Skip to main content

https://digitalhealth.blog.gov.uk/2025/03/11/ohid-implementing-nhs-login-into-nhs-active-10-a-pilot-for-the-better-health-mobile-app-portfolio-alpha-assessment/

OHID Implementing NHS login into NHS Active 10: a pilot for the Better Health mobile app portfolio Alpha Assessment

Posted by: , Posted on: - Categories: Alpha, Assurance, Service assessments

From: DHSC
Assessment Date: 21/09/2023
Stage: Alpha
Result: Met
Service Provider: Office for Health Improvement and Disparities

Service description 

This service aims to support and motivate users to make positive behaviour changes to improve their health as part of the NHS Better Health mobile app portfolio.  

Active 10 is designed to support users to achieve evidence-based benefits of everyday moderate-intensity activity. It enables users to monitor brisk walking, set daily goals and find out how to increase physical activity levels. Activity targets are broken down into 10-minute bouts of brisk walking, called ‘active 10s’. Users are encouraged through various motivational features to make brisk walking a part of their daily routine, and complete as many Active 10s as possible. 

The Active 10 app is a live service, this alpha assessment is for the addition of an optional logged in state using NHS login to enable data portability, personalisation and data sharing across related apps and devices. 

Service users 

This service is for:

  • Active 10 core users: adults aged 40-60 C2DE 
  • Active 10 secondary users: all adults 20-40 and adults 60+  

Report contents

  1. Understand users and their needs
  2. Solve a whole problem for users
  3. Provide a joined-up experience across all channels
  4. Make the service simple to use
  5. Make sure everyone can use the service
  6. Have a multidisciplinary team
  7. Use agile ways of working
  8. Iterate and improve frequently
  9. Create a secure service which protects users’ privacy
  10. Define what success looks like and publish performance data
  11. Choose the right tools and technology
  12. Make new source code open
  13. Use and contribute to open standards, common components and patterns
  14. Operate a reliable service

1. Understand users and their needs

Decision 

The service met point 1 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team has used a good range of methods: survey and interviews in Discovery stage; moderated and unmoderated usability testing during Alpha 
  • the team has a good understanding of a range of personas across the ‘Better Health’ portfolio, motivators and different needs from a range of users 
  • the team has ensured there are good opportunities to use the data derived from adding an account, for example postcode or demographics to recommend more personalised content on the app and other services across the ‘Better Health’ portfolio, and beyond 
  • the team has allowed for more targeted communication and campaigns, a business need and goal that ultimately can help users discover services and hopefully meet needs around their health through access to email addresses

What the team needs to explore 

Before their next assessment, the team needs to: 

  • demonstrate user needs that relate specifically to the addition of an account to the Active 10 app. Similarly, explore personas that are more specific to this app. This also applies, in future, to work on the other apps in the portfolio
  • do more research with their key target audience. So far, the research presented is more generic, and little targeting of key groups has taken place 
  • do more research, service design and testing around two of the three themes, namely personalisation and customisation and data-sharing across digital and other services. How would this look? What needs is it meeting? How would it impact app usage and ultimately health outcomes? 
  • think of ways to measure the short and longer-term impact of having a logged-in state during private beta, for example by using methods such as A/B testing  

2. Solve a whole problem for users 

Decision 

The service met point 2 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team is clear where this feature sits in the overall Active 10 service journey 
  • the team is working in the open and has built a relationship with the NHS login team    
  • the team has thought about where a logged in state fits in the wider service journeys across the Better Health app portfolio  

What the team needs to explore 

Before their next assessment, the team needs to: 

  • do more research, design and testing of unhappy paths, with less engaged users, of risks and risky assumptions, including an exploration of: 
  • show how users, or potential users, without an NHS login or level P5 will react 

3. Provide a joined-up experience across all channels     

Decision 

The service met point 3 of the Standard.  

