DRAFT - PWS - Mental Health Mobile Apps.docx

Mental Health Mobile Apps Design, Development, and Research Support

VA-26-00048712

PERFORMANCE WORK STATEMENT (PWS)

DEPARTMENT OF VETERANS AFFAIRS

National Center for Posttraumatic Stress Disorder (NCPTSD) Dissemination and Training Division

Mental Health Mobile Apps Design, Development, and Research Support

Date: July 1, 2026

VA-26-00048712

PWS Version Number: 1.0

Contents

BACKGROUND

The U.S. Department of Veterans Affairs (VA), National Center for Posttraumatic Stress Disorder (PTSD), Dissemination and Training Division (NCPTSD) is responsible for creating training and educational products to support evidence-based care of Veterans with PTSD and related problems. PTSD is very common among Veterans and has a significant impact on Veterans’ quality of life. Most Veterans with PTSD do not access evidence-based treatments for PTSD, and many Veterans are either unable or choose not to access available mental health services of any kind. Lack of available services, distance from clinics, and stigma associated with mental health care are just a few of the barriers to providing care for Veterans and those living with a Veteran with PTSD. The rapid transition to telehealth in recent years has also greatly increased the burden on VA providers to offer mobile tools and services to support delivery of evidence-based telehealth. NCPTSD has developed mobile phone applications (apps) to overcome these and other barriers to care. The apps are designed to assist Veterans and their family members with understanding PTSD and related problems, tracking their improvement over time, obtaining support and resources, and managing symptoms using a variety of brief relaxation/stress coping tools.

NCPTSD has developed a variety of mobile applications in the past fifteen years, including, most notably, the multi-award winning PTSD Coach (Winner of the Advancements in Accessibility Award from the Federal Communications Commission 2011 and Winner of the President’s Innovation Award from the American Telemedicine Association 2012). NCPTSD currently maintains a portfolio of 37 mobile apps (e.g., PTSD Coach, Cognitive Behavioral Therapy for Insomnia (CBTI) Coach, Mindfulness Coach, Prolonged Exposure therapy (PE) Coach, Stay Quit Coach), that have been downloaded over 5 million Veterans and others. Each mobile app aims to address specific implementation challenges faced by Veterans and their family members in receiving education, training, and treatment.

In addition to these public-facing apps, NCPTSD also develops and maintains a suite of research applications that support active and ongoing research on the public-facing apps. These apps currently support over two dozen clinical trials and 463 investigators. Each of these research apps are kept up-to-date with its corresponding public app and are vital to the development and innovation of evidence-based treatments for PTSD and its symptoms.

The NCPTSD has also been charged with 1) ensuring that NCPTSD mobile apps are capable of supporting scientific research and 2) being capable of responding to the needs of Veterans, VA providers, and other stakeholders. To meet this charge, NCPTSD has a multi-phase coordinated research program to study the usability, efficacy, and implementation of these applications and works directly with Mental Health Services in VA Central Office to ensure that products are aligned with the mission to enhance and optimize mental health care for Veterans.

APPLICABLE DOCUMENTS

In the performance of the tasks associated with this Performance Work Statement, the Contractor shall comply with the following:

1. “Federal Information Security Modernization Act of 2014”

2. Federal Information Processing Standards (FIPS) Publication 140-3, “Security Requirements for Cryptographic Modules”, March 22, 2019

3. FIPS Pub 199. “Standards for Security Categorization of Federal Information and Information Systems,” February 2004

4. FIPS Pub 200, “Minimum Security Requirements for Federal Information and Information Systems,” March 2006

5. FIPS Pub 201-3, “Personal Identity Verification of Federal Employees and Contractors,” January 2022

6. 10 U.S.C. § 2224, "Defense Information Assurance Program", as amended

7. 5 U.S.C. § 552a, as amended, “The Privacy Act of 1974”

8. Public Law 109-461 (P.L. 109-461), Veterans Benefits, Health Care, and Information Technology Act of 2006, as amended, Title IX, Information Security Matters

9. 42 U.S.C. § 2000d “Title VI of the Civil Rights Act of 1964”, as amended

10. VA Directive 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

11. VA Handbook 0710, “Personnel Vetting Program,” September 8, 2025, https://www.va.gov/vapubs/index.cfm

12. VA Directive 6102, “Internet/Intranet Services,” August 5, 2019

13. 36 C.F.R. Part 1194 “Information and Communication Technology Standards and Guidelines,” as amended

14. Office of Management and Budget (OMB) Circular A-130, “Managing Federal Information as a Strategic Resource,” July 28, 2016

15. 32 C.F.R. Part 199, “Civilian Health and Medical Program of the Uniformed Services (CHAMPUS)”, as amended

16. NIST SP 800-66 Rev. 2, “Implementing the Health Insurance Portability and Accountability Act (HIPAA) Security Rule: A Cybersecurity Resource Guide,” February 2024

17. 45 C.F.R Parts 160 and 164, Subparts A and E, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 C.F.R. Parts 160 and 164, Subparts A and C, the Security Standard (“Security Rule”); as amended

