The good news:** the reimbursement path now exists. Oncology digital devices have been inscribed since 2024–2025 (Continuum+ Connect via PECAN, Cureety, Satelia), with télésurveillance forfaits of **€28–70/patient/month** as pricing anchors. And **no competitor owns the HAD-specific workflow** — hospital-at-home oncology coordination with toxicity alerts is an open position.

**My one-line plan:** *Lock the IP this month → create my SASU → harden the product to IEC 62304/ISO 13485 grade → run the CE-marking gauntlet with a French Notified Body → validate clinically with 2–3 partner HADs (PMCF) → enter market through hospital pilots and PECAN/forfait innovation → license per-site + per-active-patient, anchored to the €28–70 forfaits → market evidence-first through FNEHAD/AFSOS/Santexpo.*

---

## Master map — the 8 stages

| # | Stage | When (from today) | Gate / exit criteria | Order-of-magnitude cost |
|---|-------|-------------------|----------------------|------------------------|
| 0 | Lock down the idea (IP protection) | Week 0–4 | e-Soleau deposited, trademark filed, NDAs in force, patent decision made | €15–1,500 |
| 1 | Create the company (France) | Month 1–2 | SASU registered, SIRET issued, insured, IP assigned to company | ~€300–1,000 |
| 2 | Build to medical-device grade | Month 2–8 | SaaS on HDS host, IEC 62304/ISO 14971/IEC 62366 files, classification justified, NB quote in hand | €30k–80k |
| 3 | Data protection (parallel) | Month 2–6 | DPIA done, DPO named, HDS contract signed, CNIL-compliant notices | €5k–15k |
| 4 | Conformity assessment → CE mark | Month 6–18 | ISO 13485 certificate + EC certificate (IIa), EUDAMED registered, UDI assigned | €60k–150k |
| 5 | Clinical evidence & pilot | Month 9–18 | PMCF data from 2–3 HAD pilots, ≥1 publication, PSUR-ready | €20k–60k |
| 6 | Market access & reimbursement | Month 12–24 | Paying pilots, PECAN or forfait-innovation dossier filed/inscribed | €20k–80k |
| 7 | Licensing & commercial scale-up | Month 18+ | License contracts signed, SLA machine running, pipeline of HAD/hospital clients | ongoing |
| 8 | Marketing engine | Month 6+ (continuous) | KOL bench, congress presence, clinical content engine, reference customers | €10k–40k/yr |

Total elapsed time to first paid licenses: **~24 months**. Total cash needed to CE + first revenue: **~€150k–300k** (grant-coverable — see Stage 6 funding).

---

## Stage 0 — Lock down the idea (Week 0–4)
**Goal: by day 30, anyone trying to copy me has nothing they can lawfully take, and I can prove anteriority of everything.**

### 0.1 The 7-day emergency actions (do these before showing anything to anyone)

| # | Action | How | Cost |
|---|--------|-----|------|
| 1 | **Stop informal disclosure.** Demos, slide decks, the HTML presentation, specs (HAD_Digital_Specifications.docx) — all under NDA from now on. No public repo, no conference, no open-source, no investor pitch without a signed NDA. | INPI publishes a free NDA template | €0 |
| 2 | **Mark everything confidential.** Every spec, deck and export gets a "Confidentiel — secret des affaires (art. L151-1 Code de commerce)" footer. This marking is *evidence* for trade-secret status. | — | €0 |
| 3 | **Deposit an e-Soleau envelope** with INPI: the specification, the CTCAE grading/threshold logic, architecture notes, key code snapshots. It gives me a sealed, timestamped proof of possession at a date — my anteriority weapon. It grants no exclusive right, but wins "who had it first" disputes. | inpi.fr → e-Soleau, online | €15 (≤50 MB) + €10 per extra 50 MB, 5 years renewable |
| 4 | **Secure the code.** Private repo, MFA, named-account access only, access log kept. Any human contributor signs an IP assignment + NDA **before** writing a line. | — | €0 |
| 5 | **Check my employment position.** If I am (or become) a salaried/hospital practitioner, French law can attribute inventions made *in the course of duties* to the employer/establishment (art. L.611-7 CPI + hospital practitioner rules). I document that HAD Digital was conceived and developed on my own time, with my own resources, outside my clinical missions — dated notes, personal hardware, this playbook. | Personal file + e-Soleau | €0 |
| 6 | **Document human authorship of the code.** AI coding agents ("autoclaw") produce code that is not automatically protected — French/EU law requires a human author, and purely AI-generated stretches may fall into the public domain. I keep records of my creative direction: the specifications I wrote, the prompts/decisions, my reviews and manual restructuring. Where protection is doubtful, trade secret carries the weight. | Development log (already in 00_Governance framework — keep it) | €0 |
| 7 | **Book the free INPI prédiagnostic PI** — two half-days with an INPI-trained IP expert to pressure-test my protection plan, plus a free IP legal clinic session. | inpi.fr/nos-solutions | €0 |

