Health Hub — Ireland & NI

A free, installable directory for navigating health services and your rights across Ireland and Northern Ireland. Two layers:

• Service directory — 52 specialty categories spanning general medicine (cardiology, rheumatology, gastroenterology, dermatology, and more), cancer care (adult oncology and the designated cancer centres, alongside gynaecological & breast cancer), stroke, older persons & geriatric medicine, men's health & prostate, CAMHS, adult disability, addiction, allied health, general paediatrics, and weight management, neurodiversity (adult and child ADHD/autism pathways — public and private, ROI and NI — alongside CDNT/early-intervention and Education Authority SEN routes for children), and women's health in depth (maternity & obstetrics, gynaecology, endometriosis, menopause, fertility, and more), across public and private providers. National-level programmes and organisations are covered nationwide; region-specific clinic/service listings are being built out area by area (currently deepest for Cork — more regions are an ongoing, explicit priority, not an afterthought).
• Know your rights — a self-advocacy guide (including realistic expectations for adult ADHD/autism diagnosis and the private/shared-care caveat on both sides of the border), letter templates for FOI/SAR requests and formal complaints, a builder for a short, neutral letter to your TD, councillor, MLA or MP, the complaints escalation ladder for both Ireland and Northern Ireland, Freedom of Information contacts covering all 6 HSE Hospital Groups (with detailed, individually-verified contacts for ~16 major hospitals) plus all 5 Northern Ireland HSC Trusts, entitlement and disability-employment schemes (Medical Card, NTPF waiting-list rights, Fair Deal, Disability Allowance/PIP, Work and Access/Access to Work, and more), and a directory of national advocacy/support organisations.
• Before your appointment (#/prep) — an on-screen consultation checklist and a silent/off-site waiting-room check-in message, both built live from what you type and never saved anywhere. Purely a note-taking aid, not a stored health record.
• My Patient Passport (#/passport) and My call & referral log (#/log) — a one-page summary form and a running log of who-said-what, for the person to hand to (or quote to) a clinician themselves. Both are blank forms the app never suggests or auto-fills content into, both are ephemeral by default (nothing survives a refresh), and both only persist to this device's localStorage if the person explicitly ticks "Save on this device" on that page — unticking, or the "Clear" button, wipes the stored copy immediately. Plain storage, not encrypted: see the content-conventions note below on why.
• Calm mode — a sitewide, persistent toggle (top bar) for sensory overload, panic, or executive dysfunction: bigger tap targets, higher-contrast text, and the crisis/out-of-hours banners open by default. The only thing this stores without being asked is this one on/off preference. (Internal code still calls it "simple mode" — class name, function names, and the storage key are unchanged; only the user-facing label moved to "Calm mode".)

It's a static site — no build step, no backend, no database. Everything lives in data.js.

Run it locally

Any static file server works. From this folder:

python3 -m http.server 8000

Then open http://localhost:8000 in a browser.

Deploy free on GitHub Pages

1. Create a new GitHub repository (e.g. pocket-guide).
2. Push everything in this folder to the repo's main branch:

   git init
   git add .
   git commit -m "Initial pocket guide"
   git branch -M main
   git remote add origin https://github.com/YOUR-USERNAME/pocket-guide.git
   git push -u origin main
   

3. In the repo on GitHub: Settings → Pages → Build and deployment → Source: Deploy from a branch → Branch: main / (root).
4. GitHub gives you a live URL, usually https://YOUR-USERNAME.github.io/pocket-guide/. It updates automatically every time you push.
5. On a phone, opening that URL in Chrome or Safari will offer "Add to Home Screen" — that's the installable PWA, no app store needed.

Adding or editing a service

Everything is in data.js. Each entry looks like this:

{
  id: "unique-id",                 // no spaces, used in the URL
  name: "Service name",
  specialty: ["gynae"],            // one or more ids from SPECIALTIES
  county: ["cork-city"],           // one or more ids from COUNTIES
  blurb: "One sentence, shown in list view.",
  details: ["Longer notes, one per bullet."],
  referral: "How someone actually gets in — self-referral, GP, etc.",
  contact: { phone: "...", email: "...", web: "...", address: "..." }
}

To add a new county (e.g. Kerry), add it to the COUNTIES array at the top of data.js, then tag entries with its id. To add a new specialty, do the same with SPECIALTIES.

