For NHS Trusts, ICBs & VCSE waiting-list providers
Nobody should wait in silence.
Holdfast is a digital care-management layer for people waiting for NHS mental health, ADHD and autism assessment. It collects structured check-ins while someone waits, scores the risk against explainable clinical rules, and escalates automatically to a named support worker or clinician the moment it matters - with every step written to an audit trail.
The waiting list is a clinical blind spot
1.7m
people currently waiting for NHS mental health treatment in England
8 years
average wait for an adult ADHD diagnosis in some areas
8%
of waitlisted patients in research were satisfied with what they were given to manage the gap - many received nothing at all
Deterioration during the wait drives crisis presentations, re-referrals and higher-acuity, costlier treatment once someone finally reaches the front of the queue. Support workers doing phone-based waitlist outreach do excellent work, but without a way to prioritise, one worker's caseload can only stretch so far before someone quietly slips through. Holdfast is the operational layer that risk-stratifies a waiting list automatically, so a fixed number of staff can safely cover more people - and the people who are deteriorating get found sooner, not by chance.
How it fits into how the NHS is actually organised
Holdfast isn't a generic form builder bolted onto a spreadsheet - it mirrors the real structure of commissioning and delivery: a Trust runs the platform, an ICB commissions the service, and clinical teams hold their own caseloads within it. Every layer is a hard data boundary, not just a filter.
England currently has 36 ICBs across the 7 NHS England regions - down from an initial 42 as neighbouring boards consolidate. Some ICBs share a management team while remaining separate statutory bodies; Holdfast still treats each one as its own commissioning boundary, matching the accountability and data-sharing agreements a funder actually holds, rather than collapsing a shared back office into a single tenant. A platform administrator can stand up a new Trust, its ICBs and clinical teams, and invite staff in minutes - not a multi-week integration project.
Nothing starts without consent. Every patient grants their own explicit, versioned, withdrawable consent before a single check-in begins - and equity-monitoring fields (ethnicity, gender identity) are optional, separately consented, and small-number-suppressed in every report.
Built pathway by pathway, not just for one waiting list
Mental health waiting lists get the most attention, but ADHD, autism, older-adult memory services and trauma assessment routes often wait just as long and have the least structured contact of all - mostly paper screening forms posted out and scored by hand. Holdfast collects the standard, published screening questionnaires and PROMs services already use, digitally, with results routed straight to the assessing clinician.
Mental health
CORE-10, WSAS, AUDIT-C and PHQ-9/GAD-7-style distress, functioning and alcohol-use measures on a regular check-in cadence.
Adult ADHD
ASRS screening, digitally captured, with the same risk-monitoring loop while someone waits years for assessment.
Child ADHD
SNAP-IV, completed by a parent or carer through their own login - scoped to exactly the one patient they support.
Autism
AQ-10 in its adult, adolescent and child variants, again with carer-completed options where the instrument calls for it.
Older adult & memory services
6-CIT cognitive screening and a DAST-10 comorbidity check, plus GDS-15 depression tracking on a regular cadence - built for the memory-service backlog, not just working-age pathways.
Trauma & PTSD
TSQ for a quick triage flag, or PCL-5 where full severity detail is needed - the clinician picks per patient - alongside the same DAST-10 comorbidity screen.
For a commissioner, this turns "we don't have visibility of the ADHD/autism backlog" into a reportable, waiting-list-by-pathway figure sitting alongside the general mental-health numbers they already produce - and the same is now true for memory-service and trauma waits. See how a carer completes a check-in on a child pathway, or how a clinician raises a one-off screener outside the regular cadence.
Something back, not just another form to fill in
Every check-in asks a patient for something. Waiting Well gives something back: a short, pathway-specific panel on their home screen linking to NHS-approved self-help resources for mental health, ADHD or autism - picked for the wait they're actually on, not a generic list.
Once someone has waited past their pathway's NHS Right to Choose review threshold, Holdfast flags it on the caseload screen and gives staff a plain-language signposting panel on the case page - explicitly not clinical or legal advice, just NHS-sourced information a support worker can share with confidence. If a patient does transfer to another provider, that's recorded as its own outcome, not folded into a generic "discharged", so a service's waiting-list-by-pathway reporting keeps telling the truth about where people actually went - and the risk history built up over weeks of check-ins isn't simply lost. See the full Right to Choose & transfer flow.
A patient can switch the check-in to an easy-read mode - shorter sentences, plainer wording, bigger touch targets - and complete it in Welsh, French, Spanish, German or Polish as well as English, so language or cognitive load never becomes the reason someone stops responding.
A longer instrument like the 26-item SNAP-IV or the ASRS and AQ-10 screeners doesn't have to be finished in one sitting. Save and finish later autosaves progress as a patient or carer answers, and a reminder card on their home screen - web and app alike - flags anything left unfinished, so picking it back up is one tap, not starting over.
