Starting a health app in the UK: the NHS standards you need, in order

To sell a health app to the NHS, you need five things, roughly in this order. First, decide whether your app is a medical device. Then run clinical safety under DCB0129 from the first design, and build so you can pass DTAC. Complete the DSPT before you touch NHS patient data. NHS login comes last, and only once an NHS body or council commissions you.

Most founders meet these acronyms in the wrong order, usually when a buyer sends a form the week before a pilot. This guide explains each one in plain English: what it is, who it applies to and when to start. If you’re new to building software, our non-technical founder’s playbook covers the rest of the journey.

Which standards apply to a health app?

Six names come up again and again. Here’s each one in a line.

Is your app a medical device?

Answer this first. It changes your cost, your timeline and what you’re allowed to say in your marketing.

The MHRA’s guidance on medical device stand-alone software including apps says software is likely to be a device if it has a medical purpose. That includes:

• preventing, diagnosing or monitoring a disease, injury or handicap
• treating or alleviating one
• influencing actual treatment, such as calculating a dose
• giving a diagnosis or prognosis, including someone’s future risk of disease

The same guidance lists things that are unlikely to be devices:

• booking an appointment, requesting a prescription or holding a virtual consultation, where the software is purely administrative
• an electronic record that simply replaces a paper file
• monitoring general fitness, health or wellbeing
• a symptom diary that replaces a written log, although features that interpret the data can bring it into scope

Your words decide, not your code

This is where founders get caught. The MHRA says a medical purpose is set by what you state in your labelling, instructions and promotional material. It names adverts, your app store description, your landing page and your social media. It also warns that “simple changes to the description make the difference” between a device and not.

A disclaimer won’t rescue you. The guidance says “this product is not a medical device” isn’t acceptable if you make or imply medical claims elsewhere. Testimonials you repeat count as your claims too.

So write a one-paragraph intended purpose before you design anything. The MHRA’s guidance on crafting an intended purpose for software shows how specific it needs to be.

If it is a device

• You’re the manufacturer. The MHRA defines the manufacturer as whoever places the device on the market under their own name. That holds even if a third party designed and built it. Your developer isn’t the manufacturer; your company is.
• Class decides the route. Devices run from Class I, the lowest risk, to Class III. Most Class I devices can be self-declared. Higher classes need a UK approved body to assess them.
• Register before you sell. Every device must be registered with the MHRA before it’s placed on the Great Britain market. The MHRA’s fee is £300 per device category, from 1 April 2025.
• UKCA or CE. The MHRA’s guidance still lists 30 June 2030 as the latest date for accepting CE-marked devices. On 21 October 2026, the government confirmed it will keep accepting CE marking on a long-term basis. Check the current position before you pick a route.
• It doesn’t stop at launch. After launch, the manufacturer must monitor the product and report serious incidents to the MHRA.

What do DCB0129 and DCB0160 actually ask for?

They’re two halves of the same job. DCB0129 is for the company that makes health IT. It helps you show your product is clinically safe. DCB0160 is for the health or care organisation that deploys and uses it.

Both are published under section 250 of the Health and Social Care Act 2012. Anyone a standard applies to must comply with it. NHS England states plainly that compliance with both is mandatory.

Don’t assume that escaping the device rules means escaping DCB0129. They’re separate questions. NHS England says formal assurance is mandated for some products and advised for others, and points to an applicability tool for borderline cases.

The Clinical Safety Officer

Both standards need a named Clinical Safety Officer, or CSO. NHS England says the CSO must be a senior clinician with current registration with a professional body, such as the GMC or NMC. They also need sufficient training in clinical safety and clinical risk management.

If you’re a clinician-founder, that might be you, once you’re trained. If you aren’t, you’ll need to hire one or bring one in. Either way, they sign off the safety work, so involve them early.

The documents you’ll produce

• A clinical risk management plan: how you’ll run the safety process across the product’s life.
• A hazard log: a formal record of what could go wrong. NHS England says it covers each hazard, its potential clinical impact, the mitigations and controls, and the final risk assessment.
• A clinical safety case report: NHS England calls the safety case “a structured argument which is supported by a body of relevant evidence”. In plain terms, it’s your written case that the product is safe enough to use.

Your NHS customer does the DCB0160 side, but it leans on your DCB0129 documents to do it. NHS England notes that buyers can ask for this documentation, and DTAC asks for it too.

The current versions date from 2018. NHS England has started a review of both standards, and the DTAC page still lists them as under review. Build to today’s versions and watch for changes.

What does DTAC assess, and what changed in 2026?