There's no build step — save the file, refresh the browser, done.

Content conventions

These have built up over successive editing passes — keep following them:

• Link, don't duplicate. Official schemes/forms get linked to their live page, never transcribed (rates and forms go stale). Write original content — letter templates, walkthroughs — only for documented pain points, not as a substitute for a link.
• No clinical triage or symptom-checker scope. This is a directory and advocacy toolkit, not a source of medical advice — crossing that line is a medico-legal risk.
• No persisted personal health data by default, and no app-generated clinical or legal judgments. Every page that touches personal content (#/prep, #/passport, #/log) only ever echoes back what the user typed — nothing is saved to storage, and the app never infers, suggests, autocompletes, or characterises (e.g. "this breaches standard X") anything about their care. #/passport and #/log are the two exceptions that can persist, and only because the user explicitly ticks "Save on this device" on that page — see their code comments in app.js (PASSPORT_SAVE_KEY / LOG_SAVE_KEY) before changing that behaviour. That storage is deliberately plain localStorage, not "encrypted" — an encryption key that has to live on the same device as the data it protects doesn't stop someone who has unlocked the device from reading it, so the actual safeguard is the opt-in and the plain-language warning on each page, not a crypto layer that would just be theatre. If a future feature wants to persist more personal content, or make either of these two on by default, treat that as a deliberate scope change needing its own privacy/threat-model pass (a shared device, a lost phone, someone else reading it), not a small addition.
• checked: "D Mon YYYY" is an optional per-entry verification-date stamp. Add it only to entries you've actually just re-verified against a live source — never backfilled or added speculatively.
• No AI-sounding copy. Avoid formulaic hedge phrases repeated across entries (e.g. a tag like "— a genuine gap" reused everywhere) and research-process leakage ("was found", "in this pass"). Write plain, direct prose, and match the site's existing "About X" naming convention for informational/caveat entries.
• Never add a URL to data.js without verifying it live first.
• Keep language general, not gendered, by default. Most of the site (general medicine, the advocacy/rights guide, letter templates, crisis and out-of-hours info) applies to everyone and should read that way. Only use women-specific framing where the entry is genuinely about a women's-health-specific topic or organisation (maternity, gynae, endometriosis, menopause, fertility, a women's-health charity/campaign, etc.) — don't let it default in elsewhere. This site grew out of an earlier women's-health-only PWA, and that origin keeps resurfacing as leftover framing in shared, non-content copy — the homepage hero blurb, the meta/manifest descriptions, and section intros like the Support-orgs/General-support callouts. None of those describe a single entry; they describe the whole site or a whole tab, so a women's-health-first framing there misrepresents everything else (general medicine, neurodiversity/ADHD/autism, disability, advocacy) as secondary. When adding or editing any sitewide or section-level description, check it against the site's actual current scope, not the scope it had when that sentence was last written. Parenting, feeding and perinatal wording is parent-neutral by default ("parents", "new parents", "people who give birth"). Use "mother/mum" only where it is an official service or organisation name, or an accurate source statistic. Follow the official source's own phrasing. Do not generalise a factual claim beyond what the source says.

What's already fact-checked vs. what isn't

This v1 was compiled from public HSE and voluntary-sector websites. Phone numbers, staff, and referral pathways change — every entry should be verified by phone before this is shared widely. Treat it as a strong first draft, not a finished, liability-safe product.