### 0.2 Trademark — the name is an asset (file before anyone sees the brand)

- Run availability searches on **data.inpi.fr** and **EUIPO eSearch** for "HAD Digital" and variants. Note: "HAD" alone is semi-descriptive in French healthcare — I file the composite mark as a whole and pick a distinctive logo.
- **File now (option A):** French mark at INPI — **€190 for 1 class + €40/extra class**, 10 years, renewable forever. Classes: **9** (software), **42** (SaaS/development), **44** (medical/telehealth services).
- **File now (option B, recommended if EU rollout is plausible):** EU mark at EUIPO — **€850** (1 class, +€50 2nd, +€150 3rd+) covering all 27 states. Roughly the cost of 4 national filings.
- My call: **EU mark, 3 classes (~€1,050)** — one filing, whole future market.

### 0.3 Patent — decide this month, because disclosure kills it

- **What could be patentable:** not the code, but the *technical process* — e.g., the symptom→CTCAE-grade→escalation pipeline if framed with a genuine technical effect. Diagnostic methods practised *on the body* are excluded; a server-side decision engine is not per se excluded.
- **Why decide fast:** Europe has **no grace period**. Any demo, publication or pilot disclosure before the filing date destroys novelty. The 2025 EPO guidelines also make AI/ML-assisted inventions more filable (technical effect provable by experiment).
- **Cost if I file French first:** ~€636 official fees (€26 filing + €520 search + €90 grant), **halved to ~€318** for natural persons/SMEs — trivially cheap option value. Filing starts a **12-month priority window** to decide PCT/EP extension (EP official fees ~€6,800 to grant — a Year-2 decision).
- **My strategy — hybrid:** patent the *pipeline architecture* if the prédiagnostic supports it; keep the **CTCAE threshold tuning, rule weights and datasets as trade secrets** (MDR technical files held with the Notified Body are not published the way FDA submissions are, so secrecy survives CE marking).
- **Decision gate (day 30):** prédiagnostic verdict → file French patent **or** formally log "trade-secret-only" and double down on access controls.

### 0.4 Contracts arsenal (from day 1)

- **NDA** for every viewer of specs/demos (INPI template + clause pénale — liquidated damages per art. 1231-5 Code civil — kept at a defensible amount).
- **IP assignment (cession de droits)** for every human freelancer: under L131-3 CPI, each right transferred must be *distinctly identified* (scope, destination, duration, territory, and each mode of exploitation enumerated) — a vague "all rights" clause is void. Include warranty of authorship *including disclosure of any AI-generated portions*.
- **Employment/contractor clauses** aligning with secret-des-affaires obligations.

**Stage 0 exit:** e-Soleau receipt in hand · trademark filed · NDA discipline active · patent decision logged · employment-position file written. **Total spend: €15–1,500.**

---

## Stage 1 — Create the vehicle (Month 1–2)

### 1.1 Legal form

I create a **SASU** (single-shareholder simplified joint-stock company) — me as president and sole shareholder:

- Right vehicle for a funded medtech trajectory (convertible to **SAS** the day I add Zaid as partner, an incubator, or investors — keep this in the statutes' DNA).
- Separates **my physician liability** from the software business; the company will be the manufacturer of record on EUDAMED, holder of the CE certificate, signatory of hospital contracts.
- My clinical practice stays completely outside the company (corporate practice of medicine is separately regulated — the company sells software, I doctor).

