Customer: Choose Life Wellness
AWS Partner: SoftGEM Global Technologies LTD, AWS Advanced Consulting Partner
Industry: Healthcare and wellness
Country: Nigeria
AWS Region: us-east-1
About Choose Life Wellness
Choose Life Wellness runs health risk assessment and wellness programmes for individuals and for employers managing the health of their workforce. Participants complete structured assessments, the platform scores them against clinical risk factors, and the results feed individual reports and aggregate views for programme administrators.
The Challenge
The assessment platform had grown past what its original hosting could support. Three problems compounded each other.
Assessment traffic is not evenly spread. Corporate wellness programmes launch on a date, and a few hundred employees complete assessments in the same two or three days. The platform had to be sized for those peaks year round, which meant paying for capacity that sat idle most weeks and still slowing down when a large employer went live.
Recovery arrangements did not match the data. Health risk assessments contain personal health information. The platform had no automatic database failover and no tested restore path, so an infrastructure failure meant an outage of unknown length and a real question about what data would come back.
Operations depended on people rather than process. There was no defined view of what healthy looked like, no alerting tied to thresholds, and no written procedure for the recurring work. Problems were found when a user reported them.
For an organisation of this size, the risk was not only technical. Employer clients ask about availability and data protection during procurement, and Choose Life needed answers it could evidence.
Why AWS
SoftGEM assessed two options with Choose Life.
The first was to move the existing deployment onto larger virtual machines. It was quicker and cheaper to execute, and it addressed none of the three problems: peak sizing, recovery, and operations would all have carried across unchanged.
The second was to modernise onto managed AWS services, so that scaling responds to demand automatically, database failover is handled by the platform rather than by an engineer at 2am, and encryption and posture monitoring are configured once and enforced continuously. This was more work up front. Choose Life chose it because the recurring operational burden falls on a team that does not have dedicated platform engineers.
The Solution
Foundation
Two AWS accounts, one for management and one for the production workload, under AWS Organizations with service control policies preventing changes to the audit trail, use of the root account, and deployment outside the approved Region. AWS CloudTrail records management and data events across both accounts to a protected S3 bucket. Access is through AWS IAM Identity Center with no IAM users for people and multi-factor authentication required, so every credential used by an engineer is temporary.
Application Tier
The platform runs on Amazon ECS with AWS Fargate across two Availability Zones, split into separate services so that assessment scoring and the participant-facing web and API tier scale independently. An Application Load Balancer handles ingress with AWS WAF attached and a certificate issued through AWS Certificate Manager. No compute resource holds a public IP address.
Scoring and report generation run asynchronously through Amazon SQS. When an employer programme opens and several hundred assessments arrive at once, the submissions queue and drain rather than slowing the interface for everyone else. Amazon SES delivers participant notifications and report links.
Data Tier
Amazon RDS for PostgreSQL in a Multi-AZ deployment, with a synchronous standby in the second Availability Zone and automatic failover. Assessment documents and generated reports are held in Amazon S3 with versioning. AWS Backup protects both with point in time recovery.
Every data store is encrypted with customer managed AWS KMS keys, separated by domain so that database, storage, backup and secrets each use a distinct key with annual rotation. Encrypted connections to the database are enforced at the parameter group, so an unencrypted client connection is refused rather than discouraged. Application credentials are held in AWS Secrets Manager and retrieved at runtime, never stored in code.
Operations
The platform is defined in AWS CloudFormation and deployed through AWS CodePipeline, with template linting and security scanning in the build stage and a manual approval gate before production. Production console access is read only, so changes reach the environment through the pipeline rather than by hand.
Amazon CloudWatch carries dashboards, alarms, container-level metrics and Synthetics canaries against the participant-facing endpoints. Alarms notify the on-call engineer through Amazon SNS, and each alarm resolves to a named procedure in an operations runbook that SoftGEM wrote and walked through with the Choose Life team at handover. AWS Security Hub runs the CIS AWS Foundations and AWS Foundational Security Best Practices standards, and Amazon GuardDuty monitors for threats across the organisation.
Architecture
Results
Capacity now follows demand. Employer programme launches are absorbed by automatic scaling and by queueing the scoring work, so a few hundred assessments arriving together no longer slow the platform for anyone, and Choose Life is not paying for peak capacity during quiet weeks.
Recovery is automatic rather than manual. The database fails over to its standby without intervention, backups are tested on a schedule, and recovery time and recovery point objectives are agreed and written down rather than discovered during an incident.
Health data is encrypted at rest under customer managed keys and in transit on every path, with key administration separated from key use and posture monitored continuously against recognised security standards.
Operations are documented and repeatable. Alerts are tied to defined thresholds and resolve to named procedures, and the recurring daily, weekly and monthly work is written down, so the platform can be run by the team that owns it rather than depending on the person who built it.
Choose Life can now answer employer procurement questions about availability, encryption and data recovery with documented evidence rather than assurances.