Procurement teams, DPOs, and clinical governance leads need evidence — not buzzwords. Here is how HealthCrew AI approaches data protection, access control, and UK compliance during our Alpha design partner programme.
Status labels distinguish published information, items that require current evidence, work in progress and roadmap plans.
Our public website notice explains its stated lawful bases, retention periods, cookie choices and rights contact route.
Registration, toolkit and assurance status should be confirmed from current documentary evidence during procurement.
ISO 27001 certification is not claimed. Relevant management-system work remains in progress.
SOC 2 Type II is a roadmap item; no current SOC 2 report or certification is claimed.
Platform security
Use these topics to structure a product-specific security review. Availability and implementation can differ by product, deployment and release stage.
Ask how application, infrastructure and operational controls are scoped, implemented and evidenced for your intended deployment.
Confirm role design, privileged-access controls and available authentication options for the product and deployment you are reviewing.
Request current evidence for transport, storage, key-management and backup protections before relying on specific algorithms or versions.
Confirm which events are logged, who can access them, how they are protected and how long they are retained.
Review monitoring, vulnerability-management, incident-response and notification arrangements during procurement.
Healthcare-specific
A product review should cover how worker checks, consent records, candidate documents and audit evidence are implemented for the intended workflow.
Procurement reviews should confirm the secure-development lifecycle, dependency review, security testing and access practices that apply to the proposed service.
Data residency
Hosting locations, subprocessors and transfer mechanisms can vary by service and deployment. Request current product-specific documentation before making a residency or transfer assessment.
Our team can walk through architecture, subprocessors, and compliance evidence during a dedicated security briefing. Evidence availability depends on the product and release stage.