### 1.2 Registration mechanics (all online, ~1–2 weeks)

| Step | Detail | Cost |
|------|--------|------|
| File on the **guichet unique INPI** (formalites.entreprises.gouv.fr) — one-stop shop since 2023 | Statutes, registered office (domiciliation possible at my address initially), president appointment | RCS €33.83 + beneficial-owners register €19.33 |
| Legal announcement (JAL) | Mandatory publication | ~€142 flat |
| SIREN/SIRET issued by INSEE; VAT regime; TVA declaration | Automatic follow-on | €0 |
| **Total** | | **≈ €200–250** (+ optional legal-platform fees for drafted statutes, ~€100–600, or free with an incubator) |

### 1.3 Housekeeping that matters later

- **Bank account** in the company name (needed before first invoice).
- **RC professionnelle insurance** now (~€500–1,500/yr); after CE marking, upgrade to **product-liability cover scaled to a medical device** (non-negligible — price it at Stage 4).
- **Registered capital:** token amount now (€1,000); real money enters as Bpifrance/grant tranches arrive.
- **Transfer Stage-0 IP into the company:** I assign (aperfectly documented cession) the e-Soleau-protected materials, code and know-how to the SASU — with the assignment's scope written to L131-3 standards. The trademark application can be filed in the company name from the start.
- **DPO:** formally appointed when health-data processing begins (Stage 3) — can be a hired external DPO (~€200–500/month).

**Stage 1 exit:** SIRET issued, bank open, insured, IP assigned to SASU. **Spend: ~€300–1,000.**

---

## Stage 2 — Build to medical-device grade (Month 2–8, parallel with autoclaw MVP work)

The .exe/SQLite MVP is a **demo artifact only** — health data on local patient machines is not a deployable architecture. The regulated product is a proper SaaS:

### 2.1 Architecture pivot (keep autoclaw productive on this)

- **SaaS web app** (the web variant already in REQ-SYS-13) hosted on a **HDS-certified provider** — OVHcloud Santé, Coreye, Claranet, Guardis (packs from ~€100–390/month; +20–50% surcharge vs standard hosting). I do **not** need my own HDS certificate if my team has **no administrator access** to health-data systems (all exploitation delegated to the certified host) — that saves €15k–80k and ~1 year.
- Keep the standalone .exe as the **sales-demo and training sandbox** with synthetic data, clearly labelled "démonstrateur — non destiné à un usage clinique".
- Security by design to **ISO 27001 alignment** (formal certification optional until clients demand it) + **MDCG 2019-16** cybersecurity guidance + **IEC 81001-5-1** (health-software safety/security — increasingly requested by Notified Bodies).

### 2.2 The engineering standards I must now live by (they *are* the product)

| Standard | What it demands of me |
|----------|----------------------|
| **IEC 62304** | Software lifecycle discipline; my alert engine is likely **safety Class B** (defect → non-serious injury; Class C if the NB argues serious injury). Requirements traceability, verification records, regression control. |
| **ISO 14971** | Risk management file: hazard analysis on *missed/false alerts*, delayed escalation, wrong grading — the core clinical risks of my product. |
| **IEC 62366-1** | Usability engineering file — including **alert-fatigue scenarios** (the classic SaMD usability failure). |
| **ISO 13485** | The QMS that the Notified Body audits — start light and grow it; a 2-person startup can run a lean 13485. |

### 2.3 Regulatory positioning

- Write the **intended purpose / claims** document with a regulatory consultant (~€3–8k well spent): it fixes classification. I plan for **Class IIa via Rule 11**, with a written justification anticipating an NB challenge toward IIb.
- Keep the engine **deterministic (rules-based)**: it keeps me outside the **EU AI Act** (Recital 12 excludes simple deterministic rule systems). The moment I add ML risk-scoring (the deferred V2 feature), AI-Act obligations must be re-examined — a 2028+ problem given the Digital Omnibus delays, but I log the trigger.

### 2.4 Notified Body — engage NOW (the queue is the critical path)

- NB certification alone takes **13–18 months** (the #1 schedule risk of the whole journey). French option: **GMED/LNE (NB 0459)**; strong EU alternatives for software: **BSI (2797), TÜV SÜD (0123), TÜV Rheinland, DEKRA, SGS**.
- Month 3–4: send quote requests + application to two NBs; sign with one by Month 6. NB fees: **€20k–60k initial**, €10k–25k/yr surveillance.