18. Sections 504 and 508 of the Rehabilitation Act (29 U.S.C. § 794d), as amended

19. Homeland Security Presidential Directive (12) (HSPD-12), August 27, 2004

20. VA Directive 6500, “VA Cybersecurity Program,” February 24, 2021 (see VA NOTICE 24-18, dated September 27, 2024, “Update to VA Directive 6500 Cybersecurity Program”, and VA Notice 25-07, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”)

21. VA Handbook 6500, “Risk Management Framework for VA Information Systems VA Information Security Program,” February 24, 2021 (see VA Notice 25-01, dated October 15, 2024, “Update to VA Handbook 6500 Risk Management Framework for VA Information Systems VA Information Security Program”, and VA Notice 25-06, dated 3/18/25, “Amending VA Directive 6500 to incorporate M-24-15”, VA Notice 25-16, dated September 15, 2025, “Amending VA Handbook 6500 to Replace Enterprise Mission Assurance Support Services Tool With Office of Information Technology Governance Risk Compliance Tool, and VA Notice 25-17, dated September 22, 2025, “Rescission Of Office Of Information Security (OIS) Deputy Assistant Secretary (DAS) Memorandum – Requirements of Proper Plan of Action and Milestones (POA&M) Completion)

22. VA Handbook 6500.2, “Management of Breaches Involving Sensitive Personal Information (SPI),” June 30, 2023

23. VA Handbook 6500.6, “Contract Security,” March 12, 2010 (see VA Notice 24-12, dated April 22, 2024, “Update to VA Handbook 6500.6, Contract Security, Appendix C VA Information and Information System Security/Privacy Language For Inclusion Into Contracts, As Appropriate”)

24. VA Handbook 6500.8, “Information System Contingency Planning,” March 25, 2025

25. VA Handbook 6500.10, “Mobile Device Security Policy,” February 15, 2018 (see VA NOTICE 25-10, dated June 9, 2025, “Use of Personally Owned Mobile Devices Policy Amendment of Department of Veterans Affairs Handbook 6500.10”, and VA Notice 25-15, dated August 22, 2025, “Update to VA Handbook 6500.10 Mobile Device Security Policy”)

26. VA Handbook 6500.11, “VA Firewall Configuration,” August 22, 2017

27. OIT Process Asset Library (PAL), OIT Process Asset Library.

28. One-VA Technical Reference Model (TRM) (reference at https://www.va.gov/trm/TRMHomePage.aspx)

29. VA Directive 6508, “Implementation of Privacy Threshold Analysis and Privacy Impact Assessment,” October 15, 2014

30. VA Directive 6510, “VA Identity, Credential and Access Management,” September 3, 2024

31. VA Handbook 6510, “VA Identity, Credential and Access Management,” September 27, 2024

32. VA Directive and Handbook 6513, “Secure External Connections,” October 12, 2017

33. VA Directive 6300, “Records and Information Management,” September 21, 2018

34. VA Handbook, 6300.1, “Records Management Procedures,“ March 24, 2010

35. NIST SP 800-37 Rev 2, “Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy,” December 2018

36. NIST SP 800-53 Rev. 5, “Security and Privacy Controls for Federal Information Systems and Organizations,” September 23, 2020 (includes updates as of 12/10/2020)

37. VA Directive 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” October 26, 2015

38. VA Handbook 0735, “Homeland Security Presidential Directive 12 (HSPD-12) Program,” March 24, 2014

39. OMB Memorandum 05-24, “Implementation of Homeland Security Presidential Directive (HSPD) 12 – Policy for a Common Identification Standard for Federal Employees and Contractors,” August 5, 2005

40. OMB Memorandum M-19-17, “Enabling Mission Delivery Through Improved Identity, Credential, and Access Management,” May 21, 2019

41. OMB Memorandum, “Guidance for Homeland Security Presidential Directive (HSPD) 12 Implementation,” May 23, 2008

42. Federal Identity, Credential, and Access Management (FICAM) Architecture, June 30, 2023 (FICAM Architecture (idmanagement.gov))

43. NIST SP 800-116 Rev 1, “Guidelines for the Use of Personal Identity Verification (PIV) Credentials in Facility Access,“ June 2018

44. NIST SP 800-63 Rev 4, 800-63A-4, 800-63B-4, 800-63C-4, “Digital Identity Guidelines,” August 1, 2025

45. NIST SP 800-157, “Guidelines for Derived PIV Credentials,” December 2014

46. VA Memorandum, VAIQ #7100147, “Continued Implementation of Homeland Security Presidential Directive 12 (HSPD-12),” April 29, 2011 (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

47. IAM Identity Management Business Requirements Guidance document, May 2013, (reference Enterprise Architecture Section, PIV/IAM (reference https://www.voa.va.gov/documentlistpublic.aspx?NodeID=514)

48. VA Memorandum “Personal Identity Verification (PIV) Logical Access Policy Clarification,” July 17, 2019, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4896

49. Trusted Internet Connections (TIC) 3.0 Core Guidance Documents, https://www.cisa.gov/publication/tic-30-core-guidance-documents

