Compliance and data protection

Supporting your own toolkit submission

The NHS Data Security and Protection Toolkit asks care providers about the suppliers who handle their data. When we work with you, we can provide our ODS code, our published status, our Cyber Essentials certificate and our data processing agreement to support your own submission.

Your data stays yours

When we build, host or support a system for you, you stay in control of your data. You are the data controller and we act as your processor. We only use your data to deliver the work you have asked for, and only on your written instructions.

Before any live data is shared, we both sign a data processing agreement. It sets out what data we handle, why we handle it, where it is stored and which providers are involved.

How we protect the systems we host

• Encrypted in transit and at rest, with backups encrypted again before they leave the hosting environment
• Every user has their own account protected by two-factor authentication, and logins are never shared
• People only see the records their role requires, and every sign-in by our team is logged
• Automated security checks run on every change, and we build and test with made-up data, never your real records
• Databases are backed up every night, and systems alert us to errors and failed jobs
• Everyone who handles client data is bound by confidentiality and trained in data protection

Where your data is stored

We host client systems with established cloud providers, keeping data in the UK or EU wherever possible. Your data processing agreement lists every provider used, what each one does and where it is based. We give you at least 14 days’ notice before adding a new provider, so you have the chance to object.

AI and your data

AI features are only switched on when you ask for them. Before we enable one, we confirm the provider is set up so your data is not used to train its models and is not kept after processing.

If something goes wrong

If we become aware of a data breach affecting your data, we will tell you within 48 hours. We then explain what happened, which data is affected and what we are doing about it, and work with you on the next steps.

When our work together ends

We securely delete your data or return it to you, whichever you prefer. If the law requires us to keep anything for longer, we tell you what it is, why we need it and when it will be deleted.

Open to scrutiny

You can audit how we handle your data once a year. If you are considering working with us, you can ask for a copy of our data processing agreement and a summary of our security measures before signing anything.

Questions or security concerns

Harvey Wood, Co-founder, is responsible for data protection and security. Email [email protected] with any question about how we handle data, or to report a possible security issue.