Log InBook a demo
Trust Centre

Security, Compliance &
Clinical Safety

We are committed to maintaining the highest standards of data security and clinical safety. Verify our compliance, view our certifications, and access our governance documentation.

Cyber Essentials

Fully certified against UK government standards

DSPT Compliant

Exceeds standards for NHS data handling

DCB0129 Ready

Clinical Risk Management compliant

Trusted by Healthcare Organisations

Request Full Access

Complete the form to verify your identity and request access to restricted clinical safety cases and detailed architecture documentation.

Why do we ask for this?

Due to the sensitive nature of our security architecture and clinical safety cases (DCB0129), we must verify that requestors are authorised NHS or healthcare personnel.

Access Request Form

All fields are required for verification.

Frequently Asked Questions

Common questions about our security, compliance, and data handling practices.

Do you have a privacy policy?
Yes. Appt Health maintains a comprehensive privacy policy that explains how we collect, use, share, and protect personal data. You can read the full policy here: Privacy Policy.
Where is your data hosted?
Our production data is hosted in UK-based cloud infrastructure.
Do you use a cloud provider?
Yes. We use Microsoft Azure for core infrastructure and operations.
Are you registered with the ICO?
Yes. We maintain an ICO registration for our UK data protection obligations.
Do you complete the NHS Data Security and Protection Toolkit (DSPT)?
Yes. We maintain an organisation profile on the DSPT and keep it up to date as part of our NHS information governance approach.
Are you DTAC compliant?
Yes. We provide a DTAC evidence pack and supporting documentation (including clinical safety, IG, and security materials) to NHS organisations as part of due diligence.
Do you provide DPIA documentation and support?
Yes. We can provide DPIA templates and supporting documentation, and we work with NHS partners to complete DPIAs where required.
Who can access patient data within Appt Health?
Access is restricted to authorised personnel on a need-to-know basis, using role-based access principles and strong account controls.
Do you encrypt data?
Yes. We use encryption in transit and encryption at rest as standard for production systems.
Do you perform security testing (e.g., penetration testing)?
Yes. We perform security testing and share relevant assurance evidence with NHS partners as part of our due diligence pack.
Do you keep audit logs?
Yes. We maintain audit and operational logs in accordance with NHS England requirements to support security monitoring, investigation, and service reliability.
What is your approach to incident management?
We have an incident management process for triage, containment, investigation, and resolution. Where required, we follow contractual and regulatory notification obligations.
How long do you retain data for?
Retention depends on the deployment and the contractual arrangements with the NHS organisation. We only retain data for as long as necessary for the agreed purpose and we support secure deletion when no longer required.
How can I request your assurance documentation?
Complete the form above and you will be able to access or request the relevant assurance pack (DTAC materials, IG/security documentation, and supporting policies) appropriate to your deployment.