50. OMB Memorandum M-19-26, “Update to the Trusted Internet Connections (TIC) Initiative,” September 12, 2019

51. OMB Memorandum M-08-23, “Securing the Federal Government’s Domain Name System Infrastructure,” August 22, 2008

52. Sections 524 and 525 of the Energy Independence and Security Act of 2007, (P.L. 110–140), December 19, 2007

53. Section 104 of the Energy Policy Act of 2005, (P.L. 109–58), August 8, 2005

54. Executive Order 13221, “Energy-Efficient Standby Power Devices,” August 2, 2001

55. Executive Order 14148, “Initial Rescissions of Harmful Executive Orders and Actions,” dated January 20, 2025

56. VA Directive 0057, “VA Environmental Management Program,” October 25, 2022

57. OIS VAIQ #7424808 Memorandum, “Remote Access,” January 15, 2014, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

58. Clinger-Cohen Act of 1996, 40 U.S.C. §11101 and §11103

59. “Veteran Focused Integration Process (VIP) Guide 4.0,” March 2021, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4371

60. VA Memorandum “Proper Use of Email and Other Messaging Services,” January 2, 2018, https://www.voa.va.gov/DocumentListPublic.aspx?NodeId=28

61. “Product Line Management Transformation Playbook” version 3.1, August 2023, https://www.voa.va.gov/DocumentView.aspx?DocumentID=4946

62. NIST SP 500-267B Revision 1, “USGv6 Profile,” November 2020

63. OMB Memorandum M-21-07, “Completing the Transition to Internet Protocol Version 6 (IPv6),” November 19, 2020

64. Social Security Number (SSN) Fraud Prevention Act of 2017

65. Section 240 of the Consolidated Appropriations Act (CAA) 2018, March 23, 2018

66. C.F.R Title 15 Part 7, “Securing the Information and Communications Technology and Services (ICTS) Supply Chain”, as amended

67. Executive Order 14028, “Executive Order on Improving the Nation's Cybersecurity,” May 12, 2021, https://bidenwhitehouse.archives.gov/briefing-room/presidential-actions/2025/01/16/executive-order-on-strengthening-and-promoting-innovation-in-the-nations-cybersecurity/

68. OMB Memorandum M-22-09, “Moving the U.S. Government Toward Zero Trust Cybersecurity Principles”, January 26, 2022, https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf.

69. NIST SP 800-52 Revision 2, “Guidelines for the Selection, Configuration, and Use of Transport Layer Security (TLS) Implementations

70. OMB M-26-05, “Adopting a Risk-based Approach to Software and Hardware Security,” January 23, 2026

71. OMB M-21-31, “Improving the Federal Government’s Investigative and Remediation Capabilities Related to Cybersecurity Incidents,” August 27, 2021

72. NIST SP 800-88 Revision 1 “Guidelines for Media Sanitization,” December 2014

73. CISA Binding Operational Directive (BOD) 19-02: “Vulnerability Remediation Requirements of Internet-Accessible Systems,” April 29, 2019, BOD 19-02: Vulnerability Remediation Requirements for Internet-Accessible Systems | CISA

74. CISA BOD 22-01: “Reducing the Significant Risk of Known Exploited Vulnerabilities,” November 3, 2021, BOD 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities | CISA

75. CISA BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks.” Cybersecurity & Infrastructure Security Agency (CISA), BOD 23-01: Improving Asset Visibility and Vulnerability Detection on Federal Networks | CISA

76. VA Directive 6550, Pre-Procurement Assessment and Implementation of Medical Devices/Systems, June 03, 2019

77. VA Memorandum, “VA Security Controls,” January 17, 2025, https://www.voa.va.gov/DocumentView.aspx?DocumentID=5010

78. E.O. 13960, “Promoting the Use of Trustworthy Artificial Intelligence in the Federal Government,” December 3, 2020

79. E.O. 14319, “Preventing Woke AI in the Federal Government,” July 23, 2025

80. OMB Memorandum M-25-21, “Accelerating Federal Use of AI through Innovation, Governance, and Public Trust,” April 3, 2025

81. OMB Memorandum M-25-22, “Driving Efficient Acquisition of Artificial Intelligence in Government,” April 3, 2025

82. OMB Memorandum M-26-04, “Increasing Public Trust in Artificial Intelligence (AI) Through Unbiased AI Principles,” December 11, 2025

SCOPE OF WORK

The Contractor shall provide project management, continue to host, maintain, and support the Vertical Design developed solution, maintain the existing portfolio of mobile apps, and the continued integration of mobile apps with the solution. This includes developing new and updating mobile apps and integrating them into the Vertical Design solution as part of the support services.

The Contractor shall:

1. Continue the hosting, maintenance, and support of the cloud-based Vertical Design LLC solution to ensure uninterrupted access to the usage data (and collection of new data) by VA researchers and care providers in support of currently funded clinical care and research trials.

2. Develop research-enabled versions of NCPTSD mobile apps.

3. Maintain existing mobile apps and research capabilities previously built for NCPTSD, in order to provide reliable, high-quality mental health service to Veterans, their families, health care providers, and others.

