Trust & Security

All data stored by Augmented Healthcare is encrypted at rest using AES-256 encryption and in transit via TLS 1.3. Our infrastructure is hosted on AWS within UK data centres, ensuring that no data leaves the United Kingdom without explicit consent.

Consultation data — including any patient information entered during training scenarios — is anonymised before analysis and never stored in a form that identifies individuals. Our AI models are trained on this anonymised data to improve feedback quality.

Augmented Healthcare is fully compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We act as a data controller for the personal data of our users, and a data processor for any anonymised training data generated through the platform.

Users have full rights over their personal data, including the right to access, rectification, erasure, and portability. We maintain a detailed record of processing activities and conduct Data Protection Impact Assessments for all new features that process personal data.

Praxis is designed and maintained in accordance with DCB0129, the NHS standard for clinical risk management in health IT systems. As a manufacturer of clinical decision support software, we maintain a clinical safety case, conduct hazard analysis, and review safety-related changes through our clinical safety management process.

Our Clinical Safety Officer reviews all platform updates before release and maintains the Clinical Safety Case Report. Safety incidents are logged, investigated, and reported in line with DCB0160 requirements.

Our AI system is designed to augment clinical judgement — not replace it. Every AI-generated insight is framed as a consideration or observation, never as a definitive clinical judgement. We do not use language such as "the AI decides" or "the AI requires" — our system considers, recommends, and suggests.

AI-generated feedback on consultation performance is reviewed against established communication frameworks (such as Calgary-Cambridge and MAAS) and calibrated with clinical educators. We regularly evaluate our models for bias, accuracy, and fairness across diverse demographic groups.

We maintain detailed audit logs of all data access and platform changes. These logs are retained for a minimum of five years and are available to authorised regulators on request. We publish an annual transparency report covering data access requests, security incidents, and AI model performance.

Augmented Healthcare is registered with the Information Commissioner's Office (ICO) as a data controller. We also hold Cyber Essentials certification, demonstrating compliance with essential cyber security controls.

We use a limited number of third-party services, all of which are assessed for data protection compliance before onboarding. These include AWS for infrastructure and storage, Stripe for payment processing, and OpenRouter for AI model inference.

Where we share data with third parties, we do so under Data Processing Agreements that restrict their use of the data to the specific service they provide. We do not sell personal data to third parties under any circumstances.