QuoVira Health · Trust & compliance
How we keep data safe
What we hold, what we are working towards, and how to get the full evidence.
Cyber Essentials Plus certified
Whole organisation, 26 October 2026 to 26 October 2027. Certificate ada2adbf-7c45-4256-b101-6304f8f99dab, issued by Axiom Worknest under IASME.
Our Cyber Essentials certificate runs alongside it: whole organisation, 22 September 2026 to 22 September 2027, certificate 6f372ac7-9d96-46ef-874f-c25dcbb4c48a.
Our assurance position
Where each item stands today, including the ones still in progress.
Cyber Essentials
Certified 22 September 2026, whole organisation. Certificate 6f372ac7-9d96-46ef-874f-c25dcbb4c48a.
In placeCyber Essentials Plus
Certified 26 October 2026, whole organisation. Certificate ada2adbf-7c45-4256-b101-6304f8f99dab.
In placeUK GDPR and DPIA
DPIA, record of processing and retention schedule, kept current.
In placeICO Children’s Code
Our own products are designed and assessed against all fifteen standards.
In placeSecurity policies and incident response
Information security policy set and a documented breach procedure.
In placeNHS Data Security and Protection Toolkit
Registered. Our assessment is being completed and is not yet published.
In progressClinical safety (DCB0129)
Hazard log and safety case produced with each build, with a clinical safety officer appointed per engagement.
In progressIndependent penetration test
Not yet carried out on our own platform. For client services, an independent test is done before go-live and annually after that.
Not yet held
How we handle data
Assessed before it is built
Every build starts with a data protection impact assessment, revisited whenever the processing changes.
Secure by default
UK hosting, encryption, least-privilege access, multi-factor authentication and prompt security patching.
Backed up and tested
Independent daily backups, with restores tested rather than assumed.
You stay in control
You are the data controller. Export, erasure and retention are built into the product, and every build has a documented exit.
Need the detail? Ask for our evidence pack
Procurement, information governance and clinical safety reviewers can request our full documentation under NDA: policies, DPIA, record of processing, supplier list, backup and recovery evidence, and risk register. Or send us your supplier assurance questionnaire and we will complete it.
Email us with SECURITY in the subject line. We acknowledge reports within one business day and will not pursue researchers who act in good faith.
Last reviewed 20 October 2026. Registrations link to the public registers. We use no regulator logos and claim no regulator endorsement: the ICO, MHRA and NHS do not accredit or approve products.
Got a health or care service to get right?
Whether it's a question about regulation, a service to design, or a supplier to check, tell us the problem and we'll tell you how we'd approach it. The first conversation is free.