Structure

index.html      — page shell, loads everything else
styles.css      — all styling (design tokens at the top), self-hosted @font-face rules
app.js          — hash-based router + rendering (no framework, no build step)
start.js        — "Where do I start?" (`#/start`): the topic and location lookup table. Steps come from `doors.js`; `scripts/test-doors.js` checks every step resolves and that no Republic of Ireland page can appear in a Northern Ireland result
doors.js        — the four hub pages (Find care, What applies to you, Take action, Get support) reached from Home: which hub lists each route. Edit this to move a feature; `node scripts/test-doors.js --table` prints the route table
data.js         — all service listings, specialties, and counties — edit this to update content
manifest.json   — PWA metadata (name, icons, colours). Optional install guidance lives at #/install (footer link)
sw.js           — service worker, network-first with offline fallback
icons/          — app icons for home-screen install
assets/fonts/   — self-hosted Plus Jakarta Sans & Fraunces woff2 files, plus their OFL licences
vendor/leaflet/ — self-hosted Leaflet 1.9.4 (library only — map tiles are click-to-load, see below)
scripts/check-third-party.sh — fails the build if a new external request sneaks into HTML/CSS/JS
scripts/test-rep-letter.js — checks the "Write to your elected representative" wording is neutral and holds no contact detail (plain Node), plus page checks when Playwright is available (roles per region, nothing stored, no outside link)
scripts/test-feedback-link.js — checks the footer feedback link is exactly the expected Google Form (new tab, noopener, the wording about email and personal details) and that no other form link appears in any text file; plain Node
scripts/test-home.js — local pre-merge browser check of Home and search (order, emergency line, Where do I start? row and page, door tiles, search, no outside requests, 320px). Needs Playwright (`node scripts/test-home.js`); not run in CI, so run it before merging a change to Home, search or the tiles
scripts/test-doors.js — checks every route is assigned to a door (or to none), no route is under two doors, every "Where do I start?" step is a real route and none is Republic-of-Ireland-only for Northern Ireland, and the bottom tabs and cross-links are intact; plain Node

Third-party requests

This site makes none on page load. Fonts (Plus Jakarta Sans, Fraunces) and the Leaflet map library are vendored into the repo and served from the same origin as everything else — see assets/fonts/ and vendor/leaflet/. The Content-Security-Policy in index.html only allows 'self' for scripts, styles, and fonts.

The one deliberate exception: the out-of-hours map (#/out-of-hours) starts as a static placeholder and only contacts OpenStreetMap's tile server once a visitor taps "Show map" — see the notice on that page. img-src in the CSP allows that one tile host for this reason. Run scripts/check-third-party.sh after any change that touches <script src>, <link href>, url(), @import, or fetch() — it fails on anything outside this list.

Offline

The service worker precaches the app shell, scripts, data files, icons and fonts on first load, and is network-first: it uses the network when it can and the saved copy when it can't. When the browser is offline, or a section fails to load, a banner says "You're offline. Showing what was last saved; some details may be out of date."

• Works offline after one online visit: every page, search, the guided tools and letter builders, Calm mode, saved-on-device items (if you chose to save them).
• Needs a network: the "Show map" tiles (always, from OpenStreetMap), the "Let us know" form, and every outbound link to an official site.
• A page that isn't saved yet shows the app with a "Couldn't load this section" message, not the browser's error page.

Known limitations of this v1

• No analytics, accounts, or backend — by design, for privacy and simplicity.
• Pregnancy topics leave no trace in the app. #/pregnancy and the sensitive: true rows store nothing, use a neutral route and tab title, and searches for terms in HHSearch.isSensitiveQuery are redirected there instead of being written into the address bar. scripts/test-pregnancy-privacy.js enforces it in CI. Browser history itself is outside the app's control.
• What the app stores and caches. Stored in the browser only when you choose it: Calm mode flag, and the Passport, appointment prep, call log and rights tracker if you tick "Save on this device". Nothing about pages viewed or searches made is stored anywhere (no recent searches, favourites or history). The service worker caches only the fixed list of app files in sw.js, installed for every visitor; it does not add files because of what someone viewed, and page views are hash routes that make no requests. Sensitive searches (HHSearch.isPrivateSearch) never appear in the address bar, tab title, results heading or screen-reader announcement. The browser's own history, autofill and any device backups are outside the app's control; private browsing is the reliable way to leave no trace. scripts/test-sensitive-privacy.js checks this in a real browser.
• Region-specific service listings are still deepest for Cork; the data structure already supports any county/region and expanding coverage nationally is the active priority, not a "someday" item.