Safe Play

Safe Play is a clinical-grade digital health platform designed to modernize sexual health verification and reduce STI transmission rates through verified trust. It bridges the gap between private behavior and public health data by allowing users to share their latest "Clear" STI status with partners via a secure, one-time-use QR code.
What the Business Does
Safe Play transforms the sexual health journey from a manual, anxiety-inducing process into a seamless digital experience:

Verified Integration: It pulls real-time pathology data directly from NHS labs using HL7 FHIR standards and NHS Login (P9 identity assurance). It is not "self-reported"—it is clinically verified.
The "6-Month Rule": To prevent the sharing of stale data, the app automatically hides results older than six months, incentivizing regular testing.
Zero-Knowledge Verification: Users generate a 5-minute, anti-fraud QR code. When a partner scans it, they see a "Verified Clear" status on their own device without any sensitive data being stored, screenshotted, or exchanged.
The Rewards Hub: It gamifies public health. Users earn "Play Points" for testing, completing educational modules, and breaking transmission chains. These points are redeemable at commercial partners like Boots, PureGym, and Uber.
Commissioner Dashboard: It provides NHS Integrated Care Boards (ICBs) with anonymized heatmaps of uptake and "transmission chains broken," proving ROI in real-time.

Why an Acquirer Should Buy Safe Play
Safe Play is not just an app; it is a turnkey enterprise that has already cleared the highest hurdles in the UK health-tech market.

High Barrier to Entry (Cleared Regulatory Hurdles)
The most significant "moat" for any NHS health-tech business is regulatory compliance. Safe Play is Audit-Ready:

Clinical Safety: Full DCB0129 compliance with a finalized Clinical Safety Case Report (CSCR) and Hazard Log.
Security & Privacy: DTAC-mapped, GDPR-compliant (DPIA complete), and ready for DSPT certification.
Procurement: Already has a G-Cloud 14 Service Definition, meaning it can be "bought off the shelf" by any UK government body.

The technical setup for Safe Play is designed to be a "turnkey" process using modern DevOps practices. Below are the specific instructions for the buyer's engineering team to spin up a fresh production-grade instance.

Infrastructure Provisioning (Terraform)

The entire stack is managed via Infrastructure as Code (IaC) to ensure consistency and speed of deployment.

Target Environment: AWS (Recommended Region: eu-west-2 for UK data residency).
Prerequisites: Terraform CLI installed, AWS CLI configured with administrative access.
Action:
Navigate to /infra/terraform.
Run terraform init and terraform apply.
This will provision:
Amazon ECS (Fargate): For the Node.js/Express backend.
Amazon RDS (PostgreSQL): Multi-AZ, encrypted at rest via KMS.
AWS WAF & Shield: For DDoS and SQL injection protection.
Amazon ElastiCache (Redis): For high-speed session management.
2. Environment Secrets & Configuration

The application requires several sensitive keys and configuration strings, which should be stored in AWS Secrets Manager.

NHS Login (OIDC) - Mandatory

OIDC_ISSUER: The NHS Login endpoint (Sandbox: https://auth.sand.signin.nhs.uk/).
OIDC_CLIENT_ID: The unique ID provided to you by NHS Digital.
OIDC_CLIENT_SECRET: The secure secret provided by NHS Digital.
OIDC_REDIRECT_URI: Must match the URI registered in the NHS Digital developer portal.
Clinical Data Integration (FHIR)

FHIR_BASE_URL: The endpoint for the pathology data provider.
FHIR_API_KEY: Authentication key for the lab API.
mTLS_CERT_THUMBPRINT: The thumbprint of the client certificate required for production NHS Spine access.
Security & Encryption

KMS_KEY_ID: The ARN of the AWS KMS key used for field-level encryption of clinical results (Observations) in the database.
JWT_SECRET: A high-entropy string used for signing internal session tokens.
3. Database Initialization

Safe Play uses Field-Level Encryption to protect sexual health data.

Initialize the schema using /backend/db/init.sql.
The application uses knex for migrations. On first deploy, the ECS task will automatically run npm run migrate.
Important: The ECS Execution Role must have kms:Encrypt and kms:Decrypt permissions for the KMS_KEY_ID specified in your environment.
4. Frontend Deployment (Next.js)

The mobile experience is a Next.js application that can be deployed via AWS Amplify or Vercel.

CI/CD: The repository includes GitHub Actions workflows.
Build-time Variable: NEXT_PUBLIC_API_URL must point to your newly provisioned ECS load balancer URL.
5. Compliance & Regulatory Handover (Manual Step)

To go live in the UK, the new owner must:

Appoint a Clinical Safety Officer (CSO): Update and re-sign the CSCR.md (Safety Case Report).
Update the DPIA: Change the "Data Controller" information in the DPIA_DRAFT.md to the new legal entity.
DSPT Submission: Complete the annual NHS Data Security and Protection Toolkit submission using the evidence provided in the DTAC_EVIDENCE.md file.
A comprehensive technical manual is available at /home/team/shared/development/TECHNICAL_HANDOVER_SPEC.md

Overview

Mission

The team

Setup