HAD Digital — The Owner's Journey

Protect the idea → Register in France → Approve & test → License & market

Owner's playbook for: Dr Kais Al Dabbagh (concept originator & clinical authority) Written in the owner's voice, as the decision-maker driving each stage. Date: 6 September 2026 · Companion to: MVP_PLAN.md / MVP_EXECUTION_PLAN.md (autoclaw build track runs in parallel)

0. The strategic reality — read this first

Before any registration or marketing, three facts determine everything about this journey:

1. HAD Digital is not "just software." Because it auto-grades patient symptoms (CTCAE v5.0, grades 1–5) and fires urgent/emergency alerts that drive therapeutic decisions, it meets the definition of a medical device software (MDSW) under EU Regulation 2017/745 (MDR), per MDCG 2019-11 rev.1 (June 2025). Under Rule 11 (Annex VIII) that puts it at Class IIa minimum (Class IIb arguable if a missed emergency alert could cause serious deterioration). Marketing it as "wellness/coordination only" is not a credible strategy — symptom interpretation + clinician alerting is explicitly a medical purpose, and selling an unclassified device in France is an offence (Art. 5 MDR; CSP R.5211-9).

1. The gate to market is the CE mark via a Notified Body — a realistic 18–30 months and €100k–€250k for a small team (Notified Body fees alone: €20k–60k initial + €10k–25k/yr surveillance). Since 28 May 2026, EUDAMED registration is mandatory before placing a device on the EU market.

1. Nobody can "steal the idea" itself — but they can steal everything the idea is made of. Ideas, algorithms and CTCAE mapping logic are not protected by copyright (only the code's expression is). My protection stack must therefore be: copyright (code) + trade secret (grading rules) + trademark (name) + optional patent (the technical pipeline) + contracts (NDAs/assignments) — built before the first demo, pilot, or publication.

The good news: the reimbursement path now exists. Oncology digital devices have been inscribed since 2024–2025 (Continuum+ Connect via PECAN, Cureety, Satelia), with télésurveillance forfaits of €28–70/patient/month as pricing anchors. And no competitor owns the HAD-specific workflow — hospital-at-home oncology coordination with toxicity alerts is an open position.

My one-line plan: Lock the IP this month → create my SASU → harden the product to IEC 62304/ISO 13485 grade → run the CE-marking gauntlet with a French Notified Body → validate clinically with 2–3 partner HADs (PMCF) → enter market through hospital pilots and PECAN/forfait innovation → license per-site + per-active-patient, anchored to the €28–70 forfaits → market evidence-first through FNEHAD/AFSOS/Santexpo.

Master map — the 8 stages

Total elapsed time to first paid licenses: ~24 months. Total cash needed to CE + first revenue: ~€150k–300k (grant-coverable — see Stage 6 funding).

Stage 0 — Lock down the idea (Week 0–4)

Goal: by day 30, anyone trying to copy me has nothing they can lawfully take, and I can prove anteriority of everything.

0.1 The 7-day emergency actions (do these before showing anything to anyone)

0.2 Trademark — the name is an asset (file before anyone sees the brand)

• Run availability searches on data.inpi.fr and EUIPO eSearch for "HAD Digital" and variants. Note: "HAD" alone is semi-descriptive in French healthcare — I file the composite mark as a whole and pick a distinctive logo.

• File now (option A): French mark at INPI — €190 for 1 class + €40/extra class, 10 years, renewable forever. Classes: 9 (software), 42 (SaaS/development), 44 (medical/telehealth services).

• File now (option B, recommended if EU rollout is plausible): EU mark at EUIPO — €850 (1 class, +€50 2nd, +€150 3rd+) covering all 27 states. Roughly the cost of 4 national filings.

• My call: EU mark, 3 classes (~€1,050) — one filing, whole future market.

0.3 Patent — decide this month, because disclosure kills it

• What could be patentable: not the code, but the technical process — e.g., the symptom→CTCAE-grade→escalation pipeline if framed with a genuine technical effect. Diagnostic methods practised on the body are excluded; a server-side decision engine is not per se excluded.

