Protection built into every layer
RespiroScreen protects respiratory monitoring data during capture, storage, processing and clinical review for UK practices.
Security architecture
Our safeguards cover the device, network, processing environment, stored information and user access. Each layer has a defined purpose.
Compliance and accountability
RespiroScreen processes special category health data. Our compliance programme is designed for UK healthcare.
RespiroScreen processes patient data as a data processor for the clinical practice, the data controller. Each practice receives a Data Processing Agreement before monitoring starts. Patients may exercise access, rectification and erasure rights through their clinical team or directly with RespiroScreen.
Our information governance aligns with the principles of the NHS Data Security and Protection Toolkit. We reviewed relevant assertions for organisations supplying digital health services to NHS-connected practices. Formal Toolkit submission is planned for the next assessment window.
Our information security management system is built to the ISO 27001 standard. RespiroScreen is not yet certified. An external audit is planned for later in 2026 as we work toward certification.
We gather the minimum data needed for the service. Audio is pseudonymised at upload, and names are excluded from the acoustic AI compute tier.
Independent testing before important releases
An independent security consultancy performs penetration testing at least once a year and before major platform releases. Critical and high-severity issues must be fixed before release. Medium-severity findings are tracked and remediated within 30 days. Summaries of findings are available to clinical data controllers on request for due diligence.
Talk with the RespiroScreen team
Clinical practices can request security information or discuss data handling before monitoring begins. Contact [email protected] or call +44 20 7946 0132.