The Wellcom App

Inspiration

I grew up in eastern Kentucky, a region of the US which is pretty lacking in many areas, especially education and healthcare. I have always wanted to go into healthcare not just to have a job, but to make an actual difference and improve access to healthcare. With incoming political changes to healthcare access already alarming my home region, there has never been a better time to develop applications for solving problems in healthcare.

Eastern Kentucky faces additional challenges not usually seen in larger cities, such as a longer distance to drive to reach a provider or case worker, no public transportation, spotty cell service, and severe lack of high-speed internet. The last two points are what inspired the offline-first strategy for data storage--users can still work on the app even while offline!

Youth in foster care are already at a significant disadvantage, but add to that, challenges with mental and behavioral health, and these kiddos really need more care than even bigger healthcare providers can manage with traditional methods--meet once a month, tell all your problems, and go back home. This app takes core principles from a modern movement called TCOM (Transformational Collaborative Outcomes Management) to really go all in on bringing everyone together to care for a child struggling and in need, everyone should feel Wellcom.

What it does

Wellcom is an enterprise-ready collaborative care platform for behavioral and mental health services. The app allows care providers to assign, monitor, and review tasks associated with a care plan for patients, while patients can check off daily goals, receive reminders, and view their care progress in real time. Additionally, patients may fill out mini assessments on symptoms related to their care, while on the provider side, trends on these symptoms are logged and clearly displayed. Because large-scale care plans might be overwhelming for a provider interpret and make decisions on, a carefully-crafted LLM summarizer tool is available to help with generating insights. With robust offline support, all user activity is securely synced to the cloud when a connection is available. Wellcom leverages secure authentication, real-time database syncing, and supports multi-role access for future team collaboration. It’s designed for organizations that want secure, reliable, and user-friendly digital care management.

How we built it

Wellcom was built using React Native and Expo for true cross-platform deployment (iOS, Android, and Web).

  • Frontend:

    • Built with React Native + Expo, using TypeScript for type safety and component reusability.
    • Modern UI with responsive layouts for mobile, tablet, and web.
    • SVG asset support and icon libraries for a polished look.
  • Backend:

    • Supabase (PostgreSQL + Auth + Realtime) powers user authentication, database storage, and real-time data updates. Edge functions for securely utilizing LLM tools directly on de-identified data.
    • On mobile, data is stored locally first (encrypted at rest using expo-secure-store) and synced with Supabase when a connection is available for robust offline functionality and cloud syncing. On web, data is directly inserted into Supabase to avoid unsecure web browser storage--no data is stored in a web session.
  • Collaboration features:

    • Role-based access control limits provider and patient roles to only screens relevant to their roles.
    • Real-time collaborative features with Supabase subscriptions using websockets allows for a much more fluid user experience with fewer manual refreshes needed during collaboration sessions.
  • Development & deployment:

    • Developed collaboratively using GitHub and Bolt.
    • Supports easy local testing with Expo CLI and one-command builds for Android/iOS.
    • Web deployment through Netlify (for demonstration purposes) with a custom IONOS domain.

Challenges we ran into

  • Offline/Online Data Sync: Merging local and cloud data reliably was a major challenge, especially handling edge cases like conflicts and authentication loss.
  • Role Management: Designing a data schema and policy rules to separate user access (patients, providers, admins) while remaining flexible for future roles.
  • Supabase Policies: Navigating Row Level Security (RLS) and ensuring users only access their assigned data required careful policy design and debugging.
  • Web App Routing: Handling page refreshes and deep linking in the web version with Expo/React Native presented challenges outside typical mobile workflows.
  • Batch Data Import: Planning for enterprise bulk user and patient uploads meant thinking about UUID assignment and safe data linking.
  • Bolt Context Window exhaustion began to limit the reliability of the AI tool

Accomplishments that we're proud of

  • Delivered true offline-first functionality with seamless sync when back online.
  • Built a clean, modern UI adaptable for mobile and web, with accessibility in mind.
  • Established a secure, real-time backend with future support for collaborative care teams.
  • Designed with enterprise-readiness and HIPAA-compliance (encryption, secure auth) as guiding principles.
  • Created a scalable foundation to support new roles, features, and enterprise data needs.
  • Integration of LLM data summarizer via Supabase Edge Functions

What we learned

  • The value of robust local storage and thoughtful conflict resolution for healthcare apps that can’t afford data loss.
  • Importance of database policies and RLS for multi-user security.
  • How real-time tools like Supabase can simplify complex backend needs—while also introducing new challenges.
  • How UX and technical design decisions impact provider/patient trust in a digital healthcare product.
  • The realities of cross-platform development and web/mobile parity with Expo.

What's next for Wellcom

  • Integration with native mobile tools for inclusion of health metrics, especially sleep and exercise
  • Bulk user and patient import tools for organizations onboarding at scale.
  • Expanded roles: care team collaboration, supervisor oversight, and patient family access.
  • Real-time messaging and push notifications for timely care interventions.
  • Enhanced analytics and reporting for organizational insights.
  • Third-party EHR integration and export capabilities.
  • Advancing toward full HIPAA compliance and security certifications.
  • Improved web support (PWA) and deep-linking.
  • More user customization and accessibility enhancements.
Feature/Safeguard Status Progress
Offline-First Sync ☑️ Complete
Basic Auth (w/ roles) ☑️ Complete
Encrypted Storage (at rest/in transit) ☑️ Complete
RBAC (basic) ☑️/⏳ Partial
Task CRUD ☑️ Complete
User-Task Assignment ☑️ Complete
User Profile Management ⏳ In Progress
Audit Trail/Audit Log ⏳/❌ Partial/Not Started
Central Error Monitoring ❌ Not Started
Automated Backups/Restore ❌ Not Started
Data Retention/Deletion ❌ Not Started
No PHI in Logs/Notifications ❌ Not Started
2FA/MFA Support ❌ Not Started
Session Timeout/Lockout ❌ Not Started
Remote Wipe ❌ Not Started
BAA/Compliance Docs ❌ Not Started
Multi-Env Support ☑️ Complete
Bulk Import/Export ❌ Not Started
Enterprise SSO ❌ Not Started
Advanced Permissions/Delegation ❌ Not Started
Test Coverage & CI/CD ❌ Not Started
Accessibility ❌ Not Started
Rate Limiting/Abuse Detection ❌ Not Started
Scalable Notification Infra ❌ Not Started
Custom Notification System ❌ Not Started
Defensive Against Localhost/WebRTC/Port Tracking ☑️ Complete

🔐 Youth/Vulnerable Population Security Hardening

Additionally, because youth in mental/behavioral health services within a foster care program are among the most vulnerable population when it comes to social aspects, we want to provide options for securing the app against social engineering tactics and even accidental peer interactions that may leak compromising information in a social setting, such as a friend seeing the app open with potentially embarrassing therapy notes and care plans visible.

Safeguard/Feature Priority Status Comments/Links
App icon/name/notifications reveal nothing High
No PHI/PII in notifications High
PIN/biometric lock for app High
Panic/hide/logout feature Medium
Clipboard guard Medium
Screenshot prevention (FLAG_SECURE) High
Local PHI auto-expiry after inactivity High
Root/jailbreak detection/block High
Admin remote wipe/lockout High
Account offboarding disables access immediately High
User consent/attestation for minors High
Access transparency for guardians Medium
Geo/IP anomaly detection Medium
Device encryption enforcement/warning Medium
FERPA compliance (if applicable) Varies
Data residency/legal compliance High
Training and periodic security review High
Penetration testing High
Share this project:

Updates