Security & compliance
Security, information governance and clinical safety
Everything your IG lead needs to sign this off.
Because this is a clinical-safety and data-protection product, we publish only what we hold today and show honest, dated status for the rest.
Status last reviewed: July 2026. Regulators register pharmacies and pharmacists, not our software.
Clinical safety
Clinical risk management: DCB0129 and DCB0160.
DCB0129 (manufacturer)
We are establishing DCB0129 clinical risk management as the software manufacturer: a named Clinical Safety Officer, a hazard log and a clinical safety case. This work is in progress.
DCB0160 (your deployment)
We support your organisation with its DCB0160 deployment clinical risk management; we do not claim it for you.
Your Responsible Pharmacist remains on the premises throughout. Remote Pharmacist adds consultation capacity by secure video; it never replaces your RP and never supervises dispensing remotely.
Data protection
Where your patients’ data lives, and how it’s handled.
UK GDPR and DPA
Designed for UK GDPR and the Data Protection Act, with controller vs processor set out per service mode. ICO registration is in progress.
Data minimisation
Only what is needed is stored, and patient data is kept out of logs and analytics.
UK residency and encryption
Built for UK data residency: records and any recordings held in the UK, encrypted in transit and at rest.
What your IG lead receives
The pack we walk through with you
- Data-flow map for each service mode
- DPIA support for your assessment
- Draft data-processing terms (labelled as drafts)
- Controller / processor responsibility matrix
- Pathway-by-pathway remote-suitability matrix
- Convert-to-face-to-face protocol
- Sub-processor and hosting list
- Retention and deletion schedule
Non-negotiables, built in
How access is controlled
- Mandatory MFA, no shared logins
- Role-based access on every record
- No patient data in logs or analytics, ever
- Recording off by default, consent-gated when used
Recording, when a service uses it at all, is consent-gated, visibly indicated, signed-URL access only and retention-controlled.
Access and audit
Least privilege, fully audited.
Every access and state change writes to an append-only, hash-chained audit log, so who saw what, and when, is always answerable.
Our clinicians
Consultations are delivered by GPhC-registered, appropriately indemnified pharmacists, aligned to the GPhC February 2025 guidance for services provided at a distance.
Safe prescribing
A documented convert-to-face-to-face protocol and a pathway-by-pathway remote-suitability matrix.
See how this works in practice: how a consultation works, the NHS Pharmacy First service, and the services you can deliver. For website data, see our privacy notice.
Security FAQ
What IG leads ask us first.
Where is patient data stored?
The platform is built for UK data residency: records and any recordings are held in the UK, encrypted in transit and at rest, with strict data minimisation and no patient data in logs or analytics.
Is the platform NHS DSPT compliant?
Our NHS Data Security and Protection Toolkit assessment is in progress and we say so plainly. We never show a badge for something we do not yet hold. Ask us for the current status and evidence.
Who is responsible for clinical safety?
We are establishing DCB0129 clinical risk management as the software manufacturer, with a named Clinical Safety Officer, a hazard log and a clinical safety case in progress. Your organisation runs DCB0160 for its deployment, and we support that work rather than claim it for you.
Is video recording always on?
No. Recording is off by default, policy-driven and consent-gated. When it is used, access is by signed URL only and retention is controlled per policy.
Can we see the audit trail?
Yes. Every access and state change writes to an append-only, hash-chained audit log, so who saw what, and when, is always answerable. We show it live in the demo.
Talk to us about your IG sign-off
We’ll walk your superintendent or IG lead through the detail and share our documentation.