ICO registration
Baton Clinical Ltd on the Information Commissioner's public register of organisations that handle personal data.
Trust centre
How Baton keeps patient information safe.
Where Baton is hosted, how it is protected, and where we are with each standard that UK clinics and the NHS look for. Every item shows its status, and the date it was done.
Last reviewed 29 October 2026
At a glance
- Hosted in the UKEvery record and backup, on servers in the United Kingdom
- Two-factor sign-inRequired for every member of staff
- Nightly backupsKept for 14 days, and a restore tested
- Processor terms publishedA data processing agreement every clinic can read
Standards and certifications
Where we are with each one.
- Done in place, with the date
- In progress being worked on now
- Planned on the plan, not started
- Later when clinics ask for it
Planned
NHS Data Security and Protection Toolkit
The NHS's yearly assessment of an organisation's data security, published at "Standards Met".
Clinical risk management (DCB0129)
The NHS standard for making health software clinically safe: a Clinical Safety Officer, a hazard log and a safety case for each release.
Medical device assessment
Whether Baton counts as a medical device under UK rules, with an independent expert's view and the reasoning on file.
Cyber Essentials
The UK government's certificate that the basic controls against common cyber attacks are in place.
Cyber Essentials Plus
Cyber Essentials, with the controls tested on our systems by an independent assessor.
Digital Technology Assessment Criteria
NHS England's checks for digital health tools: clinical safety, data protection, security, interoperability and usability.
Independent penetration test
An outside security firm tries to break into Baton, and we fix what it finds.
ISO/IEC 27001
The international standard for running information security as a managed, audited system.
Security in Baton
Built in, not added on.
Two-factor sign-in for all staff
Every member of staff signs in with a second factor. Clinics that use Microsoft 365 sign in with their own accounts, so one switch removes someone who leaves.
Done · 25 Oct 2026Access by role
Each person sees only what their role needs, and a clinician sees only the records of their own patients.
DoneA record of every look and change
Baton records whenever anyone, including us, opens or changes a record. The clinic can see who did what, when, and to which record.
DoneEncrypted connections only
Every connection to Baton is encrypted, and browsers are told never to connect any other way.
DoneNightly backups, restore tested
The database and every uploaded file are backed up each night and kept for 14 days. A full restore has been tested, and the recovery plan written.
Done · 25 Oct 2026Tested before it reaches you
Every update runs first on a separate test server, and needs a clinical safety sign-off before it reaches a clinic's live system.
Done · 25 Oct 2026A public status page
Whether Baton is up, at any time, with an uptime target. See the status page.
Done · 25 Oct 2026Security incident process
Who is told about a security incident, by whom, and how fast.
PlannedData protection
The clinic's data stays the clinic's.
Hosted in the United Kingdom
Baton and its backups run on servers in the UK.
Done · 25 Oct 2026Data processing agreement
What we may and may not do with a clinic's information, as UK GDPR Article 28 requires. Read the agreement.
Done · 28 Oct 2026Subprocessors
Every company that handles a clinic's information for us, what it does and where. See the list.
Done · 28 Oct 2026Leaving Baton
A clinic that leaves gets a full copy of its records, and then they are deleted from Baton and its backups. How it works.
Done · 25 Oct 2026AI drafting, under the clinic's control
Off unless the clinic turns it on. It uses the clinic's own Anthropic account, is never used to train AI, and a patient can be marked "no AI". The safeguards.
DonePrivacy notice
How we use information about the people who contact us and the clinics we work for. Read the notice.
Done · 28 Oct 2026Data protection impact assessment
Baton's own assessment of the risks to patients' privacy, with a template each clinic can adapt for its own.
PlannedClinical safety
Safety is a clinician's job, on the record.
Report a safety issue
A route for clinics to report a clinical safety issue in Baton, straight to the person responsible for clinical safety.
Done · 25 Oct 2026Safety sign-off before every release
Nothing reaches a clinic's live system without a clinical safety sign-off.
Done · 25 Oct 2026Clinical Safety Officer
A consultant psychiatrist, trained in NHS clinical safety, appointed to own Baton's clinical risk.
PlannedHazard log and safety case
Every clinical risk Baton could create, how it is controlled, and a signed safety case for each release.
PlannedNHS connections
Connecting to the NHS properly.
NHS clinical terminology
Diagnoses and medicines coded in SNOMED CT and dm+d from NHS England's terminology server. Access for live use requested on 20 October 2026.
In progressNHS number checks
Checking each patient's NHS number against the national patient register (PDS).
In progressNHS secure messaging
Letters to GPs and commissioners through NHSmail or MESH.
In progressUpdates
What has changed.
- This trust centre published.
- Data processing agreement, subprocessor list and privacy notice published.
- Two-factor sign-in required for all staff. Backup restore tested. Status page live. Clinical safety sign-off added to every release. Safety issue reporting route opened.
- Access to NHS England's terminology server for live use requested.
Need something for your own checks?
Ask for a document, or tell us about a security problem you have found, at hello@baton-clinical.com.