First time in, a short, skippable introduction explains what a check-in is and who sees it - not a login screen with no context. And because this sits on a phone that's sometimes shared or left unattended, the app defaults to asking for Face ID, a fingerprint or a device passcode before it reopens - the same "ask before it shows anything" principle as the crisis support panel that's never more than a scroll away.
One view, risk-sorted, across every pathway
A support worker or clinician opens their caseload and sees exactly who needs them next - filtered by RED/AMBER/GREEN risk, by pathway, and by whether someone's gone quiet on their check-ins. No spreadsheet, no manual triage, no guessing who to call first.
Security and compliance evidence, built in from day one
A system that scores clinical risk and holds patient data has to earn its place in an NHS environment before it earns its place in a clinical workflow. Rather than treating compliance as paperwork bolted on before go-live, Holdfast maps its technical controls directly to the frameworks NHS procurement and information-governance teams actually assess against, and surfaces the live evidence in-product for an Admin to review at any time - not just in a one-off PDF submitted at contract signing.
DTAC
The Digital Technology Assessment Criteria is the standard NHS gate for any digital health tool. Holdfast's controls are tagged against DTAC's clinical safety, data protection, technical security, interoperability and usability/accessibility sections, so an assessor can trace every requirement to the control that satisfies it.
DSPT
The Data Security and Protection Toolkit is the annual self-assessment every organisation handling NHS patient data must complete. Holdfast's audit logging, authentication controls and tenant isolation are designed to give an onboarded Trust or ICB the evidence its own DSPT submission needs, rather than leaving that work to be reconstructed after the fact.
Cyber Essentials Plus
CE+ certification - independently verified, not self-assessed - is treated as a pre-launch gate: required before any real patient data is processed, not an afterthought. The underlying controls (patching, access control, firewalling, malware protection) are designed in from the start so certification is a verification step, not a redesign.
PCREF
The Patient and Carer Race Equality Framework expects providers to evidence whether services reach all communities fairly, not just aggregate throughput. Ethnicity and gender identity are patient-supplied, optional and separately consented, and the commissioner-facing report breaks engagement and escalation outcomes down by ethnicity, gender and age band - with any group under 5 patients automatically withheld rather than shown as a small, re-identifying number.
Live control evidence, not a claim in a slide deck
An Admin can see exactly which controls are active today - authentication logging, brute-force protection, and a full application audit trail - and which are queued for the platform, such as multi-factor authentication, network-layer rate limiting, and infrastructure-level logging and threat detection. Nothing is marked done that isn't actually done. On the patient app specifically, jailbreak/root detection and a Face ID/fingerprint/passcode app lock sit in front of the check-in data itself, not just the account behind it.
Every patient, referral, check-in and escalation state change - consent granted or withdrawn, a safety plan updated, a carer added or removed, an escalation raised, acknowledged or resulting in a Mental Health Act assessment referral - is written to an immutable audit log, with who did it and when. That log is exactly what a Clinical Safety Officer needs for DCB0129 hazard review, and what an information-governance lead needs when something has to be reconstructed after the fact. See exactly what gets written to that log when a check-in escalates.
Clinical safety and information security are kept separate on purpose. The Clinical Safety Officer's DCB0129 hazard log and safety-case evidence is a distinct, read-only view from the Admin's infosec dashboard - matching how real NHS Trusts split clinical governance from IT security, rather than forcing one account to hold both.
Who it's for, and what each seat actually sees
Support worker
Owns a caseload of named patients, manages carer contacts, and is first responder when someone is escalated.
Clinician
Reviews escalations, sets check-in cadences, requests screeners, and authors safety plans for their team's patients.
Admin
Manages teams and staff accounts across an ICB, with visibility of the audit trail and security evidence.
Clinical Safety Officer
A distinct, read-only ICB-wide seat reviewing the hazard log and safety-case evidence - matching real DCB0129 duties.
Commissioner
Read-only, aggregate outcomes and waiting-list-by-pathway reporting - never patient-identifiable data.
Patient & carer
A short, private check-in on their phone or a browser; a carer's login is scoped to exactly the one patient they support.
Why this exists
Holdfast was built by a developer who has worked in the mental health sector, and who has also sat on the other side of the desk. During a course of CBT, that meant filling in a PHQ-9 and a GAD-7 questionnaire, week after week, watching the numbers move (or not) long before anyone else in the system had visibility of them. Right now, it also means being on an NHS adult ADHD waiting list, with no structured contact in between the referral and whatever comes next - just silence, and a wait measured in years rather than weeks.
Both of those experiences point at the same gap: the tools patients fill in already exist, and they're genuinely useful - the problem is nobody on the clinical side sees the pattern until the next appointment, which might be months away. Holdfast exists to close that gap: keep using the questionnaires services already trust, but route them somewhere that can act on a change in real time, and give the people doing that work a way to know who needs them most, today, not next quarter.
Get in touch
Commissioning a mental health, ADHD or autism waiting-list service and want to see how Holdfast would fit your teams? We'd like to hear from you.
contact@c-cook.com