**Stage 2 exit:** SaaS live on HDS host · 62304/14971/62366 files opened · classification memo · NB contract signed. **Spend: €30k–80k** (much of it fundable — Stage 6).

---

## Stage 3 — Data protection, in parallel (Month 2–6)

- **Legal basis:** care delivery = GDPR art. 6(1)(c)/(e) + **art. 9(2)(h)** (provision of health care) — *not* consent. Patient **consent is still required for the telecare acts themselves** and for app terms; information notice per art. 13/14; traceability of each tele-act in the record (R.6316-4 CSP).
- **DPIA (AIPD):** mandatory for this category — health data, vulnerable persons. CNIL publishes the method + a health-app checklist + a mobile-app security referential to build against.
- **DPO** appointed; **art. 28 processor contracts** with host and every sub-processor; 72-hour breach procedure; patient-rights workflow (incl. post-mortem instructions, art. 85 LIL).
- **My telemedicine compliance:** as prescribing/monitoring physician — Ordre registration, CNOM telemedicine rules (no exclusive-telemedicine practice, consent, quality requirements). Nurses/pharmacists on the platform operate as **télésoins** (permitted for their professions).
- **Interoperability credentials (buy me hospital credibility, needed for V-next):** **Pro Santé Connect** conformity (mandatory for sensitive e-health services), **Ségur référencement** (ANS verification by category — checked by hospital DSI), **DMP-Compatibilité** homologation (mandatory only once I touch the DMP — post-V1).

**Stage 3 exit:** DPIA validated, DPO named, HDS contract signed, notices live. **Spend: €5k–15k.**

---

## Stage 4 — Conformity assessment → CE marking (Month 6–18)

1. **QMS audit (ISO 13485)** by the NB —Stage 2's files become the audited reality.
2. **Technical documentation** (Annex II/III): design, risk file, verification & validation, cybersecurity, usability file, labelling/IFU.
3. **Clinical evaluation** per **MDCG 2020-1** (SaMD): valid clinical association (CTCAE's established validity helps) + technical validation + clinical validation — written to survive the **MDCG 2020-13 CEAR template** the NB will use.
4. **UDI** assignment (IIa deadline long past — needed at launch; UDI displayed in the software's About screen; new UDI-DI on any substantive clinical change).
5. **EUDAMED:** obtain my **SRN** from ANSM, register as manufacturer + register the device. Since **28 May 2026** the first modules are mandatory and registration must precede market placement.
6. **French specifics:** designate the **correspondant de matériovigilance**; note the recodified French device rules (décret n°2026-299).
7. **Post-market machinery (live from day 1 of launch):** vigilance reporting to ANSM at **2/10/15 days** by severity; **PSUR every 2 years** (IIa); post-market surveillance plan (Art. 84).

**Stage 4 exit:** ISO 13485 + EC certificates → **CE mark affixed** → EUDAMED registration → I may lawfully place HAD Digital on the EU market. **Spend: €60k–150k.**

---

## Stage 5 — Clinical evidence & the pilot (Month 9–18)

**The rule that shapes everything:** a pilot on real patients **before** the CE mark is a *clinical investigation* (ANSM authorization + CPP ethics committee — months of process). **After** CE, the same real-world usage is a **PMCF study** — the standard, far lighter vehicle. And the Moovcare delisting (March 2025, after failing HAS re-evaluation) proves the evidence bar is now existential.

**My evidence plan (three layers):**

| Layer | When | What | Regime |
|-------|------|------|--------|
| 1. Bench + usability | Pre-CE (Month 9–12) | Grading-engine verification vs CTCAE reference cases (retrospective/simulated cases); usability tests with clinicians + patient-surrogates incl. alert-fatigue scenarios | None beyond QMS records — feeds the technical file |
| 2. **PMCF pilot** | Post-CE (Month 15–21) | 2–3 partner HAD structures, ~60–120 patients over 6–9 months, real-world use in routine care, data reused for evaluation | **RNIPH** (outside Loi Jardé): **MR-004** conformity declaration to CNIL (online, days) + patient information with non-opposition; register on the HDH répertoire. If I add research-only acts (extra questionnaires/procedures) → becomes **RIPH3**: CPP favourable opinion (~45 days + RFIs), opinion transmitted to ANSM. CERES ethics review optional but classy. |
| 3. Publication | Month 21–24 | Pilot results (MOE-1..4 from MVP_PLAN: structured-capture %, alert-to-acknowledgment times, re-admissions delta) in **Bulletin du Cancer** (which published the 2025 oncology-télésurveillance referential) or JMIR/BMC | — |

