Trust & compliance
Built for trust,
Secured for healthcare
Cerebric is a registered UKCA Class I medical device, architected from the ground up to meet and exceed the highest UK standards for data security, clinical safety, and privacy.
Compliance and security
Our compliance and security status
Clinical safety & device regulation
Cerebric is regulated as a medical device and governed by NHS clinical safety standards.
- UKCA Class I medical deviceRegistered
- Registered under UK medical device regulations, with an Intended Purpose Statement and Basic UDI-DI in place.
- NHS DCB 0129Compliant
- A mandatory human-in-the-loop review for every report, backed by a maintained hazard log. Clinical content remains the responsibility of the qualified clinician.
- Clinical Safety OfficerAppointed
- A registered clinician who approves our DCB0129 hazard log and clinical safety case, and reviews clinical risk as the product changes.
- NHS DTACPassed
- Assessed against the Digital Technology Assessment Criteria: clinical safety, data protection, technical security and interoperability.
Data protection & privacy
Patient data handled beyond the NHS baseline, under UK law, with a registered Data Protection Officer.
- NHS DSPTStandards Exceeded
- Our latest annual assessment exceeded the baseline NHS England sets for handling patient data.
- UK GDPR & DPA 2018Compliant
- All data processed under a robust Data Processing Agreement, encrypted in transit and at rest, and fully GDPR compliant.
- Data Protection OfficerAppointed
- Oversees how we handle personal data under UK GDPR.
- ICO registrationActive
- Cerebric Ltd is formally registered with the ICO as a Data Processor.
Security assurance
Independent, externally audited evidence that our controls actually work.
- Cyber Essentials PlusCertified
- Independently audited technical controls: access control, secure configuration, malware protection and patch management.
- Penetration testingAnnual
- An annual, independent test of our application code by a CREST-approved provider.
UK data hosting, 99.99% availability
Data protection
GDPR
Patient data is stored in the UK and processed in the UK and EU, in line with UK GDPR.
Availability
99.99%
Uptime target on a high-availability architecture, with a near-zero recovery time objective so clinics are never left waiting.
For procurement teams
Everything your information governance and clinical safety reviews ask for, self-serve through our live Trust Centre and always current.
- Compliance evidence for Cyber Essentials Plus, DSPT, DTAC, GDPR and UKCA Class I registration
- DCB0129 clinical safety documentation and hazard log
- Data Processing Agreement (DPA)
- Subprocessor DPAs and privacy documentation
Security, compliance & procurement FAQs
Where is our patient data hosted?
Patient data is stored in the UK and processed in the UK and EU, in line with UK GDPR. It is encrypted in transit (TLS 1.2+) and at rest (AES-256).
Is Cerebric a medical device?
Yes. Cerebric is registered as a UKCA Class I medical device. Its intended purpose is to reduce clinicians' administrative work, and a clinician reviews and approves everything it produces. Our Intended Purpose Statement and Basic UDI-DI are in place.
What compliance evidence can you provide for procurement?
Our Trust Centre (trust.cerebric.io) holds our certificates, DCB0129 hazard log, Data Processing Agreement and subprocessor documents. Request access there and we'll share them with your team. We hold NHS DSPT (Standards Exceeded), DTAC, Cyber Essentials Plus, ICO registration and an annual CREST-accredited penetration test.
How does Cerebric's pricing work?
Cerebric is quote-based; there are no public price lists. Pricing scales with your assessment volume and the parts of the pathway you deploy, from the reporting module alone through to the full platform. Book a call and we'll scope pricing to your service.
What are the contract terms?
We agree the contract length, notice period and support level with each clinic, and put them in writing before you sign. Book a call and we'll tell you what they would be for your service.
Can we get our data out if we leave?
Yes. Your clinic is the data controller, so the data is yours. When you leave, we return your patient data to you or securely delete it, whichever you tell us to, as set out in our Data Processing Agreement. We never use your patient data to train models for other clients.
How much effort is onboarding?
Typical deployment is around four weeks. Our team works with you through onboarding, and staff train in the built-in Training Centre, which issues completion certificates. Report templates are tailored to your existing structure and language as part of set-up.