DTAC, the Digital Technology Assessment Criteria, is the framework NHS and adult social care buyers in England use to check a digital health product. It covers five areas:

1. Clinical safety
2. Data protection
3. Technical security
4. Interoperability, meaning how well it connects to other NHS systems
5. Usability and accessibility

You, as the manufacturer, complete the form. NHS England says you should keep it up to date for each product version. Buyers such as trusts, GP practices, integrated care boards and care providers request it when they buy.

Version 2.0 arrived in February 2026

NHS England published DTAC version 2.0 in February 2026. The main changes:

• about 25% fewer questions
• less overlap with the DSPT and the pre-acquisition questionnaire for medical devices
• a scope aligned with NICE, focused on software-based digital health technologies

The old form shouldn’t be used from 6 April 2026. General-purpose software, such as HR or finance systems, is out of scope.

Two points save founders money. First, the NHS’s own developer guidance says DTAC is “not legally required”, but calls it “an essential activity”. It says to start at the concept stage. Second, NHS England doesn’t endorse any third-party DTAC certification schemes. Anyone selling you a “DTAC certificate” is selling you something the NHS doesn’t recognise.

Who needs the DSPT, and how often?

The Data Security and Protection Toolkit is an online self-assessment against the National Data Guardian’s 10 data security standards. In NHS England’s words, “All organisations that have access to NHS patient data and systems must use this toolkit.”

It’s yearly. The standard behind it says collection happens once a year, and failing to submit can lead to enforcement, which may include fines. The 2026–27 toolkit is version 9, with a deadline of 30 June 2027. It has its own set of requirements for IT suppliers.

Start it before you hold NHS patient data or connect to NHS systems. A pilot that goes live with real patient records needs it in place.

When can you use NHS login?

NHS login is for patient-facing health or social care services that are commissioned or sponsored by an NHS organisation. If a service has a commissioned part and a private part, only the commissioned part can use it.

NHS England’s team helps partners integrate at no financial charge, and says the process should take around three to four months. A subscription sold straight to patients won’t qualify. Our guide to NHS login eligibility walks through the commissioning rule and each stage.

Does the CQC apply to an app?

Usually not to the company that supplies the software. The NHS’s regulation service says: “It is the use of this technology that may be a regulated activity, rather than the supply of the technology.”

If an NHS provider uses your tool to diagnose, it may need to register, and you generally won’t. If your company delivers the care itself, that changes. The same guidance gives the example of a company making a diagnosis with AI and sending it to a referrer who doesn’t check it. That company must register.

What should you do, and when?

The pattern is simple. The cheap decisions sit at the top, and the expensive rework sits at the bottom if you skip them.

What drives the cost?

There’s no public price list for this work, and we won’t invent one. What we can tell you is what moves the bill:

• Device or not. This is the biggest swing. A Class I device can usually be self-declared. Anything higher needs an approved body’s assessment, plus registration fees of £300 per device category.
• Your CSO. A clinician-founder’s own time costs less in cash than a contracted CSO, but it still takes time.
• How much can go wrong. Every feature that could harm a patient adds hazards to log, mitigate and test.
• Evidence for DTAC. Security, interoperability and accessibility each need proof, not promises.
• The yearly cycle. The DSPT comes round every year, and each release means updating your safety documents.
• Retrofitting. Adding an audit trail or accessibility after launch costs more than designing it in.

For the build itself, our guide to what an app costs in the UK breaks down the main drivers.

What should you ask a development partner?

• Have you built health or care software that passed a DTAC assessment? Can we see the form?
• How will your build process feed our hazard log and safety case?
• Who on your team works with our CSO, and how often?
• How do you test accessibility, and to what standard?
• Where is our data hosted, and who can reach it?
• What will you give us for the DSPT and DTAC’s technical security section?
• Who owns the code, the accounts and the documents when you’re done?
• What happens to the safety work when we release an update?

A partner who can’t answer these in plain English will leave the paperwork to you, usually at the worst moment.

Where Contic fits

We don’t act as your CSO, and we don’t certify anything. We build the product, and the clinical sign-off stays with your CSO. The DSPT is yours to submit. We build the product so you can answer its technical questions about access, encryption and backups.

Everything we build meets WCAG 2.2 AA. We hold Cyber Essentials Plus and are registered with the ICO.

LaunchPad builds a first product at a fixed price, excluding VAT. Starter is £25k over two months, Growth £60k over three and Scale £100k over four. Discovery sets the exact scope. If you aren’t confident in the plan after Discovery, you get your money back. You own the code and IP. Any audit is done by an independent auditor, and that isn’t part of a LaunchPad price.

See the LaunchPad pricing, or read how we work with health and wellness teams. The first chat is free.