Quality and security

Our management systems comply with:

• ISO 13485: 2016 Medical devices - Quality management systems - Requirements for regulatory purposes
• ISO 27001 Information security management systems
• ISO 14971: 2019 Medical devices - Application of risk management to medical devices.

In addition, all of our products comply with:

• IEC 62366-1:2015 Medical devices - Part 1: Application of usability engineering to medical devices
• IEC 62304:2006 Medical device software - Software lifecycle processes
• IEC 62304:2006 + Amd 1:2015 Medical device software - Software lifecycle processes - Amendment 1
• IEC 82304-1:2016 Health software - Part 1:General requirements for product safety
• DCB 0129 Clinical Risk Management: its application in the manufacture of health IT systems.

Data security in healthcare is critical. We ensure the confidentiality, integrity and availability of your data in multiple ways:

• encryption of data
• logical and physical data segregation
• minimum access levels 
• logging and monitoring of data access
• regular penetration testing (including testing by third parties)
• physical security and secure cloud server hosting
• local data processing.

Our life-cycle approach to product design includes continuous development to ensure our products continue to evolve to meet our customer demands. This includes post-market surveillance to ensure that our products are working as they should in live environments.

Bug fixes and new features are added every 3 weeks with associated risk analysis, testing and assessment.

We always consider data protection and privacy issues upfront in all product development - from the design stage and throughout the lifecycle of our services. 

Risk mitigation is an integral part of our product lifecycle with all new features and fixes included in risk assessment updates.

Our post marketing surveillance enables us to review and actively look for issues or negative trends, hopefully preventing issues before they arise.

We have tested and effective incident management processes in place in the event of any clinical safety or information security incident.  We have a dedicated incident team with direct responsibility for managing breaches and all staff receive incident management training.

We manage clinical risk by the ongoing assessment of the impact of changes and incidents  on the on-going validity of the Clinical Safety Case.

Our risk mitigation includes ensuring operational resilience. This includes, among many other things, processes for:

• business continuity
• disaster recovery
• managing third party risks
• supplier evaluation
• third party monitoring
• third party off-boarding.