LMC Tech
Charity web platform
TimeOut Recovery
Three regional services, one platform: referral routing, resource library, regional editors and a signed data processing agreement, for a lived-experience gambling recovery service.
Our work / Case management system
Case Review Tracker
Small services run caseloads in spreadsheets and hope. Case Review Tracker replaces that with configurable review cycles, structured contact tracking, role-aware dashboards and automated reminders, on the customer's own server, with nobody at LMC Tech able to see a service user's name.
20
database tables, one instance per customer
8
default review templates, unlimited custom ones
4
role-aware dashboards: keyworker, team manager, organisation, service user
9
compliance documents shipped with the product
The brief
Never let a review go stale, never leak a name.
Keyworkers in recovery and support services carry caseloads with risk assessments, recovery plans and welfare checks on different cycles. Managers need to know who is overdue and who is overloaded without reading every file. And the data is as sensitive as it gets.
The design rule was that status is always derived from dates so it can never be wrong, and that the system holds as little as possible: no free-text case notes, no clinical records, no medication.
- Configurable review engine: interval, amber and second warnings, escalation, responsible role, mandatory flag and controlled outcomes. Defaults for risk assessment, recovery plan, CHIME, safeguarding, welfare, housing and benefits.
- Structured contacts: successful or attempted, method, outcome, worker, a 280-character note cap, with per-organisation amber, red and escalation thresholds.
- Dashboards for keyworkers, team managers and organisation managers, with CSV exports that are manager-only and always audited.
- Hourly reminder worker producing in-app notifications and content-free digest emails (counts and a sign-in link only), retried with backoff and logged.
- Mandatory TOTP multi-factor for managers and admins, bcrypt passwords, lockout, per-IP rate limiting, opaque UUIDs, and out-of-caseload records returning 404 rather than 403.
- Privacy mode: names encrypted at field level, reference numbers as the visible identifier, every name reveal audited. Platform admins have no service-user access; support mode is off by default, time-boxed and customer-enabled.
- Encrypted, integrity-checked nightly backups, a restore script, archive-by-default retention, and a health dashboard.
Under the bonnet
TypeScript end to end, Docker deployed, no third parties at runtime.
PostgreSQL 16, Node 22 with Express 5 in TypeScript, a pg-boss background worker, a React 18 and Vite front end, Caddy for automatic HTTPS and security headers, all in Docker Compose. AES-256-GCM for field encryption. No analytics, no external services once deployed.
It ships with a security overview, DPIA support pack, retention and deletion guide, incident response plan, access-control guide, privacy-notice template and deployment checklist, with an honest note that controls support UK GDPR compliance but do not constitute it.
- TypeScript
- Node 22
- Express 5
- React 18
- PostgreSQL 16
- pg-boss
- Caddy
- Docker
- TOTP MFA
- AES-256-GCM
What it shows
- Case management designed by people who have worked in services, not sold to them.
- Security and privacy as architecture: encryption, MFA, audit, isolation, all tested.
- Self-hosted per customer, so the data never sits in a shared cloud.
Published Android app
LODORi
A meditation app that writes and voices a personalised session in about 25 seconds. React Native, FastAPI, subscriptions, ads, safety checks, and a public release on Google Play.
AI social media manager
Social Jen
Give it one idea, a product photo or a video and it drafts, schedules and publishes to nine social networks, writes graded Etsy listings and renders your 3D models. Nothing goes out until you approve it.
Next step