4. Integrate existing NCTPSD mobile apps with the proprietary Vertical Design LLC solution, thereby making them capable of collecting usage analytics that contain no personally identifying information; to provide information about user needs and experiences in order to inform future improvements to the mobile app; and to support NCPTSD mental health research studies.

5. Provide logistical support (i.e. operations support, development of wireframe-based prototypes, etc.) for user experience research conducted during mobile app construction, which is necessary for the production of a successful mobile app that meets customers’ needs, and for NCPTSD mental health research studies involving mobile apps.

This effort includes optional tasks, if exercised, for Professional Services, maintenance for mobile app coding, user interface design, graphic design, mobile app research enablement, Additional Vertical Design solution hosting and maintenance support, and additional research enabled mobile app development. The scope of this effort anticipates future enhancements to the portfolio of mobile apps.

PERFORMANCE DETAILS

PERFORMANCE PERIOD

The Period of Performance (PoP) shall be September 28, 2026, through September 29, 2027, with three (3) 12-month option periods and four (4) Optional Tasks. The overall PoP shall not exceed 48 months.

There are 11 Federal holidays set by law (USC Title 5 Section 6103) that VA follows:

Under current definitions, five are set by date:

If any of the above falls on a Saturday, then Friday shall be observed as a holiday. Similarly, if one falls on a Sunday, then Monday shall be observed as a holiday.

The other six are set by a day of the week and month:

PLACE OF PERFORMANCE

Tasks under this PWS shall be performed at Contractor facilities. The Contractor shall identify the Contractor’s place of performance in their proposal submission.

TRAVEL

The Government does not anticipate travelling under this effort.

SPECIFIC TASKS AND DELIVERABLES

The Contractor shall perform the following:

PROJECT MANAGEMENT

KICKOFF MEETING

The Contractor shall hold a technical kickoff meeting within 10 days after contract award. The Contractor shall present, for review and approval by the Government, the details of the intended approach, work plan, and overall project management approach. The Contractor shall specify dates, locations (can be virtual), agenda (shall be provided to all attendees at least five calendar days prior to the meeting), and meeting minutes (shall be provided to all attendees within three calendar days after the meeting). The Contractor shall invite the Contracting Officer (CO), Contract Specialist (CS), Contractor Officer’s Representative (COR), and VA Program Manager (PM).

CONTRACTOR PROJECT MANAGEMENT PLAN

The Contractor shall deliver a Contractor Project Management Plan (CPMP) that lays out the Contractor’s approach, timeline, and tools to be used in execution of the contract. The CPMP should take the form of both a narrative and graphic format that displays the schedule, milestones, risks, and resource support. The CPMP shall also include how the Contractor shall coordinate and execute planned, routine, and ad hoc data collection reporting requests as identified within the PWS. The initial baseline CPMP shall be concurred upon and updated in accordance with Section B of the contract. The Contractor shall update and maintain the VA PM approved CPMP throughout the PoP.

Deliverable:

A. Contractor Project Management Plan

REPORTING REQUIREMENTS

The Contractor shall provide the COR with Monthly Progress Reports in electronic form in Microsoft Word and Project formats. The report shall include detailed instructions/explanations for each required data element, to ensure that data is accurate and consistent. These reports shall reflect data as of the last day of the preceding month.

The Monthly Progress Reports shall cover all work completed during the reporting period and work planned for the subsequent reporting period. The report shall also identify any problems that arose and a description of how the problems were resolved. If problems have not been completely resolved, the Contractor shall provide an explanation including their plan and timeframe for resolving the issue. The report shall also include an itemized list of all Information and Communication Technology (ICT) deliverables and their current Section 508 conformance status. The Contractor shall monitor performance against the CPMP and report any deviations. It is expected that the Contractor will keep in communication with VA accordingly so that issues that arise are transparent to both parties to prevent escalation of outstanding issues.

The Contractor shall conduct weekly conference calls to brief VA on the status of each task and deliverable defined within this PWS. The Contractor briefing shall include a detailed review of the current work breakdown structure and Gantt chart; the projected schedule; risk mitigation status; and the Contractor’s planned actions for recovering from any schedule slippage.

Deliverable:

A. Monthly Progress Report

MINDFULNESS COACH 3.0 APPLICATION

iOS MOBILE APP DEVELOPMENT (Labor Hour) The Contractor shall develop a native mobile app (Mindfulness Coach 3.0) for the iOS platform. The Contractor’s solution shall meet the following code, security, functional, and quality control requirements:

A. Code Requirements:

The mobile app shall be a native mobile app for iOS coded in Flutter with custom elements in native code (either Objective-C or Swift at the Contractor’s discretion). A hybrid mobile app will not be acceptable. A web app will not be acceptable. The mobile app shall be completely compatible with VoiceOver and it shall be able to integrate with the device’s calendar, saved music/audio, saved photos, saved videos, and contacts.

The Contractor shall design and implement the mobile app so that it is capable of being instrumented to transmit anonymized usage analytics to the proprietary, cloud-based Vertical Design LLC solution. The Contractor shall utilize the Vertical Design LLC software development framework to develop both the research-enabled (i.e. instrumented) and public (no usage data collection) software builds.

