Platform

More than a website. A platform.

Hand-coded. Not templated. Not built on Wix, Squarespace, or Webflow. Seven engineering pillars under every site we ship.

01 · Performance

Performance, felt.

Pages load fast on a 4G iPhone in a clinic carpark. That is the test that matters.

Heavy PNGs. Default Google Fonts loading. No preload. Sluggish on mobile, especially on older devices.

  • AVIF + WebP image pipeline at 640, 1024, 1600, 2400 px. 40 to 70 percent smaller than PNG.
  • LCP preload on the largest image so it starts before the HTML is parsed.
  • Self-hostable fonts for zero third-party requests when needed.
  • Hover prefetch on nav links. Clicks feel instant.
  • Native view transitions for app-like page changes.
  • Explicit width and height on every image. Zero layout shift.
Result. Lighthouse mobile in the high 90s before any tuning. Patients do not wait.
02 · Findability

Findable in Google and AI.

Patients now ask ChatGPT and Perplexity. Your site needs to answer in both worlds.

A title and meta description. Maybe one basic JSON-LD block. No Speakable. No llms.txt.

  • Schema.org @graph: Physician, MedicalOrganization, Hospital with hours, MedicalProcedure, BreadcrumbList, SpeakableSpecification, WebSite SearchAction.
  • llms.txt at the root. The standard that tells AI crawlers how to index you.
  • Canonical tags on every page.
  • OpenGraph and Twitter Cards per page. Link previews look right in WhatsApp and LinkedIn.
  • Sitemap with image extensions. Portraits get indexed.
  • Clean URLs. /about, never /about.html.
Result. You appear in Google results and in AI answers when patients ask "good plastic surgeon in Singapore."
03 · Security & Compliance

Compliant by default.

Real headers. Real consent. Not a checkbox.

HTTPS because the host turned it on. A cookie banner that does nothing. No CSP. No PDPA framework.

  • Strict Content Security Policy. Only whitelisted scripts run.
  • Full security header stack: HSTS preload, Permissions-Policy, Referrer-Policy, X-Content-Type-Options, COOP.
  • security.txt at /.well-known/security.txt for responsible disclosure.
  • PDPA-compliant consent via Google Consent Mode v2. Deny by default. Choice persisted and revocable.
  • Self-hosted fonts option. Visitor IPs never touch a third-party CDN.
  • Cache policy that fits. One-year immutable for assets, no-cache for HTML.
Result. A or A+ on securityheaders.com and Mozilla Observatory on day one.
04 · Accessibility

WCAG 2.2 AA.

Every patient gets the same site, regardless of how they read it.

Alt text if you are lucky. Default focus rings. A mobile menu that traps keyboard users.

  • Skip-to-content link on every page.
  • Semantic landmarks. <main>, <nav> with aria-label, aria-current on active page.
  • Visible focus rings via :focus-visible, designed in brand colour.
  • Keyboard-first mobile menu: aria-expanded, Escape to close, focus return.
  • prefers-reduced-motion respected on every animation.
  • Descriptive alt text on every image. Not the filename.
Result. Patients on screen readers, keyboard-only, or with vestibular disorders are fully served. Ethically right and legally defensible.
05 · Installable

Installable, offline-capable.

A site, but also a saveable thing. Patients can add it to their home screen.

A website. Lose signal, blank page.

  • Web App Manifest. "Add to Home Screen" on iOS and Android.
  • Service worker: cache-first for assets, network-first for HTML, stale-while-revalidate for the rest.
  • Branded offline page. No browser dinosaur.
  • Print stylesheet. Patients print. The page should not waste ink.
Result. A patient on a plane can pull up your contact details. Disproportionate trust signal.
06 · Analytics

Analytics, done right.

Real numbers, real conversion events, no compliance flags.

GA4 dropped in the head. Or nothing.

  • Google Tag Manager. One container, all your pixels.
  • Consent Mode v2. Legal in PDPA and GDPR markets.
  • Automatic CTA tracking. Phone, email, WhatsApp, vCard, booking.
  • Web Vitals telemetry. LCP, INP, CLS, TTFB streamed live.
  • vCard "Save Contact" download. Tracked as a high-intent event.
Result. You know what works. You can run real ads with real conversion events.
07 · Craft

The craft layer.

The reason a Drfol.io site does not look AI-generated.

A Webflow or Wix template. Default fonts, default fade-in, default everything.

  • Bespoke typography. Faces selected, kerned, paired for the specialty.
  • Intentional easing. cubic-bezier(0.16, 1, 0.3, 1), not ease-in-out.
  • Native scroll-driven reveals. GPU-accelerated, zero JS overhead.
  • View transitions between pages. Native-app feel.
  • Real art direction. Texture, gradient, grain.
  • Hand-crafted states. Focus, hover, active. Designed, not inherited.
Result. The site looks commissioned, not generated.

The plain version.

If a colleague asks why any of this matters, here it is.

  • Performance
    Patients don't bounce on slow mobile networks.
  • Findability
    AI assistants cite you correctly when asked who's good.
  • Security
    You can answer "is this compliant?" with "yes."
  • Accessibility
    You serve every patient, including the ones with disabilities.
  • Installable
    Patients save you to their home screen.
  • Analytics
    You know what works. You can run real ads.
  • Craft
    It looks commissioned, not generated.

See it on a real build.

Begin Discovery, or message the team to ask first.