Trust
The standards we hold ourselves to
Assurance is not a page of promises — it is documentation somebody else can audit. This is how we govern clinical AI, evidence safety, handle data and keep our medical content accurate.
Health organisations do not buy claims, they buy evidence — and the people who sign off a purchase are rarely the people who wanted it. A clinical safety officer needs a hazard log they can defend at a board. An information-governance lead needs a lawful basis and a DPIA. A procurement team needs to know which standards apply before they can score you. Each page below sets out the standard, what it actually requires, and where we help — with explicit boundaries on what remains yours and your own regulatory or legal advisers'.
Clinical Safety & Risk →
Safety cases and hazard logs that satisfy DCB0129 and DCB0160 — produced efficiently, reviewed properly.
AI Governance & Human Oversight →
The boundaries, oversight and monitoring that keep clinical AI safe after go-live, not just at launch.
Data Protection & Security →
Privacy by design — lawful bases, DPIAs where needed, sensible retention and security throughout.
Regulatory & Compliance Overview →
Which standards actually apply to your product, and when each one bites.
UK Buyer Readiness →
The artefacts that move a digital-health purchase through NHS governance.
U.S. Buyer Readiness →
Security, privacy and implementation assurance adapted for US health systems.
Quality & Editorial Policy →
How our clinical content is written, reviewed, dated and corrected.
How the standards fit together
Four questions, in the order buyers ask them
- Is it a medical device? Classification drives almost everything downstream. If your software makes or supports a clinical decision it may be regulated, and the answer changes your evidence burden entirely — see is my software a medical device and our regulatory overview.
- Is it clinically safe? In UK health systems that means DCB0129 for manufacturers and DCB0160 for the deploying organisation — two separate duties that are routinely confused. See DCB0129 vs DCB0160 and clinical safety and risk.
- Is the data handled lawfully? A lawful basis, a DPIA where the processing is high-risk, minimisation and retention you can justify. See data protection and security and DPIA for AI in healthcare.
- Can the buyer approve it? DTAC, the DSP Toolkit and local governance are the gate. See UK buyer readiness, what is DTAC and what is the DSP Toolkit.
These duties overlap but do not substitute for one another. A completed DTAC does not discharge DCB0160; a DPIA does not evidence clinical safety. Where a standard does not apply to your product we will say so rather than sell you work you do not need.
Applied to this site
The same discipline, turned on our own content
We publish a large clinical reference — drug-class guides, conditions, clinical calculators, individual medicines and a plain-English medical glossary — so our editorial standards are not abstract. Every clinical page is written from primary and national guidance rather than scraped from a licensed source, carries a named reviewer and a review date, states its scope, and links out to the BNF and SmPC as the authority for anything dose-related. Our reference pages deliberately contain no doses.
Our quality and editorial policy sets out the source hierarchy, who reviews what, how review dates are recorded and how to report a correction. If you find something you believe is wrong, tell us — a correction route that works is worth more than a disclaimer.
Reference only. Nothing on this site is personal medical advice, and our clinical pages are not a substitute for the judgement of the clinician responsible for a patient. See our medical disclaimer.
Need this evidence for your own buyers?
We produce the safety, governance and readiness artefacts health-system approvers actually ask for.