Patient Data — What We Store (and What We Don't)
Our data minimisation policy is the foundation of our privacy approach.
No NHS Numbers
HealthLens never requests, stores, or processes NHS numbers, National Insurance numbers, or any other government identifiers.
No Names or Dates of Birth
The interpreter captures only anonymous clinical context — sex, region, and test results. No name, address, or date of birth fields exist.
Anonymised AI Results Only
The AI interpretations stored for clinician review contain only the clinical text. Automatic PII redaction strips any accidental NHS or NI numbers from submitted text before storage.
GDPR Article 25 — Privacy by Design
Data minimisation is enforced at the API layer. Our functions validate and reject any field beyond the defined anonymised schema.
Right to Erasure
Stored AI results have no user link and can be deleted by clinicians from the Clinician Centre. Contact us to request a full data purge.
No Third-Party Analytics on Clinical Pages
The interpreter and clinician portal pages do not load Google Analytics or any other third-party tracking scripts.
Technical Security Controls
Aligned with OWASP Top 10 and NHS DSPT Technical Controls.
-
✓
HTTPS Everywhere (HSTS) — All traffic is encrypted in transit via TLS 1.2+. HTTP Strict Transport Security (HSTS) with a 1-year max-age and preload flag ensures browsers never connect over plain HTTP.
-
✓
Content Security Policy (CSP) — Restricts which scripts, styles, and frames can load, preventing cross-site scripting (XSS) injection.
object-src: noneblocks all browser plugins.frame-ancestors: noneprevents clickjacking. -
✓
HMAC-SHA256 Session Tokens — Clinician sessions use cryptographically signed tokens (not cookies). Tokens expire after 12 hours and are cleared when the browser tab is closed (sessionStorage, not localStorage).
-
✓
Timing-Safe Authentication — Password comparison uses
crypto.timingSafeEqual()to prevent timing-based side-channel attacks that could reveal password length or content. -
✓
Brute-Force Rate Limiting — The clinician login endpoint locks after 5 failed attempts within 15 minutes, with exponential backoff (30-min, 60-min, 120-min locks). IP addresses are hashed (SHA-256, salted) before storage — no raw IPs are persisted.
-
✓
Input Validation & Allowlisting — All API endpoints validate field types, lengths, and categorical values against strict allowlists. Invalid or oversized inputs are rejected before any processing occurs.
-
✓
CORS Restriction — API endpoints accept cross-origin requests only from
https://telehealthlens.com. This prevents third-party sites from making authenticated requests on behalf of users. -
✓
No-Cache on Sensitive Responses — Auth endpoints and clinical data APIs return
Cache-Control: no-store, preventing tokens and clinical content from being stored in browser or proxy caches. -
✓
Permissions Policy — The browser Permissions Policy header disables camera, microphone, geolocation, Bluetooth, USB, payment APIs, and sensor access — HealthLens does not require any of these.
-
✓
Serverless Architecture — No persistent server processes to patch or compromise. Each API call runs in an isolated, ephemeral function container and terminates immediately after.
Infrastructure & Hosting
HealthLens is deployed on enterprise-grade cloud infrastructure.
Netlify (SOC 2 Type II)
HealthLens is hosted on Netlify, which holds SOC 2 Type II certification — independently audited controls for security, availability, and confidentiality. View Netlify's security page →
Encrypted Data at Rest
Stored AI results are held in Netlify Blobs, which encrypts data at rest using AES-256. No unencrypted data is written to disk.
EU/UK Data Residency
Netlify's edge infrastructure includes European and UK Points of Presence (PoPs). We are reviewing configuration options to ensure UK/EEA data residency for stored blobs.
Zero Persistent Server Attack Surface
There are no long-running virtual machines or database servers to exploit. All compute is serverless and ephemeral — functions exist only for the duration of a request.
Automatic TLS Certificate Renewal
SSL/TLS certificates are managed and auto-renewed by Netlify via Let's Encrypt, eliminating the risk of expired certificates exposing plain-text connections.
Dependency Minimisation
Backend functions use only Node.js built-in modules (crypto, fetch) and no third-party npm packages. This eliminates supply-chain attack risk from package vulnerabilities.
Clinical Governance & AI Oversight
Every AI output is subject to clinician review before clinical action.
-
✓
Clinician Centre — All AI interpretations are automatically stored and made available in a password-protected clinician portal. Clinicians can approve, flag, override, or annotate every result.
-
✓
Clinician Audit Trail — Every clinician action (review, note, status change) is timestamped and recorded alongside the reviewed result, creating a full governance audit log.
-
✓
AI Results Not Diagnostic — HealthLens AI interpretations are clearly labelled as information support tools, not diagnostic outputs. All pages carry prominent disclaimers directing patients to seek clinical advice.
-
✓
NHS NP-Led Platform — The platform is designed and overseen by an NHS Nurse Practitioner with clinical governance experience, ensuring outputs are reviewed against clinical standards.
Compliance Roadmap
Our current status and certifications in progress.
GDPR / UK GDPR
Data minimisation, right to erasure, no PII collection, privacy-by-design architecture, compliant cookie consent banner, and published Privacy Policy.
OWASP Top 10 Mitigations
CSP, rate limiting, input validation, CORS, HSTS, timing-safe auth, and secure session handling address the primary OWASP web application security risks.
Cyber Essentials
We are preparing our Cyber Essentials application covering boundary firewalls, access control, malware protection, patch management, and secure configuration.
NHS DSPT (Data Security & Protection Toolkit)
We are working through the DSPT self-assessment for organisations that handle health & care data, targeting the "Standards Met" assertion.
ISO 27001
As HealthLens scales to NHS organisational contracts, we will pursue ISO 27001 certification for our Information Security Management System (ISMS).
ICO Registration
Registration with the Information Commissioner's Office as a data controller, required once commercial data processing commences at scale.
🔍 Responsible Security Disclosure
If you discover a security vulnerability in HealthLens, please report it to us privately so we can fix it before it affects users.
📧 Report a Vulnerability →We follow coordinated disclosure principles. A machine-readable security policy is available at /.well-known/security.txt