At healthya, the safety, quality, and accessibility of our digital healthcare services are our highest priorities. We are fully aligned with the requirements of NHS Digital’s Clinical Risk Management Standards (DCB0129 and DCB0160), DTAC (Digital Technology Assessment Criteria), and relevant national safety and accessibility frameworks.
Clinical Safety Governance
healthya has a designated Clinical Safety Team, led by Dr Suhel Ahmed (MB ChB, MRCGP), our Clinical Safety Officer, a registered clinician with extensive experience and NHS Digital-recognised Clinical Risk Management certification.
The Clinical Safety Team ensures that safety, risk, and governance are embedded throughout the product lifecycle—from design and development to deployment and post-market monitoring. All clinical safety activities follow the principles of continuous risk assessment, management, and assurance to maintain a safe digital environment for both patients and healthcare professionals.
Compliance and Risk Management
Our safety systems are developed and maintained in accordance with:
- NHS Digital Clinical Risk Management Standards (DCB0129/DCB0160).
- NHS DTAC requirements, covering Clinical Safety, Technical Security, Data Protection, Interoperability, and Usability & Accessibility.
- ISO 27001:2022 (Information Security Management).
- Cyber Essentials Plus accreditation.
healthya continuously assesses risk and safety across its digital services. This ensures that all identified risks are assessed, mitigated, and documented through our Clinical Risk and Hazard Management Process, overseen by our Clinical Safety Officer. A Hazard Log is maintained to record identified hazards, associated causes, impacts, and mitigations.
For example:
- Duplicate patient records: Resolved by introducing mandatory fields and on-screen guidance for clinicians.
- Slow system performance: Addressed through continuous performance monitoring of database and web application servers, with dynamic resource scaling and user notifications in advance of maintenance.
Data and Information Security
All collected, processed, and stored data is encrypted in transit and at rest using AES-256 encryption. All data transmission occurs via Transport Layer Security (TLS) 1.2 or higher.
Data hosting is provided through Amazon Web Services (AWS, London region), compliant with NHS and UK GDPR requirements.
Access to infrastructure is strictly controlled, monitored daily, and governed by our ISO 27001 Information Security Management System.
Accessibility and Inclusive Design
healthya is committed to making its digital services accessible to everyone, in accordance with the Equality Act 2010 and the Web Content Accessibility Guidelines (WCAG) 2.2 AA standards.
Our teams regularly review the usability, accessibility, and inclusivity of all features to ensure they meet diverse user needs. This includes reviewing peer‑reviewed evidence, patient feedback, and in‑app telemetry data to identify and address inequalities in engagement or health outcomes. For further details on our accessibility approach and standards compliance, please visit the Accessibility Information section of our website. https://www.healthya.co.uk/accessibility
Ongoing Safety and Transparency
Our Clinical Safety Team reviews all updates and feature changes to ensure compliance with clinical safety and technical standards. We collaborate closely with NHS and partner organisations during deployment to review, resolve, and document any safety-related issues.
Regular audits, incident reviews, and safety testing ensure our systems remain resilient, secure, and safe for clinical use. Our commitment to transparency means that citations for clinical safety claims and risk management documentation are available on request.
Queries, Requests, or Concerns
If you have any questions, safety concerns, or requests to exercise your information rights, please contact our support team:
📧 support@healthya.co.uk (mailto:support@healthya.co.uk)