Trust centre
How we comply
This page outlines the security, privacy, and compliance standards Ideoshift operates to when handling patient data on behalf of GP practices and NHS organisations. Our controls span people, process, and technology, and are designed to meet NHS expectations for confidentiality, integrity, and availability of clinical information. We regularly review our controls to ensure continued alignment with regulatory and contractual requirements.
Updated a month ago
Certifications
Ideoshift operates within a robust governance and compliance framework designed to meet the expectations of GP practices and NHS organisations. We handle patient data in line with UK GDPR, NHS information governance requirements, and contractual obligations, with controls spanning people, process, and technology. Access to data is strictly role-based, activity is logged and auditable, and all work is carried out within approved, secure environments.
Our compliance approach is not limited to certifications alone. We place strong emphasis on operational discipline, workforce training, and clear accountability to ensure confidentiality, integrity, and availability of clinical information at all times. This framework is reviewed regularly to ensure it remains aligned with evolving NHS guidance, regulatory standards, and best practice.
We have a Data Protection Officer and Chief Safety Officer with extensive NHS experience who have helped design the service to ensure it remains safe and secure for your patients.
We maintain the following certifications:
Cyber Essentials
2025
NHS DSPT 2024-25 (v7)
2025
DCB 0129: CRM
2025
ISO 27001:2022
2025
ICO registered
2025
Information Governance
Ideoshift operates within a structured information governance framework designed to meet UK GDPR, DSP Toolkit, and NHS contractual requirements. Our governance artefacts demonstrate how we assess privacy risk, document data flows, define controller–processor responsibilities, and test the security of our systems. This ensures transparency for our clients and clear assurance that patient data is processed safely, proportionately, and with appropriate oversight.
DPA
2025
DPIA
2025
Data flow diagram
2025
Template privacy notice
2025
Penetration test
2025
Document processing controls
Protecting patient data is not just a technical exercise — it is a combination of secure systems, robust governance, and human-led controls designed to ensure safety, accuracy, and accountability at every stage of document processing. Our audit framework covers how information is accessed, handled, reviewed, and assured, ensuring that patient records are processed consistently, securely, and in line with NHS expectations. This includes preventative controls, continuous monitoring, and retrospective auditability, giving our clients confidence that data is protected not only by technology, but by well-designed processes and experienced oversight.
Full audit logs
On request
System activity logs
On request
Identity logs
On request
Training, sampling & QA
On request
Least privilage RBAC
Set
