Mobile App Development Company in Cambridge

Cost tracks scope. A scoped Cambridge mobile MVP runs ten to sixteen weeks on a single platform (iOS or Android) or React Native, covering design, build, App Store and Play Store submission, and a single backend integration. A full cross-platform production app adds multiple integrations (Open Banking, Veeva Vault, FHIR, Stripe), ICO DPIA, App Store policy compliance, accessibility (WCAG 2.2 AA), and where applicable MHRA SaMD documentation. Clinical apps add full DCB 0129 hazard logs, DCB 0160 clinical safety cases, and IEC 62304 Class B or C software lifecycle files. Cambridge rates sit a notch above Bristol and Manchester due to the ARM, AstraZeneca, and Microsoft Research talent premium, but stay below central London. Codazz proposals are fixed-fee against scope, not open time and materials.

Yes. For Cambridge medical device clients (CMR Surgical, Owlstone Medical, Cambridge Biomedical Campus spinouts) we run a full SaMD classification (Class I, IIa, IIb, III) under UK MDR 2002 as amended and the MDCG 2019-11 guidance. Documentation includes a clinical evaluation report, a DCB 0129 hazard log, a DCB 0160 clinical safety case, an IEC 62366-1 usability engineering file, an IEC 62304 software lifecycle file (Class A, B, or C), and an ISO 14971 risk management file. Apps deploy through Apple App Store and Google Play under the Medical category with the appropriate UKCA or CE marking. Backend infrastructure stays in AWS eu-west-2 or Azure UK South with all PHI inside UK borders. Addenbrooke's, Royal Papworth, and Cambridge University Hospitals NHS Foundation Trust accept this package as the basis for local clinical safety officer sign-off and DTAC submission.

Yes. We have built Open Banking apps under FCA authorisation routes including AISP (Account Information Service Provider) and PISP (Payment Initiation Service Provider) registration. We integrate the Open Banking Implementation Entity (OBIE) standards via TrueLayer (Cambridge-founded), Plaid UK, Yapily (Cambridge-area), or direct bank API integration. Documentation includes FCA Consumer Duty cross-cutting rules evidence, SYSC 8 outsourcing assessment, PSD2 strong customer authentication (SCA) implementation, and FCA SUP 16.22 transaction reporting where applicable. Apps deploy with biometric authentication, secure enclave or StrongBox key storage, certificate pinning, jailbreak and root detection, and runtime application self-protection (RASP). All inference and storage stays inside AWS eu-west-2 or Azure UK South. We have shipped this pattern for UK challenger banks and Cambridge-founded fintech startups.

Apple HealthKit and Google Health Connect both require explicit user consent on each data type, restrict background access, and impose App Store and Play Store review obligations specific to the Health and Medical categories. For Cambridge research apps under HRA and REC approval, we wire HealthKit and Health Connect into ResearchKit (iOS) and equivalent Android research frameworks, with consent flows aligned with HRA Integrated Research Application System (IRAS) approved documents and ICH E6 GCP electronic consent guidance. Data flows go through UK-resident backends in AWS eu-west-2 with FHIR R4 APIs for downstream EHR or trial master file integration. We document HealthKit and Health Connect data flows in the ICO DPIA, the HRA application, and the DCB 0129 hazard log. For ATMP cell and gene therapy companion apps we add MHRA Clinical Trial Authorisation (CTA) coordination and HTA tissue handling links.

We do both, and we will recommend the right one for your brief rather than the one we have spare capacity in. React Native (Expo SDK, Hermes, React Navigation, TanStack Query) is our default when the client has a React web codebase, when the team prefers TypeScript, or when over-the-air updates via EAS Update are valuable. Flutter (Dart 3, Riverpod, GoRouter) is our recommendation when pixel-perfect design control matters, when the app has heavy custom animations or charts, when the team has no React skill base, or when integrating with embedded hardware (Bluetooth LE, Matter, NFC) where Flutter's platform channels have been more stable. For ARM ecosystem partners shipping configuration utilities for embedded silicon, Flutter often wins. For Cambridge biotech building patient-facing trial apps, React Native often wins because of the existing web codebase. Native iOS and Android remain on the table for medical device apps where IEC 62304 Class C compliance is easier on a single platform.

Apple App Store and Google Play both maintain stricter review for Medical (Apple) and Health & Fitness and Finance (Google Play) categories, with frequent rejections for unclear consent, unsupported medical claims, or missing data deletion flows. We pre-empt this with a category policy review during discovery, a privacy nutrition label and Data Safety form aligned with the actual implementation, and an in-app account deletion flow that meets Apple's June 2022 requirement. For medical apps we add the App Store Medical category questionnaire response, MHRA UKCA mark documentation references, and clinical evidence summaries. For finance apps we add the FCA authorisation reference and Open Banking OBIE conformance certificates. We track rejection patterns from Apple's review team and Google's policy enforcement and adjust submissions accordingly, so Cambridge clients typically clear review on first or second submission rather than the four-to-six-cycle delays that hurt many UK launches.

Yes. For ARM-adjacent semiconductor partners, AstraZeneca-grade R&D IP, MoD-adjacent embedded software, or ATMP cell and gene therapy companion apps where data cannot leave UK-controlled infrastructure, we deploy backend services on UK-resident infrastructure with no third-party telemetry. Options include AWS eu-west-2 with VPC isolation and private endpoints, Azure UK South with private link, or bare metal on UK-based providers (Civo UK, Iomart, Pulsant) for clients with sovereign requirements. Mobile apps connect through certificate-pinned TLS, app-attest (iOS) or Play Integrity (Android) for client attestation, and where required a private VPN profile delivered through MDM (Jamf, Intune). All access is logged to a UK-resident SIEM (Splunk UK, Microsoft Sentinel EU). We have repeated this pattern for Cambridge Science Park silicon teams and Babraham Research Campus tenants.

Some mobile development qualifies for the merged UK R&D Expenditure Credit scheme (20 percent above-the-line credit), but plain mobile UI work generally does not. Eligible activity is the portion involving algorithmic uncertainty: custom Bluetooth Low Energy or Matter integration for ARM-adjacent silicon, novel offline-first sync for low-connectivity research deployments, on-device ML model integration (Core ML, TensorFlow Lite, MediaPipe), real-time signal processing for medical devices, or cryptographic implementation work. Routine UI, integration, and API calls do not qualify. We separate eligible R&D portions from routine build in our time logs, deliver technical narratives aligned with HMRC's CIRD guidance and the BEIS Frascati definition, and provide failed-hypothesis documentation where applicable. Cambridge biotech and medical device clients often stack Patent Box relief (10 percent effective corporation tax on qualifying IP profits) on the resulting platforms. Final eligibility sits with your R&D tax adviser and HMRC.