The mobile app shall target iOS 27 (or successor versions during the performance of this contract), and design shall be optimized for both iPhones and iPads. Design elements shall automatically scale to the size of the screen and the device orientation, in order to accommodate iPhone and iPad models of varying screen dimensions.

The mobile app shall support only English as its default language, but it shall be internationalized so that after final delivery NCPTSD can later localize it to support additional languages. The Contractor shall code the mobile app according to Apple’s recommended practices for iOS internationalization and localization (https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPInternational/Introduction/Introduction.html), externalizing user-facing text and images from code so that alternative sets of user-facing text and images can be later added to support different languages.

The final mobile app deliverable shall include delivery and ownership of all of the mobile app’s code to VA. The mobile app shall not be dependent on non-VA-owned code or non-VA code licenses for any of its functionality.

B. Security Requirements:

The mobile app shall not be dependent on a server. All mobile app data shall be stored and managed solely by the mobile app on the user’s device; however, the app shall be instrumented to transmit anonymized usage analytics using the Vertical Design LLC software development framework. The app shall not share personal data or identifying information with any third-party organization.

C. Functionality Requirements:

Functional requirements for each iOS app will be provided by NCPTSD. Apps will each address Veteran-related mental health issues and shall provide the following features:

1. An initial onboarding sequence which uses an engaging visual design to a) consent users for use of the app and b) provide information about how to use the main features of the app (e.g., see PTSD Coach 4.0).

2. The app shall provide a training plan, similar in scope and functionality to Mindfulness Coach 2.0, directing users to level-specific learn topics, tools, goals, and assessment exercises, as well as an “extended” training plan that is available to users who complete the basic training plan.

3. Graphically-rich educational messages provided in a news-style layout with images (e.g., the “Learn to Meditate” section of the mobile app “Stop, Think, and Breathe”), links to related content (e.g., the “Happify Daily” section of the “Happify” mobile app), and the ability to favorite specific content (“Learn” content; e.g., favoriting of “Tools” in the “PTSD Coach” mobile app). Educational content will include original content from other NCPTSD apps plus up to 50 additional Learn topics to be provided by VA.

4. Support and other resources for accessing other forms of care (“Support” content; e.g. the “Support” section of the “PTSD Coach” mobile app). Users shall be able to add their own support contacts to the app from their Address Book.

5. Interactive exercises (“Tools”) identical to those in the PTSD Coach 4.0 with up to 20 additional other custom tools comparable to those provided in other VA mobile mental health apps (e.g., see “Breathe2Relax” mobile app and “RID” tool in the “PTSD Coach” mobile app).

6. Users shall be able to see graphs and other visual indicators of their progress with respect to changes in self-assessment measures and goals.

7. The app shall be able to access the user’s calendar, for scheduling of notifications and other activities, and the user’s photos and music when needed for specific tools

8. Implementation of any software development kits (SDKs), such as Google analytics, Amazon mobile analytics, or similar app tracking software to be approved by VA stakeholders. The app and any SDKs used in the app must not collect or share device information, device identifiers, location information, internet protocol (IP) address, phone number, device state, email address, or any other potentially identifying information.

Acquisition of any necessary graphics or art is the responsibility of the Contractor. Any graphics or art shall be either created by the Contractor for the mobile app or purchased by the Contractor from sources with appropriate licensing.

The mobile app shall meet VA user interface design criteria for mobile apps, as defined by VA Human Factors Engineering.

D. Quality Control Requirements:

Quality control of delivered mobile app builds shall be led and performed by the Contractor. No data will be provided to the Contractor for use in testing.

An issue tracking system administered by NCPTSD (on Github) shall be used to track quality control issues and monitor progress.

The Contractor shall deliver the following system design artifacts and software builds:

1. Low-fidelity wireflows, with up to 5 iterations at NCPTSD discretion, that accurately depict all screens and navigation of the mobile app. Wireflows shall consist of wireframe screen layout designs arranged in a flowchart depiction of navigation between screens. Each delivered wireflow iteration shall depict every screen in the mobile app, except for screens of equivalent design at NCPTSD discretion (for example, screens 2-20 of a 20-screen survey). Use of Figma software is preferred for wireflows.

2. High fidelity design proposal, depicting 4 proposed alternative graphic design themes for the mobile app. Screens depicted in each of the 4 proposed designs shall include the Home screen and the main landing screen of each major navigation section of the mobile app.

3. High-fidelity mockups based on a graphic design theme selected by NCPTSD from deliverable 2, with up to 3 iterations at NCPTSD discretion, that depict the intended “pixel-perfect” final graphic design of representative screens of the mobile app. A list of representative screens will be provided to the Contractor by NCPTSD. Each mockup iteration shall depict every representative screen requested by NCPTSD.

4. Feature complete mobile app builds (research-enabled and public), confirmed by NCPTSD’s inspection as being free of bugs that crash the app or that otherwise render mobile app features inoperable. The app build shall be uploaded to App Store Connect for TestFlight distribution.

