The short answer
You can build and launch a healthcare or mental health app in the UK without any special licence to write the software. What you need is a product designed around five sets of rules: data protection, CQC registration scope, MHRA medical-device rules, professional registration, and — if you want NHS customers — NHS digital standards. Get the design right at the start and none of them block you. Get it wrong and each one becomes an expensive rebuild.
1. UK GDPR: health data is special category data
Anything about someone's physical or mental health is special category data. That raises the bar:
- A lawful basis and an Article 9 condition — for most consumer health apps, that means explicit consent captured and recorded properly.
- A Data Protection Impact Assessment (DPIA) before you launch. Processing health data at scale, especially with new technology such as AI, is exactly what DPIAs exist for.
- ICO registration — the annual data protection fee is modest for small organisations, and it's a legal requirement for most controllers.
- Security to match the risk: encryption in transit and at rest, role-based access, audit logs, and the ability to export and delete a person's data on request — bearing in mind that erasure rights are limited where practitioners must retain clinical records.
The engineering implication: build consent records, access control and deletion into the data model from day one. Bolting them on later means touching every table.
2. CQC: does your platform "carry on" a regulated activity?
The Care Quality Commission regulates providers of certain health activities — most relevantly treatment of disease, disorder or injury. CQC regulates England only: Scotland (Healthcare Improvement Scotland), Wales (Healthcare Inspectorate Wales) and Northern Ireland (RQIA) run their own registration. Two questions decide whether your platform is in scope:
- Who delivers the care? CQC's own guidance lists professions that are not included in that regulated activity — clinical psychologists among them. Counsellors and psychotherapists aren't listed professionals either. A service run by, or introducing clients to, those practitioners working independently generally doesn't need to register for it.
- Does the platform direct or supervise care? An introducer that matches clients to independent practitioners, who remain responsible for their own care, is a different thing from a provider that assigns clinicians, sets treatment protocols or supervises clinical work.
So a psychologist-matching platform in England can typically launch without CQC registration — but adding doctors (including psychiatrists), nurses, prescribing, mental-health social workers, or the platform itself employing or directing clinicians can move you into scope, as can a multi-disciplinary team that includes a listed professional. Operating a regulated activity without registration is an offence, so check your model against the guidance (or with a regulatory solicitor) before you add those features.
Checked against CQC's scope guidance, updated 27 August 2026.
3. MHRA: is your software a medical device?
Software can be a medical device in its own right if its intended purpose is medical — diagnosing, preventing, monitoring or treating a condition, or informing clinical decisions. That brings conformity assessment, registration and post-market surveillance.
The practical line for most health apps:
- Generally not a device: booking, directories, general wellbeing content, admin tools, and matching people to practitioners on their stated preferences — as long as the matching doesn't use symptoms, severity or clinical scores to decide urgency or level of care.
- Could be a device: symptom checkers, risk scores, triage that decides urgency or level of care, treatment recommendations, or AI that interprets clinical data.
MHRA publishes specific guidance on how digital mental health technology is qualified and classified — read it before you design any assessment or matching logic.
Your intended purpose is judged partly on what you say the product does — so product copy, app-store listings and AI outputs all need to stay on the right side of the line.
4. Professional registration: verify every practitioner
In the UK, titles such as clinical psychologist, counselling psychologist and practitioner psychologist are protected by law and require HCPC registration. Doctors are registered with the GMC and nurses with the NMC. "Psychologist", "counsellor", "psychotherapist" and "therapist" on their own are not protected titles — verify those practitioners against a register accredited by the Professional Standards Authority, such as BACP or UKCP. If your platform lists practitioners, check their registration before a profile goes live and re-check it periodically. It protects users, protects you, and is one of the strongest trust signals a health platform can show.
5. NHS standards — if the NHS is ever a customer
Selling into the NHS brings its own checks, including the Data Security and Protection Toolkit (DSPT) and the Digital Technology Assessment Criteria (DTAC), plus clinical safety standards for health IT. You don't need these to launch a private service, but designing to their principles early — good access control, audit, incident handling, documented clinical risk — keeps the NHS door open without a rebuild.
Safeguarding: design for the worst day
Mental health products in particular will meet people in crisis. Build crisis signposting (999; NHS 111, option 2 for mental health in England; Samaritans on 116 123) into intake flows so that crisis language triggers immediate help — never a place in a queue — and keep support links visible throughout.
Where AI fits safely
AI is genuinely useful in health products — turning free-text answers into structured preferences, summarising, drafting, ranking matches. Keep it safe by:
- limiting it to support, not diagnosis or treatment advice;
- making outputs explainable (why was this practitioner suggested?);
- processing sensitive text in UK/EU regions with providers that don't retain or train on your data;
- testing it with evaluations before launch, not after a complaint.
How we build health products at Softgen
We build UK health and mental health platforms with these rules engineered in — special category data handling, clinician verification, safeguarding flows and explainable AI — on a fixed price and date. Most start with a short Discovery Sprint that maps your model against the rules above before any code is written. See healthtech development or send us a brief.
This guide is a practical summary for planning, not legal advice.