Secure by design. Built to NHS standards.NewOvoTech Medical Coding for EMIS and SystmOne practices.See how it works →SupportContact us
Certified and compliant
NHS IM1Approved interface
DTACCompliant
DSPTStandards Met
DCB0129 · 0160Clinical safety
Cyber EssentialsCertified
ISO 27001Certified
Operational AI, not clinical decision-making.
OvoTech is not a medical device. It does not make clinical decisions. It automates and orchestrates operational and administrative work, and the clinician remains in control of care.
Standards
Every standard the NHS asks for.
Procurement, IG and clinical safety teams can check each one. Request the assurance pack below for the supporting evidence.
Clinical safetyCompliant
DCB0129 and DCB0160
A maintained clinical safety case and hazard log, overseen by a named Clinical Safety Officer, with deployment support for your practice.
NHS assuranceCompliant
DTAC
Assessed against the Digital Technology Assessment Criteria across clinical safety, data protection, security, interoperability and usability.
NHS assuranceStandards Met
Data Security and Protection Toolkit
Standards Met on the DSPT, the NHS requirement for any organisation handling patient data.
Data protectionCompliant
UK GDPR and UK data residency
Patient data is special-category data. It stays in the UK, under a signed data processing agreement and a DPIA for every practice.
SecurityCertified
ISO 27001 and Cyber Essentials
Certified to the international standard for information security management, backed by UK Cyber Essentials.
InteroperabilityApproved
NHS IM1, FHIR and HL7
Approved IM1 access for direct, bi-directional integration with clinical systems, and standards-based exchange across the NHS.
Controls
How we protect patient data.
Role-based access
Least privilege, always. People see only what their role needs.
Immutable audit trail
Every action logged and tamper-evident, from suggestion to filing.
Encrypted in transit and at rest
Data is protected across its whole lifecycle.
UK hosting
Patient data is stored and processed in the UK.
Deterministic rules validation
Clinical rules check every suggestion before a person sees it.
Traceable to source
Every AI output links back to the text it came from.
Designed for healthcare responsibility
Clear boundaries. Accountable actions.
Security covers the whole operating environment, from identity and access to every workflow action and recorded outcome.
01Organisational separationPeople, information, configuration, analytics and audit records stay within the boundaries set for each organisation.
02Explicit permissionsOperational oversight and access to sensitive content are separate decisions. Support access follows least privilege.
03Review and change historyAccess, edits, decisions, approvals and system outcomes are all part of the audit trail.
04Deployment evidenceAuthentication, encryption, retention, hosting and monitoring are documented for your IG and procurement teams.
Operational visibility does not automatically grant clinical access. Permissions follow each person's role.
Human-gated by design
Four checks before anything reaches the record.
Each layer is logged to the audit trail, and the last one is always a person.
LAYER 1
AI suggestion
Clinical models extract terms and rank candidate SNOMED CT UK codes.
LAYER 2
Clinical rules
Codes are validated against the official UK release and checked for conflicts and unsafe combinations.
LAYER 3
Confidence thresholds
Calibrated scores decide whether a code is offered, flagged for a closer look or withheld.
LAYER 4
Human verification
A person approves, amends or rejects. Clinical judgement always wins.
Assurance pack
Everything your IG lead will ask for, in one pack.
DTAC submission, DSPT status, DPIA template, clinical safety summary and security certificates.
Thank you. Your pack is on its way.
We'll email it to you shortly, and our governance team is happy to join a call with your IG lead.