Viva Leisure Mobile Ecosystem

Overview

I led the design and development of mobile applications across multiple consumer fitness brands within Viva Leisure Group, including Club Lime, Plus Fitness, and HIIT Republic. These apps were mission-critical, supporting daily member access, bookings, payments, and digital identity for hundreds of thousands of active users.

The work focused on building a shared mobile foundation that could support multiple brands while remaining reliable, secure, and operable under legacy backend constraints.

Problem & Constraints

The platform needed to support always-on, access-controlled mobile experiences across multiple brands and systems.

• Always-available access: Mobile access failures directly prevented members from entering facilities.
• Untrusted client signals: Location and device signals used for access validation could be delayed, inaccurate, or intentionally spoofed.
• Legacy backend systems: Core APIs were built on non-modern platforms, limiting flexibility and consistency.
• Multi-brand requirements: Each brand required custom behaviour and features while sharing a common codebase.
• Security & compliance: As an ASX-listed organisation, the platform required strong security controls and disciplined release processes.

My Role

I acted as the lead mobile engineer with end-to-end ownership of the mobile platform.

• Designed and implemented the mobile application architecture and shared foundations from scratch.
• Owned NFC and location-based access flows and their reliability under real-world conditions.
• Implemented and maintained Flutter applications with native platform integrations.
• Owned release execution, quality gating, and hotfix coordination across multiple branded apps.
• Worked within existing backend constraints while extending functionality through mobile-owned services.

System Design

The system was designed to maximise reliability on the client while minimising coupling to legacy backend services.

• Clients: Flutter-based mobile applications with native iOS and Android integrations.
• Access control: Location- and NFC-based access flows designed with conservative validation and fallback behaviour.
• Backend integration: REST-based APIs provided by legacy systems; mobile-layer logic handled retries and resilience.
• Mobile-owned services: Firebase used for non-business-critical features such as notifications, updates, crash reporting, and feedback tracking.

(Graph 1: simplified architecture diagram highlighting client-side responsibility)

Key Decisions & Trade-offs

• Client-side resilience over backend changes: Designed defensive mobile logic to handle inconsistent or delayed backend responses.
• Shared foundation with brand variation: Reused core architecture and components while allowing controlled brand-specific behaviour.
• Defence-in-depth for access validation: Avoided relying on a single signal (e.g. GPS) to make access decisions.
• Operational discipline over speed: Prioritised stability and predictable releases over rapid feature experimentation.

Outcome & Learnings

• Scaled applications from early adoption to 600k+ users across brands.
• Maintained reliable daily access for members using mobile-based entry.
• Improved release consistency and reduced risk through shared architecture and quality gating.
• Achieved strong user satisfaction, with flagship apps maintaining 7,000+ App Store reviews and a 4.8★ average.

Tech

Flutter · Native iOS/Android Integrations · Firebase · AWS