5. Feature complete mobile app builds (research-enabled and public), confirmed by NCPTSD’s inspection as being free of bugs following as many rounds as necessary of Contractor-led and Contractor-performed quality testing, issue filing, and bug fixing, and confirmed by NCPTSD’s inspection as having no inaccuracies in calculations following as many rounds as necessary of Contractor-led and Contractor-performed calculation testing. The app build shall be uploaded to App Store Connect for TestFlight distribution.

6. Release-quality mobile app builds (research-enabled and public), confirmed by NCPTSD’s inspection as:

a. Being free of bugs following as many rounds as necessary of Contractor-led and Contractor-performed quality testing, issue filing, and bug fixing.

b. Having no inaccuracies in calculations following as many rounds as necessary of Contractor-led and Contractor-performed calculation testing.

c. Having attained 100% compliance with the VA Section 508 office’s accessibility requirements for iOS mobile apps. The Contractor shall undertake multiple rounds of review, revision, and resubmission with the VA Section 508 office before the VA Section 508 office will certify 100% compliance. The Contractor is advised to consult the VA Section 508 office early and often in order to most efficiently produce compliant user interface designs and code. In order to be able to obtain 100% compliance, the mobile app shall be completely compatible with iOS VoiceOver.

7. Final delivery of source code to NCPTSD and deployment of the app files to Apple’s App Store (general availability (GA) release). This deliverable shall include all deployment assets, including complete source code; all visual and audio assets; all low-fidelity wireflow files; all high fidelity design proposal files; all high-fidelity mockup files; and any necessary documentation. Use of GitHub is preferred for source code and audio/visual asset delivery.

Deliverables:

ANDROID MOBILE APP DEVELOPMENT (Labor Hour) The Contractor shall provide a native mobile app (Mindfulness Coach 3.0) developed for the Android platform.

The Contractor’s solution shall meet the following code, security, functional, and quality control requirements:

A. Code Requirements:

The mobile app shall be a native mobile app for Android coded in Flutter with custom elements in native code. A hybrid mobile app will not be acceptable. A web app will not be acceptable. The mobile app shall be completely compatible with TalkBack (and equivalent Android screen reader software such as Samsung’s Voice Assistant) and it shall be able to integrate with the device’s calendar, saved music/audio, saved photos, saved videos, and contacts.

The Contractor shall design and implement the mobile app so that it is capable of being instrumented to transmit anonymized usage analytics to the proprietary, cloud-based Vertical Design LLC solution (see task 5.6 Mobile App Research Enablement and Instrumentation). The Contractor shall utilize the Vertical Design LLC software development framework to develop both the research-enabled (i.e. instrumented) and public (no usage data collection) software builds.

The mobile app shall target Android 17 (Android API level 37) (or successor versions during the performance of this contract), and design shall be optimized for both phone-sized and tablet/foldable-sized screens. Design elements shall automatically scale to the size of the screen and the device orientation, in order to accommodate Android devices of varying screen dimensions.

The mobile app shall support only English as its default language, but it shall be internationalized so that after final delivery NCPTSD can later localize it to support additional languages. The Contractor shall code the mobile app according to Google’s recommended practices for Android internationalization and localization (https://developer.android.com/guide/topics/resources/localization.html), externalizing user-facing text and images from code so that alternative sets of user-facing text and images can be later added to support different languages.

The final mobile app deliverable shall include delivery and ownership of all of the mobile app’s code to VA. The mobile app shall not be dependent on non-VA-owned code or non-VA code licenses for any of its functionality.

B. Security Requirements:

The mobile app shall not be dependent on a server. All mobile app data shall be stored and managed solely by the mobile app on the user’s device. However, the app shall be instrumented to transmit anonymized usage analytics using the Vertical Design LLC software development framework. The app shall not share personal data or identifying information with any third-party organization.

The mobile app shall rely on platform security features (such as per-app data siloing) and device security features (such as encryption at rest upon device lock) for data protection. The app shall not transmit any data outside the device, aside from the anonymized usage analytics.

C. Functionality Requirements:

Functional requirements for each Android app will be provided by NCPTSD. Apps will each address Veteran-related mental health issues and shall provide the following features:

1. An initial onboarding sequence which uses an engaging visual design to a) consent users for use of the app and b) provide information about how to use the main features of the app (e.g., see PTSD Coach 4.0).

2. The app shall provide a training plan, similar in scope and functionality to CPT Coach, directing users to level-specific learn topics, tools, goals, and assessment exercises, as well as an extended training plan that offers additional topics, tools, goals, and assessment exercises to users who complete the basic training plan.

3. Graphically-rich educational messages provided in a news-style layout with images (e.g., the “Learn to Meditate” section of the mobile app “Stop, Think, and Breathe”), links to related content (e.g., the “Happify Daily” section of the “Happify” mobile app), and the ability to favorite specific content (“Learn” content; e.g., favoriting of “Tools” in the “PTSD Coach” mobile app). Educational content will include original content from other NCPTSD apps plus up to 50 additional Learn topics to be provided by VA.

