This page outlines the security, privacy and compliance standards we operate to when handling complaint and patient data on behalf of NHS GP practices. Our controls span people, process and technology.
ComplaintGuard is built around UK NHS information governance requirements. We hold and maintain the recognised UK standards listed below.
We complete the NHS Data Security and Protection Toolkit (DSPT), covering data security, staff responsibilities and incident response.
We hold Cyber Essentials certification and operate the technical controls required under the UK government-backed scheme.
All processing carried out under a clear lawful basis with controller–processor terms in place for every practice.
PracticeOS Ltd is registered with the Information Commissioner's Office as a data processor.
Clinical risk management applied to the manufacture of health IT, with a nominated Clinical Safety Officer.
Our information security management follows ISO/IEC 27001:2022, with certification in agreement.
We work within the NHS Care Identity Service (CIS2) framework for staff identity and access.
We operate within a documented information governance framework designed to meet UK GDPR, the NHS DSP Toolkit and your practice's contractual requirements.
Standard contractual clauses defining controller–processor responsibilities, provided to every practice before go-live.
A DPIA covering complaint handling, AI-assisted drafting and CQC evidence — ready to attach to your own records.
Clear mapping of how complaint data flows between your practice, ComplaintGuard and any sub-processors.
Patient-facing privacy notice wording your practice can adopt to cover use of ComplaintGuard.
A maintained list of every sub-processor handling patient data, with location and purpose.
External security testing carried out by a CREST-accredited provider.
Protecting patient data is a combination of secure infrastructure, strict access control and a full audit trail of every action taken inside the product.
All traffic is TLS 1.2+ encrypted end-to-end. Data at rest is encrypted using industry-standard AES-256.
Practice managers, clinicians and reception staff only see what their role requires. Access is revoked the moment a user leaves.
Every view, edit, draft, response and export is timestamped and attributable to a named user — designed for CQC and complaints scrutiny.
Continuous monitoring of authentication, configuration changes and administrative actions, retained for investigation.
ComplaintGuard runs on enterprise-grade UK cloud infrastructure with hardened network controls, isolated environments and automated backups.
All complaint and patient data is stored and processed within UK-based infrastructure to meet NHS data residency requirements.
We have named individuals carrying responsibility for data protection and clinical safety, with experience working inside NHS general practice.
A nominated DPO is responsible for our compliance with UK GDPR and the NHS DSP Toolkit, and is the point of contact for any data protection queries.
A nominated CSO with NHS general practice experience oversees clinical risk management under DCB0129.
Every member of staff with access to patient data completes annual information governance training, with role-specific top-ups.
Our compliance approach is not limited to certifications alone — we place strong emphasis on operational discipline, workforce training and clear accountability. Documentation is available to practice managers and IG leads on request.
DPA, DPIA, data flow diagram, sub-processor register and template privacy notice — available to practice managers and IG leads on request.