Gambling Recovery Support App

A mobile recovery programme for people working through gambling harm, built as a Flutter app for iOS and Android, a NestJS and Prisma API on PostgreSQL, and a React admin dashboard for the clinical and support team. The app had already been live for some years when I took over the server side, so the work was a rebuild rather than a greenfield project: a new API and data model went in alongside the existing app, which was then modernised onto the current Flutter toolchain against it.

The clinical surface is wide. Users complete a screening questionnaire that produces a repeatable severity score so progress can be tracked over time, keep a daily diary and mood record, work through functional analysis exercises on their own triggers, follow guided audio and video sessions, and store trusted contacts that a crisis flow can reach in one tap. A day sequenced card feed drives the home screen, assembling a top tip, a daily message, a streak, a mood reflection, a mindfulness prompt, a myth or fact card and a motivational quote from the user's day in the programme and the current weekday, so the content advances with the person rather than being the same for everyone. Around that sit milestone badges, a community forum integration, promotion code redemption, subscription entitlements, PDF reporting, and a full data export path for the support team.

The engineering problem I owned was protecting all of that. Almost every field in the system is special category personal data, so I built an application level encryption layer that encrypts sensitive columns at rest and still lets the dashboard search and filter, using separately derived keys for encryption and for search, HMAC derived deterministic tokens for substring matching, and case insensitive hash columns for exact match lookups such as email and city. It shipped with a migration script that encrypted the existing production data in place, tracked the records it could not convert, and tolerated partial state through safe decryption on read. I also worked across data export and reporting, the forum authentication integration, subscription handling and the daily content pipeline, and produced the infrastructure, data residency and audit trail documentation for a third party vendor security review, which meant separating what the platform actually logs and retains today from what it does not.