**Pilot partner selection (start courting at Month 6, letters of intent by Month 12):** one hospital-internal HAD with oncology day-hospital, one large associative HAD (Santé Service / Santélys / Groupe Adène profile), one regional oncology network (Onco-Occitanie-type). ARS can co-fund regional demonstrators.

**Stage 5 exit:** PMCF report (MDCG 2020-8 template) + ≥1 peer-reviewed publication + referenceable pilot sites. **Spend: €20k–60k** (hospital contract-value mostly funds itself).

---

## Stage 6 — Market access, reimbursement & funding (Month 12–24)

### 6.1 Public financing of the journey itself

| Scheme | Fit | Amount |
|--------|-----|--------|
| **Bpifrance i-Lab** (concours innovation) | Deep-tech grant, pre-CE — apply with the HAD-oncology positioning + IP story | **up to €600k** (60% of costs) |
| **Bpifrance Accélérateur HealthTech** | Post-amorçage medtech accelerator | coaching + network |
| **France 2030 santé numérique / ARS demonstrators** | Regional pilot co-funding | varies |
| **EIC Accelerator / Horizon Europe** | EU-scale, later | grant + equity |

### 6.2 Reimbursement routes (how stakeholders' budgets pay for me)

- **Forfait innovation (art. L.165-1-1 CSS):** derogatory temporary coverage conditioned on a data-generating study — the natural first step post-CE with my pilot hospital.
- **PECAN (prise en charge anticipée numérique, décret 2023-232):** 1-year national early coverage, then mandatory LPPR filing. **Continuum+ Connect walked this exact oncology path** (HAS favourable Sept 2024).
- **Droit-commun télésurveillance list (art. L.162-52 CSS):** inscribed activities paid by monthly forfaits — **€28 (level 1) / €56 / €70** — the anchor of my pricing. Requires: physician prescription, patient consent, **ISO 13485-certified operator** (Stage 4 output), **HDS-certified exploitant** (Stage 3 output), real-world data + biennial re-evaluation. Recent oncology inscriptions: Cureety (opérateur €28/mo + distributeur €50/patient/mo), Satelia. The 2025 oncology télésurveillance referential (Bulletin du Cancer) is my clinical map.
- **Hospitals' own budgets:** purchases below **€40k HT** run as simplified procedures (perfect pilot size); above via tender; **UGAP/RESAH catalog listing** = procurement shortcut hospitals love.

**Stage 6 exit:** ≥2 paying pilot contracts + PECAN or FI dossier filed with HAS. **Spend: €20k–80k.**

---

## Stage 7 — Licensing model: how stakeholders buy (Month 18+)

### 7.1 Product packaging

| Tier | Contents | Buyer |
|------|----------|-------|
| **HAD Core** | Toxicity capture + grading + alerts + timeline | HAD structure / oncology ward |
| **HAD Coordinate** | + care-team messaging, summaries/exports, treatment-plan views, GP/pharmacist access | HAD + its hospital partner (GHT pricing) |
| **HAD Réseau** | Multi-site, network/oncology-network level, analytics + PSUR-ready reporting | Regional networks, Unicancer-type |

### 7.2 Pricing logic

- **Per-site annual platform license** (€8k–20k depending on tier — sized so a pilot fits under the €40k MAPA threshold in year 1) **+ per-active-oncology-patient/month** for the monitored cohort, anchored to the télésurveillance forfaits: if Assurance Maladie pays an operator forfait of €28–70/patient/month, my patient fee sits at **€15–35/active patient/month**, leaving margin inside the forfait or inside avoided re-admissions.
- The value story I sell with: **MOE-4 from my own plan — ≥20% reduction of unplanned re-admissions** — measured in the PMCF pilot and printed in the publication.

