Security and Compliance
Our products handle patient conversations and clinical information, so safety and security are built in from the start. Every product is designed by GPs and developed against the NHS clinical safety and data protection standards below, with data held in the UK.
Clinical safety
DCB0129
The NHS clinical safety standard for companies that build health software. Our products are developed under DCB0129, with a clinical safety case and hazard log overseen by a named GP Clinical Safety Officer.
DCB0160
The matching standard for the practice using the software. We share our safety case and hazard log, and help your Clinical Safety Officer complete your own DCB0160 assessment before go live.
Data protection
DPIA
Required under UK GDPR when processing health data. A DPIA is in place, and your practice stays the data controller, with a Data Processing Agreement setting out how we process data on your instruction.
Penetration Testing
Our systems are tested by a CREST accredited provider, who tries to break in the way a real attacker would, so any weaknesses are found and fixed before they can be exploited.
Security
ISO 27001
The international standard for managing information security: risk assessment, access control, incident response and continual improvement.
Cyber Essentials
The national scheme that protects organisations against the most common cyber attacks, covering firewalls, secure configuration, access control, malware protection and patching.
NHS assessment
DTAC
NHS England’s baseline for digital health tools, covering clinical safety, data protection, technical security, interoperability, usability and accessibility.
DSPT
The annual NHS self assessment for any organisation with access to NHS patient data, measured against the National Data Guardian’s data security standards.