Map obligations
Confirm product, provider, contract, device, safety, data, equality and records requirements.
Policy and governance centre
A full working policy suite for an inclusive, safe digital-health service.
The centre includes 27 substantive drafts covering equality, gender, religion, language, accessibility, safeguarding, clinical safety, AI, privacy, security, records, incidents, continuity, content, suppliers, research, conduct, ethics and legal use.
Important distinction: there is no single universal list of policies that makes every supplier “NHS compliant”. Requirements vary by product function, medical-device status, organisation, contract, care pathway and data flow. These drafts provide a comprehensive starting set; each provider must map them to its own statutory, regulatory and local framework.
Search and filter
Open the complete wording
Each page contains purpose, scope, principles, mandatory requirements, procedures, responsibilities, records, monitoring, training and approval fields.
InclusionCore policy
Equality, Diversity, Inclusion and Human Rights Policy
To ensure that Healing Process is designed, supplied and operated in a way that respects dignity, advances fair access, identifies avoidable disadvantage and does not introduce unlawful discrimination into a digital care pathway.
Read full policy →InclusionCore policy
Sex, Gender Reassignment and Gender Identity Policy
To provide respectful, lawful and clinically safe treatment of information about sex, gender reassignment and gender identity, and to prevent harassment or discrimination while preserving data needed for safe care.
Read full policy →InclusionCore policy
Religion, Belief and Cultural Inclusion Policy
To respect religion, non-religious belief and cultural practice while ensuring that digital communication and care workflows remain clinically safe, lawful and person-centred.
Read full policy →InclusionCore policy
English as an Additional Language, Translation and Interpreting Policy
To ensure that people who do not use English confidently can understand essential information, communicate concerns and participate in decisions without unsafe reliance on relatives or unverified machine translation.
Read full policy →InclusionCore policy
Accessibility and Accessible Information Policy
To make Healing Process information and functionality perceivable, operable, understandable and robust, and to support the identification, recording, flagging, sharing, meeting and review of individual information and communication needs.
Read full policy →ClinicalDeployment-specific
Safeguarding Children and Adults at Risk Policy
To ensure that concerns about abuse, neglect, exploitation, coercion, inappropriate access or unsafe care discovered through Healing Process are recognised, recorded and escalated through the responsible provider’s safeguarding arrangements.
Read full policy →ClinicalDeployment-specific
Consent, Capacity, Carer and Proxy Access Policy
To ensure that consent, capacity, parental responsibility, best-interest decisions and carer or proxy access are handled lawfully, transparently and safely throughout capture, sharing, messaging and review.
Read full policy →ClinicalCore policy
Clinical Safety and Risk Management Policy
To apply a documented clinical risk-management system to the design, development, deployment, change and operation of Healing Process so that foreseeable hazards are identified, controlled, monitored and communicated.
Read full policy →ClinicalCore policy
AI Image Alignment, Comparison and Human Oversight Policy
To govern any automated image quality, alignment, segmentation, normalisation, apparent-change estimation or prioritisation used by Healing Process, ensuring traceability, proportional claims, fairness and meaningful human control.
Read full policy →ClinicalCore policy
Medical Device Status and Intended Purpose Policy
To ensure that Healing Process claims, design, evidence, quality management, market placement and change control remain consistent with a documented intended purpose and the applicable UK medical-device regulatory position.
Read full policy →DataCore policy
Data Protection and Confidentiality Policy
To ensure that personal data—particularly identifiable health images, messages and clinical records—is processed lawfully, fairly, transparently, securely and only for defined purposes.
Read full policy →DataCore policy
Information Security and Access Control Policy
To protect the confidentiality, integrity, availability, authenticity and resilience of Healing Process systems and data through proportionate technical, organisational and physical controls.
Read full policy →DataCore policy
Records Retention, Audit Trail and Data Integrity Policy
To ensure that Healing Process records are authentic, complete, attributable, available for the required period and disposed of lawfully, while clearly distinguishing source images, derived images, messages and clinical decisions.
Read full policy →ClinicalCore policy
Patient Safety Incidents, Complaints, Candour and Openness Policy
To provide a clear, fair and learning-focused process for safety incidents, near misses, complaints and concerns involving Healing Process, including timely containment, investigation, communication and corrective action.
Read full policy →OperationalCore policy
Business Continuity, Disaster Recovery and Downtime Policy
To maintain safe and proportionate continuity when Healing Process or a dependency is degraded, unavailable or recovering, and to prevent users from relying on the product as the sole route for urgent care.
Read full policy →ClinicalDeployment-specific
Infection Prevention and Safe Image Capture Policy
To ensure that the act of taking a photograph does not encourage unsafe dressing changes, contact with a wound, cross-contamination, delayed care or deviation from the person’s clinical plan.
Read full policy →ContentCore policy
News, Evidence and Content Governance Policy
To govern public and in-product health content, official-source monitoring, summaries, videos, help material and product claims so that information is current, traceable, accessible and not mistaken for personal medical advice.
Read full policy →OperationalCore policy
Supplier and Subprocessor Management Policy
To ensure that third parties supporting Healing Process are selected, contracted, monitored and exited according to the sensitivity and clinical importance of the service they provide.
Read full policy →ClinicalDeployment-specific
Research, Pilot and Service Evaluation Policy
To ensure that pilots, audits, service evaluations, research and clinical investigations are correctly classified, approved, conducted and reported, with participant safety, privacy and scientific integrity protected.
Read full policy →OperationalCore policy
Acceptable Use, Messaging and Professional Conduct Policy
To set clear standards for safe, respectful and attributable use of Healing Process accounts, images, messages, exports and professional functions.
Read full policy →CorporateCore policy
Ethical Business, Anti-Bribery and Modern Slavery Policy
To conduct Healing Process business with integrity, prevent bribery, corruption, fraud, exploitation and modern slavery, and make procurement and partnership decisions consistent with patient trust and public-sector expectations.
Read full policy →CorporateCore policy
Freedom to Speak Up and Whistleblowing Policy
To enable workers and relevant partners to raise patient-safety, legal, ethical, financial, data, security or workplace concerns in good faith without fear of retaliation.
Read full policy →LegalCore policy
Website and General Enquiries Privacy Notice
To explain how the public Healing Process website and general enquiry routes use personal information. This draft must be completed with the production contact details, hosting, form processor, analytics configuration and retention periods before publication.
Read full policy →LegalCore policy
Cookie and Tracking Technologies Policy
To provide transparent, user-controlled handling of cookies, local storage, pixels, software development kits and similar technologies on the Healing Process public website and apps.
Read full policy →LegalCore policy
Public Website Terms of Use
To set fair conditions for use of the public Healing Process website and make clear that its content is general product and governance information, not a clinical service or individual medical advice.
Read full policy →LegalDeployment-specific
Individual, Patient and Carer App Terms
To define the conditions under which an individual, patient or authorised carer may use Healing Process, including the distinction between private personal record mode and a provider-linked care pathway.
Read full policy →LegalDeployment-specific
Professional and Clinician Portal Terms
To set the conditions for authorised professional use of the Healing Process portal and preserve the provider’s responsibility for clinical care, staffing, records, configuration and local deployment safety.
Read full policy →How to approve the suite
Turn drafts into controlled organisational documents
Name owners
Assign qualified policy owners, approvers, operational contacts and evidence locations.
Implement controls
Configure the product and service, train users, test controls and resolve gaps.
Approve and monitor
Record decisions, publish the controlled version and review evidence and incidents.