Item: Clickmasters Software Development Company
Rating: 5
Author: Clickmasters Case Study Team

Project Overview

NHS-Connected Mental Health App — DTAC Approved. A UK mental health technology company needed to build a patient-facing digital therapy support app connected to NHS syst...

Technology Stack

React NativeNode.jsFastAPIFHIR R4 UK CoreNHS Login OIDCAWS eu-west-2PostgreSQLTerraform

Compliance & Standards

Achieved DTAC (all 5 domains)DSP Toolkit "Standards Met"Cyber Essentials PlusCREST pen testWCAG 2.1 AADCB0129UK GDPR Article 9 Delivery Model Fixed-price Agile — 2-week sprints Timeline Delivered on agreed schedule

Step 01

The Challenge

A UK mental health technology company needed to build a patient-facing digital therapy support app connected to NHS systems. The app needed: NHS Login for patient identity verification, FHIR R4 data model for clinical records, DTAC compliance across all 5 domains, and WCAG 2.1 AA accessibility. A previous developer had built a version that failed DTAC Domains 2, 3, and 5. Clickmasters was engaged for full remediation and rebuild of the failed components.

Step 02

Our Approach

Remediation

Achieved Cyber Essentials Plus certification (4 weeks).
Commissioned CREST-certified penetration test (identified and remediated 2 High and 6 Medium findings).
Implemented automated dependency scanning in CI/CD pipeline (Dependabot, 14-day patch SLA).
DTAC Domain 2 (Data Protection)

Remediation

Completed DSP Toolkit to "Standards Met" level.
Implemented FHIR R4 data model for clinical data (replacing custom JSON schema).
Completed DPIA for high-risk processing of mental health data (Article 9 special category).
Revised Article 28 DPA with NHS organisations.
DTAC Domain 5 (Usability &amp
Accessibility)

Remediation

WCAG 2.1 AA audit (automated + manual screen reader testing with NVDA).
Identified 23 accessibility failures.
Remediated all 23 over 3 sprints.
Re-tested with screen reader users.
Evidence pack compiled.

NHS Login Integration

Completed NHS Digital supplier onboarding (P5 assurance level for mental health service).
Implemented OIDC authorisation code flow with PKCE.
Tested in NHS Digital sandbox and integration environments.

Step 03

The Results

DTAC resubmission approved on first attempt following remediation.

NHS App Library listed 14 weeks after Clickmasters engagement began. 1,200 NHS patient registrations in first 8 weeks.

DSP Toolkit "Standards Met" maintained at annual renewal.

“

Client Testimonial

“After failing DTAC twice with our previous developer, Clickmasters understood exactly what was needed to pass. The DTAC remediation was methodical — they fixed exactly the right things and compiled evidence the NHS Digital assessors accepted immediately." — Founder, UK HealthTech Company (name withheld)”

Clickmasters Case Study Team

Reviewed by James Whitmore, CTO