Answers
Frequently asked questions about the Vitalink API
This page gathers the questions we are most frequently asked by developers and IT managers. They concern integration, compliance, and how the API works. If your question is not listed here, write to us: we respond from Monday to Friday, between 09:00 and 18:00 (CET).
Six topics come up in almost every project
The questions below come from our exchanges with integration teams, IT managers, and clinical data architects. Each answer describes what the API provides, what remains on your side, and where to find the technical details.
Looking for a specific point? The API documentation details endpoints and formats, and the security page covers encryption and logging.
How to integrate glucometer and smartwatch data into a Swiss clinical record without breaking FHIR compliance?
The API receives device data, normalizes it, and exposes it as FHIR resources. You then align these resources with your institution's profiles. The table below summarizes the steps of a typical project and what the API documentation specifies for each.
The step that requires the most attention is the association between the measurement and the correct patient: blood glucose data linked to the wrong person creates a clinical error, not just a technical error. Plan this point with your identity management team before the first test. The endpoints themselves, their parameters, and the expected responses are described in theAPI documentation.
Which profiles must be respected for a deployment in a clinic or hospital?
This depends on your institution and its exchange guides. A university hospital and a group practice do not expect the same constraints on Patient, Observation, or Device resources. Vitalink documents the resources used and aligns with the profiles you are targeting. Clarification is done during the design phase, before the first write.
Concretely, prepare two elements before the scoping workshop: the list of resources your EMR already accepts, and the internal exchange guide that describes mandatory extensions. With these two documents, mapping takes a few days rather than several weeks.
How to secure a health API with OAuth, access control, and encryption?
- Access is via OAuth, with scopes defined by role and resource: a lab technician does not see the same data as an attending physician.
- Data is encrypted in transit and at rest. The details of the algorithms and key management are described on the security and encryption page.
- Each access is logged for audit: who read what, when, and via which scope.
Is it necessary to go through a middleware before writing to the EHR?
Not necessarily, but a middleware layer facilitates access control, standardization, and traceability. It avoids scattering device logic across multiple services and keeps a single place to verify rules. The choice depends on your architecture.
If you only have one type of device and one target EHR, a direct call remains defensible. As soon as a second device or a second hospital enters the scope, the middleware becomes the easiest solution to maintain.
How to manage formats, terminologies, and device data standardization?
The API applies semantic normalization before writing: units, observation codes, repositories like SNOMED CT. You retain control over the final profile. Without this step, each integration becomes a translation in its own right.
- A point-in-time blood glucose measurement Isolated resource
- A time series of several days Different structure
- The associated patient metadata Link to be verified
A point-in-time measurement and a time series do not have the same structure. Vitalink documents the resources used for each case. You then adapt to your institution's target profile.
What is the legal framework for the processing?
The processing falls under the Swiss Federal Act on Data Protection (FADP) and the European GDPR. This page describes the principles; technical measures are on the Security and encryption page, and legal details are in the privacy policy.
FADP
Swiss Federal Act on Data Protection. It governs the processing of health data for patients monitored in Switzerland and imposes obligations of transparency and security.
- Documented legal basis and purpose of processing
- Up-to-date register of processing activities
- Rights of data subjects: access, rectification, erasure
GDPR
European regulation applicable as soon as a patient or a partner institution is established in the Union. It adds obligations for impact assessment and breach notification.
- Distribution of responsibilities between processors
- Impact assessment for high-risk processing
- Notification of breaches within the prescribed time limits
Your obligations
Vitalink provides the API and documentation. Compliance of the final use remains the responsibility of the institution that collects and uses patient data.
- Informing patients about data usage
- Management of internal authorizations
- Retention of access logs
What we are asked after the first exchange
How long does an initial integration take?
The pace depends mainly on the availability of your target profiles and access to an EHR test environment. The API part is set up quickly; writing to the clinical record progresses at the pace of your institution's validations.
Can we test without connecting a real EHR?
Yes. A test environment allows you to validate device data normalization and the resources produced before any real writing. This is the recommended step to verify units, observation codes, and patient linking.
Which devices are supported?
The API processes data from blood glucose meters and smartwatches. Supported models and protocols evolve; the API documentation lists the sources currently covered and the procedure for adding a new one.
How does developer support work?
Support is provided by the technical team, Monday to Friday between 09:00 and 18:00 (CET). You can write to [email protected] or call +41 21 581 78 71. For a blocking incident, specify the concerned endpoint and the error message received.
Where is the data processed?
Health data is processed within the framework described by the privacy policy. This page specifies the principles, purposes, and retention periods applicable to exchanges between the API and your institution.
Is your question not in the list?
Describe your context: type of institution, target EHR, devices concerned. We will get back to you with the elements your team needs to move forward, without any commitment on your part.
Vitalink HealthData AG, Seefeldstrasse 45, 8008 Zürich. Support Monday to Friday, 09:00 – 18:00 (CET).