4. Support and other resources for accessing other forms of care (“Support” content; e.g. the “Support” section of the “PTSD Coach” mobile app). Users shall be able to add their own support contacts to the app from their Address Book.

5. Interactive exercises (“Tools”) identical to those in the PTSD Coach and STAIR 2.0 mobile apps with up to 20 additional other custom tools comparable to those provided in other VA mobile mental health apps (e.g., see “Breathe2Relax” mobile app and “RID” tool in the “PTSD Coach” mobile app).

6. Users shall be able to see graphs and other visual indicators of their progress with respect to changes in self-assessment measures and goals.

7. The app shall be able to access the user’s calendar, for scheduling of notifications and other activities, and the user’s photos and music when needed for specific tools. If the operating system requires the user’s consent to access other features of the device, such as photos, music, or files, the app must first provide the user with information about how the app handles privacy.

8. Implementation of any software development kits (SDKs), such as Google analytics, Amazon mobile analytics, or similar app tracking software to be approved by VA stakeholder. The app and any SDKs used in the app must not collect or share device information, device identifiers, location information, internet protocol (IP) address, phone number, device state, email address, or any other potentially identifying information.

Acquisition of any necessary graphics or art is the responsibility of the Contractor. Any graphics or art shall be either created by the Contractor for the mobile app or purchased by the Contractor from sources with appropriate licensing.

The mobile app shall meet VA user interface design criteria for mobile apps, as defined by VA Human Factors Engineering.

D. Quality Control Requirements:

Quality control of delivered mobile app builds shall be led and performed by the Contractor. No data will be provided to the Contractor for use in testing. The Contractor shall perform thorough testing to ensure the accuracy of calculations for all graphs, assessment feedback, and other app features that rely on user-generated data.

An issue tracking system administered by NCPTSD (on Github) shall be used to track quality control issues and monitor progress.

The Contractor shall deliver the following system design artifacts and software builds:

1. Low-fidelity wireflows, with up to 5 iterations at NCPTSD discretion, that depict all screens of the mobile app. Wireflows shall consist of wireframe screen layout designs arranged in a flowchart depiction of navigation between screens. Each delivered wireflow iteration shall accurately depict every screen in the mobile app as outlined in the functional specifications document, except for screens of equivalent design at NCPTSD discretion (for example, screens 2-20 of a 20-screen survey). Use of Figma software is preferred for wireflows.

2. High fidelity design proposal, depicting 4 proposed alternative graphic design themes for the mobile app. Screens depicted in each of the 4 proposed designs shall include the Home screen and the main landing screen of each major navigation section of the mobile app.

3. High-fidelity mockups based on a graphic design theme selected by NCPTSD from deliverable 2, with up to 3 iterations at NCPTSD discretion, that depict the intended “pixel-perfect” final graphic design of representative screens of the mobile app. A list of representative screens will be provided to the Contractor by NCPTSD. Each mockup iteration shall depict every representative screen requested by NCPTSD.

4. Feature complete mobile app builds (research-enabled and public), confirmed by NCPTSD’s inspection as being free of bugs that crash the app or that otherwise render mobile app features inoperable. The app build shall be uploaded to Google Play Console for testing distribution.

5. Feature complete mobile app builds (research-enabled and public), confirmed by NCPTSD’s inspection as being free of bugs following as many rounds as necessary of Contractor-led and Contractor-performed quality testing, issue filing, and bug fixing, and confirmed by NCPTSD’s inspection as having no inaccuracies in calculations following as many rounds as necessary of Contractor-led and Contractor-performed calculation testing. The app build shall be uploaded to Google Play Console for testing distribution.

6. Release-quality mobile app builds (research-enabled and public), confirmed by NCPTSD’s inspection as:

a. Being free of bugs following as many rounds as necessary of Contractor-led and Contractor-performed quality testing, issue filing, and bug fixing.

b. Having no inaccuracies in calculations following as many rounds as necessary of Contractor-led and Contractor-performed calculation testing.

c. Having attained 100% compliance with the VA Section 508 office’s accessibility requirements for Android mobile apps. The Contractor shall undertake multiple rounds of review, revision, and resubmission with the VA Section 508 office before the VA Section 508 office will certify 100% compliance. The Contractor is advised to consult the VA Section 508 office early and often in order to most efficiently produce compliant user interface designs and code. In order to be able to obtain 100% compliance, the mobile app shall be completely compatible with Android TalkBack.

7. Final delivery of source code to NCPTSD and deployment of the app files to Google’s Play Store (general availability [GA] release). This deliverable shall include all deployment assets, including complete source code; all visual and audio assets; all low-fidelity wireflow files; all high-fidelity design proposal files; all high-fidelity mockup files; and any necessary documentation. Use of GitHub is preferred for source code and audio/visual asset delivery.