• Why decide fast: Europe has no grace period. Any demo, publication or pilot disclosure before the filing date destroys novelty. The 2025 EPO guidelines also make AI/ML-assisted inventions more filable (technical effect provable by experiment).

• Cost if I file French first: ~€636 official fees (€26 filing + €520 search + €90 grant), halved to ~€318 for natural persons/SMEs — trivially cheap option value. Filing starts a 12-month priority window to decide PCT/EP extension (EP official fees ~€6,800 to grant — a Year-2 decision).

• My strategy — hybrid: patent the pipeline architecture if the prédiagnostic supports it; keep the CTCAE threshold tuning, rule weights and datasets as trade secrets (MDR technical files held with the Notified Body are not published the way FDA submissions are, so secrecy survives CE marking).

• Decision gate (day 30): prédiagnostic verdict → file French patent or formally log "trade-secret-only" and double down on access controls.

0.4 Contracts arsenal (from day 1)

• NDA for every viewer of specs/demos (INPI template + clause pénale — liquidated damages per art. 1231-5 Code civil — kept at a defensible amount).

• IP assignment (cession de droits) for every human freelancer: under L131-3 CPI, each right transferred must be distinctly identified (scope, destination, duration, territory, and each mode of exploitation enumerated) — a vague "all rights" clause is void. Include warranty of authorship including disclosure of any AI-generated portions.

• Employment/contractor clauses aligning with secret-des-affaires obligations.

Stage 0 exit: e-Soleau receipt in hand · trademark filed · NDA discipline active · patent decision logged · employment-position file written. Total spend: €15–1,500.

Stage 1 — Create the vehicle (Month 1–2)

1.1 Legal form

I create a SASU (single-shareholder simplified joint-stock company) — me as president and sole shareholder:

• Right vehicle for a funded medtech trajectory (convertible to SAS the day I add Zaid as partner, an incubator, or investors — keep this in the statutes' DNA).

• Separates my physician liability from the software business; the company will be the manufacturer of record on EUDAMED, holder of the CE certificate, signatory of hospital contracts.

• My clinical practice stays completely outside the company (corporate practice of medicine is separately regulated — the company sells software, I doctor).

1.2 Registration mechanics (all online, ~1–2 weeks)

1.3 Housekeeping that matters later

• Bank account in the company name (needed before first invoice).

• RC professionnelle insurance now (~€500–1,500/yr); after CE marking, upgrade to product-liability cover scaled to a medical device (non-negligible — price it at Stage 4).

• Registered capital: token amount now (€1,000); real money enters as Bpifrance/grant tranches arrive.

• Transfer Stage-0 IP into the company: I assign (aperfectly documented cession) the e-Soleau-protected materials, code and know-how to the SASU — with the assignment's scope written to L131-3 standards. The trademark application can be filed in the company name from the start.

• DPO: formally appointed when health-data processing begins (Stage 3) — can be a hired external DPO (~€200–500/month).

Stage 1 exit: SIRET issued, bank open, insured, IP assigned to SASU. Spend: ~€300–1,000.

Stage 2 — Build to medical-device grade (Month 2–8, parallel with autoclaw MVP work)

The .exe/SQLite MVP is a demo artifact only — health data on local patient machines is not a deployable architecture. The regulated product is a proper SaaS:

2.1 Architecture pivot (keep autoclaw productive on this)

• SaaS web app (the web variant already in REQ-SYS-13) hosted on a HDS-certified provider — OVHcloud Santé, Coreye, Claranet, Guardis (packs from ~€100–390/month; +20–50% surcharge vs standard hosting). I do not need my own HDS certificate if my team has no administrator access to health-data systems (all exploitation delegated to the certified host) — that saves €15k–80k and ~1 year.

• Keep the standalone .exe as the sales-demo and training sandbox with synthetic data, clearly labelled "démonstrateur — non destiné à un usage clinique".

• Security by design to ISO 27001 alignment (formal certification optional until clients demand it) + MDCG 2019-16 cybersecurity guidance + IEC 81001-5-1 (health-software safety/security — increasingly requested by Notified Bodies).