### 7.3 The license contract itself (French hospital market)

- **Contrat de licence + CGV**, referencing **CCAG-TIC 2021** (the public-sector TIC general terms) rather than reinventing clauses; explicit **réversibilité** (data export in open format at exit — also an HDS 2.0 obligation), **maintenance/SLA** (hotline, GTI/GTR, availability %, aligned to my MOP-1 ≥99.5% target), **DPtraité (art. 28 GDPR)** annex, **materiovigilance contact**, UDI/CE references, IP reservations.
- Buying committee I sell to: **DSI** (HDS, Ségur, security), **direction médicale HAD + coordinating nurses** (clinical value), **DG** (budget), optional **ARS** co-funding.

**Stage 7 exit:** signed licenses, churn <10%, support machine, pipeline ≥5 structures.

---

## Stage 8 — Marketing: evidence-first, community-anchored

**Positioning line:** *"The CTCAE-native toxicity watchtower for hospitalisation à domicile — built by an oncologist, graded for the ward, reimbursable."* No competitor owns the HAD workflow; my clinical founder-authenticity is the moat competitors (Cureety, Satelia, Continuum+, Resilience) cannot copy.

| Motion | Concrete plays | Calendar |
|--------|----------------|----------|
| **1. Evidence engine** | PMCF publication; case study per pilot HAD (1-pager: before/after workflows, alert times); whitepaper "Réduire les ré-hospitalisations évitables en HAD oncologique" | Month 21+ |
| **2. Medical societies** | Join/present: **AFSOS** (soins oncologiques de support — my core community), **SFAP** (palliative HAD volume), **SFRO**; FNEHAD network | SFRO congress 4–6 Nov 2026 (attend, listen); present from 2027 |
| **3. Trade events** | **Santexpo** (hospital-buyer event) — booth/sessions from 2027; **FNEHAD Universités d'Été/Hiver** — the concentrated HAD market | FNEHAD UTE June (attend 2027), Santexpo 2027 |
| **4. Digital** | LinkedIn clinical-content engine (weekly: one toxicity case, one alert saved, one workflow win — from my own practice voice); website with evidence library + demo .exe request funnel (NDA-gated) | Month 12+ |
| **5. KOL/ambassadors** | Pilot-site physicians as congress speakers; nursing coordinators as user-testimonial voices; scientific advisory board (2 oncologists, 1 HAD physician, 1 coordinating nurse) | Month 15+ |
| **6. Ecosystem** | Incubator (Agoranov / Wilco / Medicen / Eurasanté — Eurasanté is physically close to the HAD heartland), Bpifrance HealthTech network, Healthcare Data Hub for the data side | Apply Month 3–6 |
| **7. Sales cadence** | 2 design-partner HADs (Month 12) → lighthouse reference (Month 20) → 10-structure pipeline (Month 24) with a clinical-sales hire (profile: ex-HAD coordinating nurse) | staged |

---

## Risk register (what can kill this, and my counter)

| Risk | Severity | Counter-measure |
|------|----------|-----------------|
| NB queue slips CE past month 18 | High | Apply to NBs at Month 3–4, two parallel quotes; build tech-doc DURING the queue (most startups idle in queue — I won't) |
| Idea leakage (partner/pilot copies it) | High | Stage-0 stack (NDA + secret-des-affaires measures + e-Soleau + patent) *before* any pilot; NDAs renewed at every stage gate |
| Employer/hospital claims the invention | High | Employment-position dossier (Stage 0.1 #5) + personal-resources evidence, kept contemporaneously |
| AI-authored code = weak copyright | Medium | Documented human authorship + trade-secret protection of the engine + patent on the pipeline |
| NB classifies IIb not IIa | Medium | Written classification memo (consultant-reviewed); budget contingency for IIb (stricter assessment, annual PSUR) |
| HAS refuses inscription (Moovcare scenario) | High | PMCF pilot designed to HAS evidence standards from day 1 (real-world outcomes, re-admission data); FI/PECAN as intermediate coverage |
| Founder bandwidth (I'm a clinician) | High | Autoclaw continues the build; regulatory consultant from Month 3; incubator from Month 6; first hire = regulatory/quality engineer |
| Pilot can't start pre-CE | Planned | Architecture of the evidence plan already accounts for it (bench first, PMCF after CE) |

