The standards, in plain English
| Standard | What it covers | When it applies |
|---|---|---|
| UK GDPR | Health data is special-category data: lawful basis, minimisation, security, retention | Any software holding patient or staff health data |
| DSPT | NHS England’s annual data-security self-assessment | Organisations with access to NHS patient data or systems |
| DTAC | NHS assessment of clinical safety, data protection, security, interoperability and usability | Digital health products sold to the NHS |
| DCB0129 / DCB0160 | Clinical risk management for manufacturers and deploying organisations | Software used in direct patient care |
| MHRA (medical devices) | Regulation of software that diagnoses, prevents or treats | Software as a medical device; most admin tools are not |
Most booking, rota, recruitment and back-office tools are not medical devices, but they still hold sensitive data. We tell you in the written scope which standards your build touches and what that means for cost and timeline. For a certification itself you will work with your clinical safety officer and, where needed, a specialist assessor.
What we build for healthcare
- Booking and scheduling for clinics and private practices, with reminders that cut no-shows.
- Staffing and recruitment tools: rota planning, compliance tracking for registrations and training, job boards.
- Patient and client portals for forms, documents and secure messaging.
- Internal dashboards that pull operational data into one view.
- AI assistants for staff knowledge and admin, with strict guardrails and no clinical advice.
Healthcare work we have shipped
BOQQS, our UK job platform, carries thousands of healthcare roles including NHS posts, with salary shown on every listing and an NHS take-home pay calculator. It is recruitment software rather than clinical software, and it shows how we handle large volumes of structured healthcare data and the specifics of NHS pay.
How we handle health data
- Data minimisation from the scope stage: we collect only what the workflow needs.
- Encryption in transit and at rest, role-based access and audit trails of who saw and changed what.
- UK or EU hosting where your data-protection assessment requires it.
- Retention and deletion rules built in, not bolted on.
Cost
Healthcare builds that hold sensitive data usually sit in our Platform Build tier, £15,000–£60,000+, because of the security, audit and documentation work. A simple booking or internal tool can fit a Product Build at £5,000–£15,000. See pricing for what each tier includes.