2.2 The engineering standards I must now live by (they are the product)

2.3 Regulatory positioning

• Write the intended purpose / claims document with a regulatory consultant (~€3–8k well spent): it fixes classification. I plan for Class IIa via Rule 11, with a written justification anticipating an NB challenge toward IIb.

• Keep the engine deterministic (rules-based): it keeps me outside the EU AI Act (Recital 12 excludes simple deterministic rule systems). The moment I add ML risk-scoring (the deferred V2 feature), AI-Act obligations must be re-examined — a 2028+ problem given the Digital Omnibus delays, but I log the trigger.

2.4 Notified Body — engage NOW (the queue is the critical path)

• NB certification alone takes 13–18 months (the #1 schedule risk of the whole journey). French option: GMED/LNE (NB 0459); strong EU alternatives for software: BSI (2797), TÜV SÜD (0123), TÜV Rheinland, DEKRA, SGS.

• Month 3–4: send quote requests + application to two NBs; sign with one by Month 6. NB fees: €20k–60k initial, €10k–25k/yr surveillance.

Stage 2 exit: SaaS live on HDS host · 62304/14971/62366 files opened · classification memo · NB contract signed. Spend: €30k–80k (much of it fundable — Stage 6).

Stage 3 — Data protection, in parallel (Month 2–6)

• Legal basis: care delivery = GDPR art. 6(1)(c)/(e) + art. 9(2)(h) (provision of health care) — not consent. Patient consent is still required for the telecare acts themselves and for app terms; information notice per art. 13/14; traceability of each tele-act in the record (R.6316-4 CSP).

• DPIA (AIPD): mandatory for this category — health data, vulnerable persons. CNIL publishes the method + a health-app checklist + a mobile-app security referential to build against.

• DPO appointed; art. 28 processor contracts with host and every sub-processor; 72-hour breach procedure; patient-rights workflow (incl. post-mortem instructions, art. 85 LIL).

• My telemedicine compliance: as prescribing/monitoring physician — Ordre registration, CNOM telemedicine rules (no exclusive-telemedicine practice, consent, quality requirements). Nurses/pharmacists on the platform operate as télésoins (permitted for their professions).

• Interoperability credentials (buy me hospital credibility, needed for V-next): Pro Santé Connect conformity (mandatory for sensitive e-health services), Ségur référencement (ANS verification by category — checked by hospital DSI), DMP-Compatibilité homologation (mandatory only once I touch the DMP — post-V1).

Stage 3 exit: DPIA validated, DPO named, HDS contract signed, notices live. Spend: €5k–15k.

Stage 4 — Conformity assessment → CE marking (Month 6–18)

1. QMS audit (ISO 13485) by the NB —Stage 2's files become the audited reality.

1. Technical documentation (Annex II/III): design, risk file, verification & validation, cybersecurity, usability file, labelling/IFU.

1. Clinical evaluation per MDCG 2020-1 (SaMD): valid clinical association (CTCAE's established validity helps) + technical validation + clinical validation — written to survive the MDCG 2020-13 CEAR template the NB will use.

1. UDI assignment (IIa deadline long past — needed at launch; UDI displayed in the software's About screen; new UDI-DI on any substantive clinical change).

1. EUDAMED: obtain my SRN from ANSM, register as manufacturer + register the device. Since 28 May 2026 the first modules are mandatory and registration must precede market placement.

1. French specifics: designate the correspondant de matériovigilance; note the recodified French device rules (décret n°2026-299).

1. Post-market machinery (live from day 1 of launch): vigilance reporting to ANSM at 2/10/15 days by severity; PSUR every 2 years (IIa); post-market surveillance plan (Art. 84).

Stage 4 exit: ISO 13485 + EC certificates → CE mark affixed → EUDAMED registration → I may lawfully place HAD Digital on the EU market. Spend: €60k–150k.