What the team has done well 

The panel was impressed that: 

  • the team has considered the offline parts of the service journey, for example the demo starts with QR code on poster in GP surgery 
  • the team has chosen NHS login rather than creating a new system for login 
  • the teams choice of NHS login process is nested within the Active 10 app     
  • the team has made sure the logged in state is optional, still allowing a more frictionless journey for those who don’t want to have a logged in state 

What the team needs to explore 

Before their next assessment, the team needs to: 

  • develop help, guidance or signposting for users without NHS login who might want to create an account 
  • ensure that as the service scales it does not become increasingly geared toward NHS login unless user needs dictate it would be beneficial for those affected  

4. Make the service simple to use 

Decision 

The service met point 4 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team has broadly followed tested design patterns and incorporated them well into the journey 
  • the team has done good work in mapping user journeys and creating hypothesis as to how logged in journeys should improve user experience  
  • the team has ensured that users are able to access the app with relative ease regardless of whether they use NHS login or not  

What the team needs to explore 

Before their next assessment, the team needs to: 

  • consider how different levels of user authentication affect specific user journeys from both a service design and an interaction design point of view  
  • keep considering how interfaces may be personalised over time using data as well as documented user needs to drive decision making from a feature perspective 
  • consider showcasing other personas. There was a focus on super-user persona’s during the service demo. While insightful, as the service scales they should consider showcasing other personas who may require additional support or motivation to engage with the service. It was stated that super-users make up a large percentage of the users affected by the addition of NHS-login; continue to test this hypothesis in beta as numbers scale   

5. Make sure everyone can use the service  

Decision 

The service met point 5 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team has broadly followed tested design patterns and incorporated them well into the journey  
  • the team has iterated designs over rounds of testing resulting in changes which appear to reduce cognitive load and improve user experiences  
  • the team has considered users from different backgrounds in their design decisions 
  • the team learned which designs made users feel they were being ‘forced to use NHS login’ through iterative design, and found a solution which presented it as an option rather than a necessity to users   

What the team needs to explore 

Before their next assessment, the team needs to: 

  • carry out accessibility research, in addition to an accessibility audit, ideally with people who have actual access needs, and covering the range of assistive tools recommended by GDS: https://www.gov.uk/service-manual/technology/testing-with-assistive-technologies 
  • conduct further research into the experiences of users who have low digital confidence and those who come from marginalised groups as they are may be more likely to face health inequalities when accessing services like this  
  • conduct further and more frequent usability testing of the service with a wide range of users with different needs  
  • maintain a consideration for users who do not wish to use NHS login ensuring that as many people are possible have a frictionless experience accessing Active 10 
  • continue to test the non-NHS style guide assets, such as the yellow icons, with a wide range of users and pivot accordingly if needed. The team explained that some legacy branding still exists and was reflected in the designs, but this should be revisited and rechecked with users 
  • ensure an external accessibility audit is carried out and that upcoming WCAG guidance is adhered to     

6. Have a multidisciplinary team 

Decision 

The service met point 6 of the Standard

What the team has done well 

The panel was impressed that:     

  • the team has access to all skills necessary in this stage and the flexibility to bring in additional capacity for subsequent stages 
  • the team actively uses Confluence as a knowledge store to mitigate the blended team of supplier and permanent staff 
  • the Alpha team is drawn from the live service team and is staying with the service through Beta 
  • the team already includes a full time Data Scientist to work on performance and metrics 

What the team needs to explore 

Before their next assessment, the team needs to: 

  • consider the addition of separate and more dedicated user research and design roles to reduce the ‘T’ shaped role fulfilled by the UX Designers  

7. Use agile ways of working 

Decision 

The service met point 7 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team is using standard agile sprints and ceremonies and standard tooling, for example, Jira and Confluence to work in an agile way 
  • the team is empowered appropriately and able to self-organise and prioritise their roadmap and backlog 
  • the team has well understood governance and clear links into wider planning and prioritisation    

8. Iterate and improve frequently 

Decision 

The service met point 8 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team identified the area for improvement, the logged-in state by regularly checking user feedback as part of the existing live service 
  • the team has iterated the value exchange design based on feedback from user research      

What the team needs to explore 

Before their next assessment, the team needs to: 

  • iterate more often. In Alpha designs were iterated just once in-between the moderated and unmoderated waves of research, the team should test more often 
  • iterate further based on user research and testing around the less ‘happy path’ journeys and for the less engaged personas     
  • have a plan, including recruitment strategies, for how data may be used in private beta to help measure the success of different iterations and any possible variations tested simultaneously for example using methods such as A/B testing

