Safety and governance
The trust architecture is part of the product, not a checklist at the end.
Every lead who signs off a service has a different question. Here is how we answer each one, and what we supply.
The framework we work to
We build to NHS England’s ambient scribing guidance, the MHRA’s July 2026 position on ambient voice technology, and the lessons of the HSSIB investigation opened in August 2026.
Clinical safety
A named clinical safety officer maintains our DCB0129 file and hazard log, covering transcription errors, omissions, unsupported content and export without approval. Mitigations are product features: source links, exception flags, empty rather than guessed fields, and no export without confirmation. Your DCB0160 work starts from our hazard log.
Information governance
Every data flow is mapped, from device to EPR. We supply an NHS England-based DPIA template, pre-populated, for your service to complete. Retention and access are agreed before the first encounter. No patient data trains any model.
Patient transparency
Patients are told first and can decline at no cost to their care. Leaflets, posters and scripts are reviewed with a patient group, and participation is measured in every evaluation.
Security and assurance
Encryption, role-based access, multi-factor authentication, full audit logs and independent penetration testing before the first pilot. DSPT, Cyber Essentials Plus and a DTAC evidence pack are in progress.
Intended purpose
Documentation for clinician review only: no recommendations, diagnostic outputs, risk scores or chatbot. That keeps it outside medical device classification, and we reassess whenever functionality changes.
What we supply, and when
| Artefact | For whom | Status |
|---|---|---|
| Intended-purpose statement | CCIO, procurement, clinical safety officer | Available on request |
| Data flow map and sub-processor list | Information governance lead, Caldicott Guardian | Available on request |
| DPIA template (NHS England-based, pre-populated) | Information governance lead | Supplied to design partners during onboarding |
| DCB0129 clinical risk management file and hazard log | Clinical safety officer | In preparation with a named clinical safety officer; supplied to design partners before the first encounter |
| DTAC evidence pack | Digital and procurement teams | In preparation; supplied to design partners |
| DSPT submission and Cyber Essentials Plus | Information security | In progress ahead of first deployments |
| Independent penetration test summary | Information security | Before the first pilot |
| Patient information leaflet, poster and scripts | Clinical lead, patient experience | Reviewed with a patient group before first use |
| Evaluation protocol | Clinical lead, commissioner | Pre-registered with an independent evaluator before pilots begin |