Stage 5 — Clinical evidence & the pilot (Month 9–18)

The rule that shapes everything: a pilot on real patients before the CE mark is a clinical investigation (ANSM authorization + CPP ethics committee — months of process). After CE, the same real-world usage is a PMCF study — the standard, far lighter vehicle. And the Moovcare delisting (March 2025, after failing HAS re-evaluation) proves the evidence bar is now existential.

My evidence plan (three layers):

Pilot partner selection (start courting at Month 6, letters of intent by Month 12): one hospital-internal HAD with oncology day-hospital, one large associative HAD (Santé Service / Santélys / Groupe Adène profile), one regional oncology network (Onco-Occitanie-type). ARS can co-fund regional demonstrators.

Stage 5 exit: PMCF report (MDCG 2020-8 template) + ≥1 peer-reviewed publication + referenceable pilot sites. Spend: €20k–60k (hospital contract-value mostly funds itself).

Stage 6 — Market access, reimbursement & funding (Month 12–24)

6.1 Public financing of the journey itself

6.2 Reimbursement routes (how stakeholders' budgets pay for me)

• Forfait innovation (art. L.165-1-1 CSS): derogatory temporary coverage conditioned on a data-generating study — the natural first step post-CE with my pilot hospital.

• PECAN (prise en charge anticipée numérique, décret 2023-232): 1-year national early coverage, then mandatory LPPR filing. Continuum+ Connect walked this exact oncology path (HAS favourable Sept 2024).

• Droit-commun télésurveillance list (art. L.162-52 CSS): inscribed activities paid by monthly forfaits — €28 (level 1) / €56 / €70 — the anchor of my pricing. Requires: physician prescription, patient consent, ISO 13485-certified operator (Stage 4 output), HDS-certified exploitant (Stage 3 output), real-world data + biennial re-evaluation. Recent oncology inscriptions: Cureety (opérateur €28/mo + distributeur €50/patient/mo), Satelia. The 2025 oncology télésurveillance referential (Bulletin du Cancer) is my clinical map.

• Hospitals' own budgets: purchases below €40k HT run as simplified procedures (perfect pilot size); above via tender; UGAP/RESAH catalog listing = procurement shortcut hospitals love.

Stage 6 exit: ≥2 paying pilot contracts + PECAN or FI dossier filed with HAS. Spend: €20k–80k.

Stage 7 — Licensing model: how stakeholders buy (Month 18+)

7.1 Product packaging

7.2 Pricing logic

• Per-site annual platform license (€8k–20k depending on tier — sized so a pilot fits under the €40k MAPA threshold in year 1) + per-active-oncology-patient/month for the monitored cohort, anchored to the télésurveillance forfaits: if Assurance Maladie pays an operator forfait of €28–70/patient/month, my patient fee sits at €15–35/active patient/month, leaving margin inside the forfait or inside avoided re-admissions.

• The value story I sell with: MOE-4 from my own plan — ≥20% reduction of unplanned re-admissions — measured in the PMCF pilot and printed in the publication.

7.3 The license contract itself (French hospital market)

• Contrat de licence + CGV, referencing CCAG-TIC 2021 (the public-sector TIC general terms) rather than reinventing clauses; explicit réversibilité (data export in open format at exit — also an HDS 2.0 obligation), maintenance/SLA (hotline, GTI/GTR, availability %, aligned to my MOP-1 ≥99.5% target), DPtraité (art. 28 GDPR) annex, materiovigilance contact, UDI/CE references, IP reservations.

• Buying committee I sell to: DSI (HDS, Ségur, security), direction médicale HAD + coordinating nurses (clinical value), DG (budget), optional ARS co-funding.

Stage 7 exit: signed licenses, churn <10%, support machine, pipeline ≥5 structures.

Stage 8 — Marketing: evidence-first, community-anchored

Positioning line: "The CTCAE-native toxicity watchtower for hospitalisation à domicile — built by an oncologist, graded for the ward, reimbursable." No competitor owns the HAD workflow; my clinical founder-authenticity is the moat competitors (Cureety, Satelia, Continuum+, Resilience) cannot copy.

