CONNECTPlus and the Health and Care Video Library are built, hosted and governed to NHS standards, independently assured and reviewed. This page sets out exactly how, from data protection and cyber security to clinical safety and procurement. For anything not covered here, our Compliance Lead will get you a direct answer.
The Board holds ultimate responsibility, supported by an Executive Committee and a Management Committee. Each committee and the Board follows its own Terms of Reference, and every meeting is minuted. Registers of shareholders and directors are maintained, and our Compliance Lead manages the Board and its committees.
A company-wide risk matrix is reviewed frequently and overseen by our Data Protection Officer, who has signed off our policies, risk assessments and mitigations, and access controls. Business continuity testing takes place annually, with records kept.
Our Data Protection Officer is David Birkinshaw of Kaleidoscope Consultants Limited, an independent appointment. CONNECTPlus data is stored and processed in the UK, and any sub-processors we use are listed in our privacy notice. Incident logs are kept and reviewed with the DPO. The 2025 DPO Annual Report concluded that the business works well towards data protection by design and by default.
CONNECTPlus undergoes annual penetration testing by a third-party IT consultancy, most recently in April 2026, alongside ongoing vulnerability scanning, phishing tests and staff education.
Our Clinical Safety Officer is Patrick Lester of Ethos Digital Health Limited, and our Clinical Director is Dr Matthew Halkes. Together they oversee clinical risk management, which complies with both DCB 0129 and DCB 0160. Hazard logs and incident records are kept and reviewed with the Compliance Lead, and clinical safety documents are available on request.
CONNECTPlus supports sign-in with NHS login, using OAuth 2.0 and OpenID Connect. Identity verification is handled entirely by NHS login; CONNECTPlus never sees or stores NHS login credentials. For patients without an NHS login, or who prefer not to use one, an email one-time passcode remains available.
CONNECTPlus meets the Digital Technology Assessment Criteria (DTAC), the NHS's minimum baseline standard for digital health technologies, covering clinical safety, data protection, technical security, interoperability and usability. A full DTAC submission is available from our Compliance Lead.
HCI is a registered supplier on G-Cloud 15, via the Digital Marketplace, under Lot 2b (Software as a Service), for both CONNECTPlus and the Health and Care Video Library.
Many of these services can be found on the Digital Marketplace under specific search terms where HCI is currently the only registered provider (as at October 2026). A match under one of these terms may support a direct award under the framework's standard call-off procedure, without a further competition; the usual G-Cloud call-off process still applies.
Search for these at applytosupply.digitalmarketplace.service.gov.uk. Our Carbon Reduction Plan, prepared in line with PPN 006 and G-Cloud 15, is on our Net Zero and CSR page.
CONNECTPlus has a live integration with the PDS FHIR API, using NHS Number and date of birth to validate patient identity. It can read from and write to electronic health records using industry standards for secure interoperability.
Patients and clinicians have been involved throughout CONNECTPlus's development, using an iterative design approach validated with think-aloud sessions, alpha testing and beta testing.
Contact our Compliance Lead for a DPIA, clinical safety file, DTAC submission or full Carbon Reduction Plan, or book a free demo to see CONNECTPlus for yourself.
Email our Compliance Lead Back to top