The Wellcom App
Inspiration
I grew up in eastern Kentucky, a region of the US which is pretty lacking in many areas, especially education and healthcare. I have always wanted to go into healthcare not just to have a job, but to make an actual difference and improve access to healthcare. With incoming political changes to healthcare access already alarming my home region, there has never been a better time to develop applications for solving problems in healthcare.
Eastern Kentucky faces additional challenges not usually seen in larger cities, such as a longer distance to drive to reach a provider or case worker, no public transportation, spotty cell service, and severe lack of high-speed internet. The last two points are what inspired the offline-first strategy for data storage--users can still work on the app even while offline!
Youth in foster care are already at a significant disadvantage, but add to that, challenges with mental and behavioral health, and these kiddos really need more care than even bigger healthcare providers can manage with traditional methods--meet once a month, tell all your problems, and go back home. This app takes core principles from a modern movement called TCOM (Transformational Collaborative Outcomes Management) to really go all in on bringing everyone together to care for a child struggling and in need, everyone should feel Wellcom.
What it does
Wellcom is an enterprise-ready collaborative care platform for behavioral and mental health services. The app allows care providers to assign, monitor, and review tasks associated with a care plan for patients, while patients can check off daily goals, receive reminders, and view their care progress in real time. Additionally, patients may fill out mini assessments on symptoms related to their care, while on the provider side, trends on these symptoms are logged and clearly displayed. Because large-scale care plans might be overwhelming for a provider interpret and make decisions on, a carefully-crafted LLM summarizer tool is available to help with generating insights. With robust offline support, all user activity is securely synced to the cloud when a connection is available. Wellcom leverages secure authentication, real-time database syncing, and supports multi-role access for future team collaboration. It’s designed for organizations that want secure, reliable, and user-friendly digital care management.
How we built it
Wellcom was built using React Native and Expo for true cross-platform deployment (iOS, Android, and Web).
Frontend:
- Built with React Native + Expo, using TypeScript for type safety and component reusability.
- Modern UI with responsive layouts for mobile, tablet, and web.
- SVG asset support and icon libraries for a polished look.
Backend:
- Supabase (PostgreSQL + Auth + Realtime) powers user authentication, database storage, and real-time data updates. Edge functions for securely utilizing LLM tools directly on de-identified data.
- On mobile, data is stored locally first (encrypted at rest using expo-secure-store) and synced with Supabase when a connection is available for robust offline functionality and cloud syncing. On web, data is directly inserted into Supabase to avoid unsecure web browser storage--no data is stored in a web session.
Collaboration features:
- Role-based access control limits provider and patient roles to only screens relevant to their roles.
- Real-time collaborative features with Supabase subscriptions using websockets allows for a much more fluid user experience with fewer manual refreshes needed during collaboration sessions.
Development & deployment:
- Developed collaboratively using GitHub and Bolt.
- Supports easy local testing with Expo CLI and one-command builds for Android/iOS.
- Web deployment through Netlify (for demonstration purposes) with a custom IONOS domain.
Challenges we ran into
- Offline/Online Data Sync: Merging local and cloud data reliably was a major challenge, especially handling edge cases like conflicts and authentication loss.
- Role Management: Designing a data schema and policy rules to separate user access (patients, providers, admins) while remaining flexible for future roles.
- Supabase Policies: Navigating Row Level Security (RLS) and ensuring users only access their assigned data required careful policy design and debugging.
- Web App Routing: Handling page refreshes and deep linking in the web version with Expo/React Native presented challenges outside typical mobile workflows.
- Batch Data Import: Planning for enterprise bulk user and patient uploads meant thinking about UUID assignment and safe data linking.
- Bolt Context Window exhaustion began to limit the reliability of the AI tool
Accomplishments that we're proud of
- Delivered true offline-first functionality with seamless sync when back online.
- Built a clean, modern UI adaptable for mobile and web, with accessibility in mind.
- Established a secure, real-time backend with future support for collaborative care teams.
- Designed with enterprise-readiness and HIPAA-compliance (encryption, secure auth) as guiding principles.