Risk register (what can kill this, and my counter)

The 30-day checklist (start today)

• [ ] Day 1–3: confidential marking everywhere; repo locked; NDA template adopted; no more unprotected demos

• [ ] Day 3–7: e-Soleau deposit (specs + grading logic + code snapshot) — €15

• [ ] Day 5–10: trademark availability search; file EU mark classes 9/42/44 — ~€1,050

• [ ] Day 7–15: employment-invention dossier written and dated

• [ ] Day 10–20: INPI prédiagnostic PI booked; patent go/no-go logged

• [ ] Day 15–30: SASU statutes prepared; file on guichet unique (~€250)

• [ ] Day 20–30: regulatory consultant shortlist (3 quotes — SaMD-experienced); NB quote requests drafted

• [ ] Day 30: this playbook reviewed with Zaid (governance authority) and counter-signed — GO decision for Stage 1–2 spend

Appendix — primary sources

IP & company

• INPI software & copyright: inpi.fr/realiser-demarches/propriete-intellectuelle/cas-particulier-logiciels

• e-Soleau: inpi.fr/realiser-demarches/propriete-intellectuelle/deposer-une-e-soleau-ou-un-entiercement

• Trademark fees: inpi.fr/realiser-demarches/propriete-intellectuelle/deposant-et-cout-dune-marque · euipo.europa.eu

• Patent costs: inpi.fr/realiser-demarches/propriete-intellectuelle/deposant-et-cout-dun-brevet

• Prédiagnostic PI: inpi.fr/nos-solutions/etablir-son-plan-dactions/prediagnostic-pi

• Secret des affaires: legifrance (L151-1 s. Code de commerce) · inpi.fr/ressources/propriete-intellectuelle/secret

• AI & authorship: CSPLA report (culture.gouv.fr)

• Company creation fees: formalites.entreprises.gouv.fr/tarifs.php · entreprendre.service-public.fr/vosdroits/F37688

Regulatory (MDR)

• MDCG 2019-11 rev.1 (June 2025): health.ec.europa.eu

• Rule 11 & SaMD CE costs: blog.johner-institute.com · openregulatory.com · team-nb.org (14th NB survey)

• EUDAMED mandatory timetable (Reg. 2024/1860): health.ec.europa.eu (27 Nov 2025 announcement)

• ANSM DM/EUDAMED FAQ + Guichet Innovation: ansm.sante.fr

• Standards: IEC 62304, ISO 14971, IEC 62366-1, MDCG 2019-16, IEC 81001-5-1, MDCG 2020-1/-7/-8/-13

Data & care

• HDS: esante.gouv.fr/labels-certifications/hds (+ HDS 2.0 arrêté 26/04/2024) · certified-host list: esante.gouv.fr/offres-services/hds/liste-des-hebergeurs-certifies

• CNIL: santé guidance, AIPD, mobile-app recommendation (2024), MR-004

• Loi Jardé / RIPH categories: legifrance (L.1121-1, L.1123-1 CSP)

• Télésurveillance droit commun: legifrance (L.162-52 CSS; arrêtés 22/06/2023, 17/01/2025, 17/11/2025) · ameli.fr/medecin (forfaits)

• CNOM télémédecine: conseil-national.medecin.fr

Market

• HAD figures: sante.gouv.fr (HAD page) · fnehad.fr · drees.solidarites-sante.gouv.fr · scansante

• Reimbursement precedents: legifrance arrêtés 10/09/2024 (Continuum+), 31/03/2025 (Cureety), 28/03/2025 (Satelia), 14/02/2025 (Moovcare radiation) · has-sante.fr (avis CNEDiMTS)

• PECAN: esante.gouv.fr/ens/offre/dispositifs-medicaux-numeriques/pecan · has-sante.fr (PECAN deposit guide)

• Forfait innovation: sante.gouv.fr/systeme-de-sante/innovation-et-recherche/forfait-innovation

• i-Lab: bpifrance.fr · Public procurement: entreprendre.service-public.fr/vosdroits/F23371 · CCAG-TIC 2021

• Events: santexpo.fr · sfro-congres.fr · fnehad.fr (Universités)