NHS-Connected Mental Health App — DTAC Approved

DTAC Domain 3 (Technical Security) Remediation: Achieved Cyber Essentials Plus certification (4 weeks). Commissioned CREST-certified penetration test (identified and remediated 2 High and 6 Medium findings). Implemented automated dependency scanning in CI/CD pipeline (Dependabot, 14-day patch SLA). DTAC Domain 2 (Data Protection) Remediation: Completed DSP Toolkit to "Standards Met" level. Implemented FHIR R4 data model for clinical data (replacing custom JSON schema). Completed DPIA for high-risk processing of mental health data (Article 9 special category). Revised Article 28 DPA with NHS organisations. DTAC Domain 5 (Usability & Accessibility) Remediation: WCAG 2.1 AA audit (automated + manual screen reader testing with NVDA). Identified 23 accessibility failures. Remediated all 23 over 3 sprints. Re-tested with screen reader users. Evidence pack compiled. NHS Login Integration: Completed NHS Digital supplier onboarding (P5 assurance level for mental health service). Implemented OIDC authorisation code flow with PKCE. Tested in NHS Digital sandbox and integration environments.