NHS Data Security and Protection Toolkit
DSPT Standards Met, independently audited.
EnrichMyCare's submission to the NHS Data Security and Protection Toolkit (DSPT) has been assessed as Standards Met against all 10 National Data Guardian standards, and has been reviewed by an independently appointed external auditor with no operational involvement in the controls assessed.
DSPT Status
Standards Met
2025–26 (Version 8) · Valid to 30 June 2027
Independent Audit
Substantial risk assurance
High confidence rating · externally appointed DPO
NDG Standards
All 10 standards met
Assessed against NHS England's 2025–26 assurance guide
Certificate Reference
2025–26 (v8) J8G7F
dsptoolkit.nhs.uk
The independent audit was conducted by an externally appointed Data Protection Officer with no employment relationship, equity interest, or operational management role at Enrich Digital Technologies Ltd — ensuring the assessment is genuinely independent of the team implementing the controls it reviews.
Clinical Safety & Regulatory Status
Governed as a regulated medical device.
EnrichMyCare's AI-enabled clinical features are registered as Class I Software as a Medical Device under UK MDR 2002, and operate under a documented clinical safety management system aligned to DCB0129.
MHRA registered — Class I Software as a Medical Device, confirmed via the MHRA Device Online Registration System (DORS).
DCB0129 Clinical Safety — a documented Clinical Risk Management Plan and Hazard Log are maintained, with the CEO acting as named Clinical Safety Officer.
IEC 62304 Class B software lifecycle compliance for medical device software.
ISO 14971 risk management process applied to AI-enabled features.
Cyber Security
Independently tested, continuously monitored.
EnrichMyCare holds current Cyber Essentials certification and commissions independent penetration testing annually, carried out by CREST/CHECK-qualified testers against the platform, mobile application, APIs and underlying infrastructure.
Penetration Testing
Annual, independent
CREST / CHECK qualified testers · last completed October 2025
Findings Status
Remediated & verified
All Critical, High and Medium findings independently confirmed fixed
Security Posture Score
85.9 / 100
Microsoft Secure Score · industry average 51.0
Continuous Monitoring
Always on
NHS Cyber Alerts & NCSC Early Warning Service registered
Perimeter defences include a web application firewall and DDoS protection, with a default-deny network posture and multi-factor authentication enforced across all user and administrative accounts.
A summary penetration test report is available to NHS procurement teams and due diligence reviewers on request, subject to a non-disclosure agreement. Contact us via the details below.
Data Hosting & Encryption
Hosted in the UK. Never leaves it.
All production data, including data processed by AI-enabled features, is hosted exclusively within Microsoft Azure's UK South region. No patient data is transferred outside the UK, and no patient data is used to train AI models.
Encryption at rest: AES-256.
Encryption in transit: TLS 1.2 or higher, enforced on every connection.
Data residency: UK South only — database, storage, backups and AI processing.
Infrastructure provider: Microsoft Azure, itself certified to ISO 27001, ISO 27017, ISO 27018, Cyber Essentials Plus and SOC 1/2/3.
Access Control
Named accounts. No shared logins.
Access to clinical and administrative data is restricted on a role-appropriate basis, with every account tied to a named individual.
Multi-factor authentication is mandatory for all users and enforced through conditional access policy.
Privileged administrative access is time-limited and restricted to named individuals with a documented business need.
Regular access reviews confirm that permissions remain appropriate and that leaver accounts are removed promptly.
All administrative activity is logged and auditable.
Data Protection & Governance
Clear accountability, clearly documented.
EnrichMyCare processes personal and sensitive data in accordance with UK GDPR and the Data Protection Act 2018. A Data Protection Impact Assessment is maintained and reviewed annually, and every NHS deployment is governed by a formal Data Processing Agreement setting out processing purposes, security obligations, retention and data subject rights.
For NHS Trust deployments, the Trust is the Data Controller for clinical pathway data; EnrichMyCare acts as Data Processor under the Trust's instructions. See our Privacy Policy for the full detail of this relationship.
Data Protection Officer: externally appointed, providing independent oversight under UK GDPR Article 37.
Senior Information Risk Owner: named at CEO level.
Non-Executive Director: provides independent board-level oversight of data security and governance.
Sub-processors: limited to Microsoft Azure, Microsoft 365 and Azure OpenAI (UK South only) and a push-notification service handling notification metadata only — never clinical data. All hold UK GDPR Article 28-compliant contracts.
Recognised & Assured
Third-party assurance, not just self-declaration.
Beyond our own controls, EnrichMyCare's platform has been independently assessed by recognised NHS digital health assurance bodies.
DTAC — ORCHA Assessed: assured to Silver status (UK and EU) by ORCHA, the NHS-endorsed digital health assessment platform.
NHS Innovation Accelerator: our Founder holds a current NIA Fellowship.
NIHR-funded research: supporting the development and validation of our AI triage capability against real-world NHS evidence.
