Full Stack Developer

Full Stack Developer (React + Python/FastAPI) Healthcare Software
Glasgow, Scotland (hybrid, 2 days a week in the office) | £350 375/day | 6-month contract, Outside IR35 | Start 20/10/2026

MindClon builds healthcare and medicolegal software that handles sensitive personal data under UK GDPR and clinical governance obligations. We're moving our clinical-records product off Firebase onto a new platform: a React front end, a Python/FastAPI API and background worker, PostgreSQL, and self-hosted language and speech models. The same containers run on Google Cloud and in on-premise installations with no Internet access. You'll build this platform with a small engineering team and the Chief Technical Officer.

This is a mid-level role. You'll own features from requirement to production, with design review and support around you.

What you'll do

• Build features end to end: React and TypeScript in the browser, and FastAPI endpoints with Pydantic validation, business logic and SQL on the server.
• Follow a layered API design: Routers validate, services hold the business rules, repositories own all SQL, and mappers turn rows into JSON or FHIR resources.
• Write PostgreSQL schemas, migrations and queries, working within row-level security and an existing 61-table clinical data model. This includes pgvector search.
• Build background pipeline jobs (dictation transcription, structured extraction) on a Postgres-backed queue, making each step safe to retry.
• Implement permission checks on every request: role-based and patient-level access, consent, emergency-access rules and access logging, with sign-in through Keycloak (OIDC).
• Integrate language-model and speech-to-text calls through our internal model gateway, and treat model output as a draft that a clinician confirms.
• Help move the React app from Firebase to the new API using an existing contract test suite.
• Write automated tests (unit, integration, end-to-end), keep CI green, and deploy to Google Cloud Run and containerised on-premise installations.
• Handle sensitive data carefully as routine: least-privilege access, no personal data in logs, audit trails, UK/EU data residency.

Essential

• Commercial experience with Python and FastAPI (or a comparable Python web framework), including Pydantic.
• React and TypeScript in production.
• PostgreSQL: relational modelling, schema migrations and query tuning.
• Automated testing as a habit (eg pytest, Jest/Playwright or Cypress) and Git-based code review.
• Docker and at least one major cloud platform (GCP preferred), with working CI/CD.
• Experience with OAuth2/OIDC and JWT-based authentication.
• Careful handling of personal or confidential data, and an understanding of UK GDPR obligations.
• Clear communication, and the ability to work independently with support from the team.

Desirable

• Healthcare data standards (FHIR, HL7) or other regulated-domain experience (NHS, public sector, finance).
• PostgreSQL row-level security, pgvector, or Postgres job queues (SKIP LOCKED).
• Keycloak or another identity provider; role- and attribute-based access control.
• Integrating LLM or speech-to-text services (eg vLLM, Whisper), including streamed responses and structured outputs.
• Terraform, Google Cloud Run, or on-premise and air-gapped deployments.
• Firebase, and experience migrating off it.
• Accessibility (WCAG).
• Using AI-assisted development tools (eg Claude, Cursor) responsibly, with human review of generated code.

Terms
A contract for services through your own limited company, intended to sit outside IR35. Initial 6-month term, with extension by agreement. MindClon UK Ltd qualifies for the small-company exemption from the off-payroll working rules, so the status determination rests with the contractor. Rate: £350 375 per day depending on experience, invoiced monthly. Location: hybrid, two days a week at our Glasgow office and the rest remote. Applicants must be able to attend the Glasgow office two days a week. Company equipment may be provided; any device used for MindClon work must meet our device-security policy.