Trust Pack (UK Compliance & Clinical Safety)
Last updated: 7 October 2026
Dentistry Dashboard is designed to support secure, responsible use across NHS and private dental settings. For NHS Trust procurement, IG and clinical safety review, a full Trust pack is available containing clinical safety, information governance, cyber security, and regulatory evidence.
What happens to my audio?
Your audio is never stored. It is sent for transcription and discarded. Only the written transcript and the generated notes are saved.
- What happens during transcription?
- Your audio is sent for transcription and discarded. Dentistry Dashboard does not keep a recording library for later playback.
- What remains in my account?
- Written transcripts and generated notes can be saved in your account. You can delete saved notes; this does not delete copies you have transferred to your practice management system. If you upload an existing audio file, the original file on your own device remains under your control.
- Where is this explained in the Privacy Policy?
- See sections 3.2 (AI Notes) and 9 (data retention) of our Privacy Policy. Please contact us if you would like any part of the audio handling explained further.
Current assurance status
All items below are current. Certificates, registration letters and independent reports are available on request for Trust IG, procurement and clinical safety review.
DSPT - Standards Met
2025/26 (version 8), published 13 April 2026, valid to 30 June 2027. ODS organisation code V5P2T.
Independent penetration test - passed
External web-application penetration test by Mondas Consulting. Final retest on 10 April 2026 confirmed no remaining reportable findings in scope.
Cyber Essentials
Whole-organisation scope, certified on 16 September 2026 by Penayde, an IASME certification body. Cyber liability insurance in force via the Cyber Essentials scheme.
MHRA manufacturer & device registration
Outlook Aesthetics Ltd registered as manufacturer. Dentistry Dashboard AI Notes registered as a Digital dictation system (GMDN 36216), UK MDR Class I. Registration outcome 20 September 2025.
ICO registration
Registered with the Information Commissioner’s Office, reference ZC087154.
DTAC response pack
Full NHS Digital Technology Assessment Criteria response prepared, covering clinical safety, data protection, security, interoperability and usability — including Section C3 independent penetration testing.
Clinical safety (AI Notes)
- ✓DCB0129-aligned clinical risk management with a named Clinical Safety Officer (CSO), hazard log, safety case and post-market surveillance plan maintained.
- ✓Human-in-the-loop: AI Notes drafts documentation only. Clinicians review, edit and approve every output before it is saved.
- ✓Optional retention setting for Trusts: AI Notes can be deleted automatically after a period the practice chooses (30 days by default), switched on during onboarding. Audio handling is explained above under What happens to my audio?.
UK compliance & information governance
- ✓UK GDPR / Data Protection Act 2018 compliant processing approach. Your organisation remains the Controller for patient data; we operate as Processor.
- ✓DSPT Standards Met (2025/26 v8), published 13 April 2026, valid to 30 June 2027.
- ✓Named Information Governance Lead. Article 28 Data Processing Agreement, subprocessor register, retention schedule, incident response plan and business continuity plan all maintained.
Cyber security & infrastructure
- ✓Cyber Essentials certified (whole organisation) and supported by an independent penetration test pass from Mondas Consulting (final retest 10 April 2026, no remaining reportable findings in scope).
- ✓UK/EU data residency: platform and clinical content for UK customers is stored on AWS in London (eu-west-2). AI Notes transcription uses Microsoft Azure in the UK and EU (UK South and West Europe), and drafting uses Google Vertex AI in the EU.
- ✓Independently certified providers (ISO 27001 and/or SOC 2 reports) run all production infrastructure.
- ✓TLS in transit, encryption at rest, role-based access control, centralised logging, and daily backups with documented retention.
What we can provide (on request)
Trust / IG documents
- Data Processing Addendum (Article 28), published, or signed as a standalone agreement
- Subprocessor register (purpose, regions, transfer safeguards)
- Incident Response Plan + tabletop exercise record
- Retention Schedule (including backup persistence)
- Business Continuity & Disaster Recovery Plan
- Data exit and termination (export/deletion)
- Information Governance Framework & Records Management Policy
Evidence & certifications
- DSPT Standards Met certificate (2025/26 v8, ODS V5P2T)
- Cyber Essentials certificate + insurance evidence
- Independent penetration test reports (Mondas, 2026) + retest summary
- MHRA manufacturer registration + Declaration of Conformity
- Clinical safety artefacts (Safety Case, Hazard Log, PMS Plan)
- DPIA materials (AI Notes DPIA)
- DTAC Response Sheet & attachments list
- Supplier Certifications & Assurance Register (subprocessor ISO 27001 / SOC evidence)
A note on Cyber Essentials Plus and ISO 27001
Neither Cyber Essentials Plus nor ISO 27001 is required by NHS DTAC or DSPT at this scope. The NHS baselines — Cyber Essentials and DSPT Standards Met — are both held. Our independent penetration test provides the verified external assurance that Cyber Essentials Plus is intended to demonstrate, and all production infrastructure runs on independently certified providers (ISO 27001 and/or SOC 2 reports). Where a specific Trust requires ISO 27001 on the supplier legal entity itself, please let us know.
Request the Trust pack
Email our team and we’ll share a concise Trust Compliance Summary as a PDF, with the underlying certificates, DPA, DPIA and policies provided on request for Trust IG review.