9. Create a secure service which protects users’ privacy 

Decision 

The service met point 9 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team is acquiring minimal PII (personally identifiable information) dataset from personal demographic service (PDS) 
  • the team has made use of FHIR API to acquire data from PDS, ensuring data is encrypted in motion 
  • the team has further reduced the risk by: 
  • the team is storing postcode at Local Authority (LA) level only 
  • the team is deriving age and storing age from date of birth 
  • the team has ensured that access to PII data is role based and to a non-human user 
  • the team has made use of database Technology where data in encrypted at rest 
  • the team has ensured PDS data store is a service and can be reused for all the other Better Health apps  
  • the team has ensured the OpenID Connect (OIDC) relying on service will be a reusable capability for all the other Better Health apps 
  • the team has ensured that PII data will not be shared with 3rd party apps like Google Fit 

What the team needs to explore 

Before their next assessment, the team needs to: 

  • research and apply appropriate cadence to refresh user’s PDS data  
  • consider creating a Better Health wide App ID that is unique across all Apps. This would simplify as well as provide a robust solution for managing activity data from various apps 
  • provide a shared responsibility model to ensure all stakeholders understand their roles and responsibilities for supporting this product   

10. Define what success looks like and publish performance data 

Decision 

The service met point 10 of the Standard. 

What the team has done well 

The panel was impressed that: 

  • the team has identified performance metrics to monitor the impact of implementing NHS login 
  • the team has metrics directly linked to service outcome. For Active10 this is users achieving the Chief Medical Officer recommendation of 150 minutes of moderate activity per week
  • the team has thought about data driven improvements possible because of implementing NHS login 
  • the team has thought about using a phased roll-out and using performance metrics to inform readiness to progress to the next stage     

What the team needs to explore 

Before their next assessment, the team needs to: 

  • undertake comparative modelling to monitor positive and negative impacts of implementing NHS login   
  • ensure that the new log-in parts of the onboarding journey are tagged to allow monitoring for uptake, drop-offs and attrition rate      

11. Choose the right tools and technology 

Decision 

The service met point 11 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team is introducing a single 1 new Redis AWS memory-based database for new capability, this a good fit as part of the overall AWS cloud-based backend solution 
  • the team has ensured that Redis will become a key reuseable component when this pilot is extended to other Better Health apps 
  • the team is re-using current technology set that is established and stable 
  • the team is ensuring consistent branding across all Better Health App   

What the team needs to explore 

Before their next assessment, the team needs to: 

  • make a business case for PDS data to be accessible at source thus minimising the need for creating a local copy of the dataset  
  • provide detailed data flow diagram with technologies that under pin the data store and data flow 
  • provide details of API’s used to manage data   

12. Make new source code open 

Decision 

The service did not meet point 12 of the Standard 

What the team needs to explore 

Before their next assessment, the team needs to: 

  • make all code open   
  • as part of making code open, provide all the associated design and support documents so that the code can be reused  
  • provide compelling reasons for any code that is kept closed       

13. Use and contribute to open standards, common components and patterns 

Decision 

The service met point 13 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team are using WCAG 2.1, and are planning to transition to WCAG 2.2 
  • the team are using FHIR API       
  • the team has ensured all new capabilities are developed as reusable components that would be re-used by other Better Health Apps  

What the team needs to explore 

Before their next assessment, the team needs to: 

  • consider creating microservices to enable rapid deployment of new campaigns using PDS datastore
  • explore NHS content standards as this App will be underpinned by NHS brand   

14. Operate a reliable service 

Decision 

The service met point 14 of the Standard

What the team has done well 

The panel was impressed that: 

  • the team is reusing existing stable cloud based Technologies     
  • the team has steps in place to spot and stop potential denial of service (DoS) attacks 
  • the team has thought about the need for monitoring and alerting for unexpected peak load 
  • the team has performed load and stress testing 
  • the team's design ensures that App is useable when dependant service like NHS login may not be available. Also, activity data will be synchronised with the user when NHS login is available again 
  • the team has identified key performance indicators (KPIs) to proactively monitor the performance  

What the team needs to explore 

Before their next assessment, the team needs to: 

  • consider regular penetration testing to ensure all vulnerabilities around PII data are identified and managed 
  • provide a support plan that includes team makeup and skills required to support the platform. The plan should include any training that may be needed to support the App as well as backend underpinning the App
  • ensure the new capabilities are scalable to ensure other Better Health Apps can use them without impacting reliability and performance of this App  
     

Sharing and comments

Share this page

Leave a comment

We only ask for your email address so we know you're a real person

By submitting a comment you understand it may be published on this public website. Please read our privacy notice to see how the GOV.UK blogging platform handles your information.