- Created a scalable foundation to support new roles, features, and enterprise data needs.
- Integration of LLM data summarizer via Supabase Edge Functions
What we learned
- The value of robust local storage and thoughtful conflict resolution for healthcare apps that can’t afford data loss.
- Importance of database policies and RLS for multi-user security.
- How real-time tools like Supabase can simplify complex backend needs—while also introducing new challenges.
- How UX and technical design decisions impact provider/patient trust in a digital healthcare product.
- The realities of cross-platform development and web/mobile parity with Expo.
What's next for Wellcom
- Integration with native mobile tools for inclusion of health metrics, especially sleep and exercise
- Bulk user and patient import tools for organizations onboarding at scale.
- Expanded roles: care team collaboration, supervisor oversight, and patient family access.
- Real-time messaging and push notifications for timely care interventions.
- Enhanced analytics and reporting for organizational insights.
- Third-party EHR integration and export capabilities.
- Advancing toward full HIPAA compliance and security certifications.
- Improved web support (PWA) and deep-linking.
- More user customization and accessibility enhancements.
| Feature/Safeguard | Status | Progress |
|---|---|---|
| Offline-First Sync | ☑️ Complete | |
| Basic Auth (w/ roles) | ☑️ Complete | |
| Encrypted Storage (at rest/in transit) | ☑️ Complete | |
| RBAC (basic) | ☑️/⏳ Partial | |
| Task CRUD | ☑️ Complete | |
| User-Task Assignment | ☑️ Complete | |
| User Profile Management | ⏳ In Progress | |
| Audit Trail/Audit Log | ⏳/❌ Partial/Not Started | |
| Central Error Monitoring | ❌ Not Started | |
| Automated Backups/Restore | ❌ Not Started | |
| Data Retention/Deletion | ❌ Not Started | |
| No PHI in Logs/Notifications | ❌ Not Started | |
| 2FA/MFA Support | ❌ Not Started | |
| Session Timeout/Lockout | ❌ Not Started | |
| Remote Wipe | ❌ Not Started | |
| BAA/Compliance Docs | ❌ Not Started | |
| Multi-Env Support | ☑️ Complete | |
| Bulk Import/Export | ❌ Not Started | |
| Enterprise SSO | ❌ Not Started | |
| Advanced Permissions/Delegation | ❌ Not Started | |
| Test Coverage & CI/CD | ❌ Not Started | |
| Accessibility | ❌ Not Started | |
| Rate Limiting/Abuse Detection | ❌ Not Started | |
| Scalable Notification Infra | ❌ Not Started | |
| Custom Notification System | ❌ Not Started | |
| Defensive Against Localhost/WebRTC/Port Tracking | ☑️ Complete |
🔐 Youth/Vulnerable Population Security Hardening
Additionally, because youth in mental/behavioral health services within a foster care program are among the most vulnerable population when it comes to social aspects, we want to provide options for securing the app against social engineering tactics and even accidental peer interactions that may leak compromising information in a social setting, such as a friend seeing the app open with potentially embarrassing therapy notes and care plans visible.
| Safeguard/Feature | Priority | Status | Comments/Links |
|---|---|---|---|
| App icon/name/notifications reveal nothing | High | ||
| No PHI/PII in notifications | High | ||
| PIN/biometric lock for app | High | ||
| Panic/hide/logout feature | Medium | ||
| Clipboard guard | Medium | ||
| Screenshot prevention (FLAG_SECURE) | High | ||
| Local PHI auto-expiry after inactivity | High | ||
| Root/jailbreak detection/block | High | ||
| Admin remote wipe/lockout | High | ||
| Account offboarding disables access immediately | High | ||
| User consent/attestation for minors | High | ||
| Access transparency for guardians | Medium | ||
| Geo/IP anomaly detection | Medium | ||
| Device encryption enforcement/warning | Medium | ||
| FERPA compliance (if applicable) | Varies | ||
| Data residency/legal compliance | High | ||
| Training and periodic security review | High | ||
| Penetration testing | High |
Log in or sign up for Devpost to join the conversation.