---

## The 30-day checklist (start today)

- [ ] Day 1–3: confidential marking everywhere; repo locked; NDA template adopted; no more unprotected demos
- [ ] Day 3–7: e-Soleau deposit (specs + grading logic + code snapshot) — €15
- [ ] Day 5–10: trademark availability search; file EU mark classes 9/42/44 — ~€1,050
- [ ] Day 7–15: employment-invention dossier written and dated
- [ ] Day 10–20: INPI prédiagnostic PI booked; patent go/no-go logged
- [ ] Day 15–30: SASU statutes prepared; file on guichet unique (~€250)
- [ ] Day 20–30: regulatory consultant shortlist (3 quotes — SaMD-experienced); NB quote requests drafted
- [ ] Day 30: this playbook reviewed with Zaid (governance authority) and counter-signed — GO decision for Stage 1–2 spend

---

## Appendix — primary sources

**IP & company**
- INPI software & copyright: inpi.fr/realiser-demarches/propriete-intellectuelle/cas-particulier-logiciels
- e-Soleau: inpi.fr/realiser-demarches/propriete-intellectuelle/deposer-une-e-soleau-ou-un-entiercement
- Trademark fees: inpi.fr/realiser-demarches/propriete-intellectuelle/deposant-et-cout-dune-marque · euipo.europa.eu
- Patent costs: inpi.fr/realiser-demarches/propriete-intellectuelle/deposant-et-cout-dun-brevet
- Prédiagnostic PI: inpi.fr/nos-solutions/etablir-son-plan-dactions/prediagnostic-pi
- Secret des affaires: legifrance (L151-1 s. Code de commerce) · inpi.fr/ressources/propriete-intellectuelle/secret
- AI & authorship: CSPLA report (culture.gouv.fr)
- Company creation fees: formalites.entreprises.gouv.fr/tarifs.php · entreprendre.service-public.fr/vosdroits/F37688

**Regulatory (MDR)**
- MDCG 2019-11 rev.1 (June 2025): health.ec.europa.eu
- Rule 11 & SaMD CE costs: blog.johner-institute.com · openregulatory.com · team-nb.org (14th NB survey)
- EUDAMED mandatory timetable (Reg. 2024/1860): health.ec.europa.eu (27 Nov 2025 announcement)
- ANSM DM/EUDAMED FAQ + Guichet Innovation: ansm.sante.fr
- Standards: IEC 62304, ISO 14971, IEC 62366-1, MDCG 2019-16, IEC 81001-5-1, MDCG 2020-1/-7/-8/-13

**Data & care**
- HDS: esante.gouv.fr/labels-certifications/hds (+ HDS 2.0 arrêté 26/04/2024) · certified-host list: esante.gouv.fr/offres-services/hds/liste-des-hebergeurs-certifies
- CNIL: santé guidance, AIPD, mobile-app recommendation (2024), MR-004
- Loi Jardé / RIPH categories: legifrance (L.1121-1, L.1123-1 CSP)
- Télésurveillance droit commun: legifrance (L.162-52 CSS; arrêtés 22/06/2023, 17/01/2025, 17/11/2025) · ameli.fr/medecin (forfaits)
- CNOM télémédecine: conseil-national.medecin.fr

**Market**
- HAD figures: sante.gouv.fr (HAD page) · fnehad.fr · drees.solidarites-sante.gouv.fr · scansante
- Reimbursement precedents: legifrance arrêtés 10/09/2024 (Continuum+), 31/03/2025 (Cureety), 28/03/2025 (Satelia), 14/02/2025 (Moovcare radiation) · has-sante.fr (avis CNEDiMTS)
- PECAN: esante.gouv.fr/ens/offre/dispositifs-medicaux-numeriques/pecan · has-sante.fr (PECAN deposit guide)
- Forfait innovation: sante.gouv.fr/systeme-de-sante/innovation-et-recherche/forfait-innovation
- i-Lab: bpifrance.fr · Public procurement: entreprendre.service-public.fr/vosdroits/F23371 · CCAG-TIC 2021
- Events: santexpo.fr · sfro-congres.fr · fnehad.fr (Universités)