The Challenge
TheraCom is a mental health services company providing CBT and counselling through a network of accredited therapists. Post-pandemic demand for remote therapy had grown dramatically, but their existing booking and session process was entirely manual — therapy sessions happened on Zoom, notes in a Word document, and scheduling via email chains.
They needed an app that could handle the full patient journey: finding a therapist, booking sessions, attending video calls, completing between-session exercises, and tracking mood over time — all in a single experience that felt supportive rather than clinical.
The regulatory layer
Because the app would be used as part of a clinical pathway, it required DCB0129 clinical safety documentation and DTAC compliance — frameworks most consumer app developers have never worked with. This added scope, but was non-negotiable for NHS partnerships.
Our Solution
We chose Flutter over React Native for this project — TheraCom needed pixel-perfect UI consistency across iOS and Android, and Flutter's rendering engine (which draws its own UI components rather than using native ones) delivered this reliably. The choice also simplified the video call integration.
NHS Login Integration
Patients authenticate via NHS login, which verifies their identity and populates basic demographic data. This removed a significant onboarding friction point and gave the app immediate credibility with NHS-adjacent referrers.
In-App Video Sessions
Encrypted video calling using Daily.co's SDK, integrated directly into the session UI. Session recordings are optional (requires explicit patient consent), stored encrypted, and auto-deleted after 30 days.
Mood Journal & PHQ-9 Tracking
Daily mood logging with a simplified emoji scale, plus optional guided journal prompts set by the therapist. Standardised PHQ-9 and GAD-7 questionnaires built in, with trend charts visible to both patient and therapist.
Secure Asynchronous Messaging
End-to-end encrypted messaging between patient and therapist, separate from the video session. Therapists can share resources, set exercises, and check in between sessions without the overhead of a full appointment.
Technical Approach
Clinical safety compliance (DCB0129) required us to produce a Clinical Safety Case and Hazard Log alongside the software. We worked with TheraCom's clinical safety officer throughout — documenting hazards, mitigations, and residual risks at each stage. This documentation is often an afterthought; we integrated it into our sprint process.
The end-to-end encryption for messaging uses the Signal Protocol (via a Dart implementation). All clinical data is stored in an NHS-approved data centre in the UK. We completed a Data Security and Protection Toolkit assessment as part of the project.
Technology Used
Results
"Webmatx understood that this wasn't just an app — it was a clinical product. They took the regulatory work seriously, didn't cut corners on the security architecture, and the result is something we're genuinely proud to put in front of patients."