Deliverables:

PTSD COACH 4.2 UPDATE

IOS MOBILE APP MAJOR UPDATE

The Contractor shall develop a major update of the existing PTSD Coach 4.0 mobile app for the iOS platform. The Contractor’s solution shall meet the following code, security, functional, and quality control requirements:

A. Code Requirements:

The mobile app shall be a mobile app for iOS coded in Flutter with any necessary custom elements coded in either Objective-C or Swift at the Contractor’s discretion, or other platform approved by the VA stakeholder. A hybrid mobile app will not be acceptable. A web app will not be acceptable. The mobile app shall be completely compatible with VoiceOver and it shall be able to integrate with the device’s calendar, saved music/audio, saved photos, saved videos, and contacts.

The Contractor shall design and implement the mobile app so that it is capable of being instrumented to transmit anonymized usage analytics to the proprietary, cloud-based Vertical Design LLC solution. The Contractor shall utilize the Vertical Design LLC software development framework to develop both the research-enabled (i.e. instrumented) and public (no usage data collection) software builds.

The mobile app shall target iOS 27 (or successor versions during the performance of this contract), and design shall be optimized for both iPhones and iPads. Design elements shall automatically scale to the size of the screen and the device orientation, in order to accommodate iPhone and iPad models of varying screen dimensions.

The mobile app shall support only English as its default language, but it shall be internationalized so that after final delivery NCPTSD can later localize it to support additional languages. The Contractor shall code the mobile app according to Apple’s recommended practices for iOS internationalization and localization (https://developer.apple.com/library/content/documentation/MacOSX/Conceptual/BPInternational/Introduction/Introduction.html), externalizing user-facing text and images from code so that alternative sets of user-facing text and images can be later added to support different languages.

The final mobile app deliverable shall include delivery and ownership of all of the mobile app’s code to VA. The mobile app shall not be dependent on non-VA-owned code or non-VA code licenses for any of its functionality.

B. Security Requirements:

The mobile app shall not be dependent on a server. All mobile app data shall be stored and managed solely by the mobile app on the user’s device; however, the app shall be instrumented to transmit anonymized usage analytics using the Vertical Design LLC software development framework. The app shall not share personal data or identifying information with any third-party organization.

C. Functionality Requirements:

This app, designed for Veterans enrolled in VA-approved research studies, shall provide the following features:

1. The app shall extend the functionality of the PTSD Coach 4.0 iOS mobile app.

2. The app shall provide an updated home screen and device screen widgets capable of making a suite of rapid-access tools available for users in distress.

3. The app shall improve the functionality of all content refresher tools (such as “Change Your Focus”) by adding options for users to submit suggestions for other users, and options for NCPTSD staff members to view, edit, and approve or delete suggestions from user so that they can be displayed live in the app.

4. The app shall provide up to 10 additional tools that can be included in the Manage Symptoms section of the app, and each tool shall be of similar or greater complexity to the “Coping Cards” and “Express with Art” tools currently in PTSD Coach 4.0.

5. The app shall provide an update to the “Ambient Noise” tool to include a white noise generator with customization options for the user to change different frequencies of sounds and to provide at least 3 distinct types of white noise.

6. The app shall provide users with the option to set a “dark mode” whereby the colors of the app are replaced with dark color scheme, either immediately or to follow the user’s local time (i.e., sunset).

7. Implementation of any SDKs, such as Google analytics, Amazon mobile analytics, or similar app tracking software to be approved by the VA stakeholder. The app and any SDKs used in the app must not collect or share device information, device identifiers, location information, IP address, phone number, device state, email address, or any other potentially identifying information.

Acquisition of any necessary graphics or art is the responsibility of the Contractor. Any graphics or art shall be either created by the Contractor for the mobile app or purchased by the Contractor from sources with appropriate licensing.

The mobile app shall meet VA user interface design criteria for mobile apps, as defined by VA Human Factors Engineering.

D. Quality Control Requirements:

Quality control of delivered mobile app builds shall be led and performed by the Contractor. No data will be provided to the Contractor for use in testing. The Contractor shall perform thorough testing to ensure the accuracy of calculations for all graphs, assessment feedback, and other app features that rely on user-generated data.

An issue tracking system administered by NCPTSD (on Github) shall be used to track quality control issues and monitor progress.

The Contractor shall deliver the following system design artifacts and software builds:

1. Low-Fidelity Wireflows, with up to five iterations at NCPTSD discretion, that accurately depict all screens and navigation of the mobile app. Wireflows shall consist of wireframe screen layout designs arranged in a flowchart depiction of navigation between screens. Each delivered wireflow iteration shall depict every screen in the mobile app, except for screens of equivalent design at NCPTSD discretion (for example, screens 2-20 of a 20-screen survey). Use of Figma software is preferred for wireflows.

2. Feature Complete Mobile App Builds (research-enabled and public), confirmed by NCPTSD’s inspection as being free of bugs that crash the app or that otherwise render mobile app features inoperable. The app build shall be uploaded to App Store Connect for TestFlight distribution.

3. Feature Complete Bug Free Mobile App Builds (research-enabled and public), confirmed by NCPTSD’s inspection as being free of bugs following as many rounds as necessary of Contractor-led and Contractor-performed quality testing, issue filing, and bug fixing, and confirmed by NCPTSD’s inspection as having no inaccuracies in…