Frequently Asked Questions – Information Governance & Data Security

What national services are used?

Opto queries NHS Spine services (read-only):

PDS for patient identification
CP-IS for safeguarding flags
Reasonable Adjustments API for accessibility needs

Who controls the data?

Data Controller: NHS Trust
Data Processor: Opto Health

What is the legal basis?

UK GDPR Article 6(1)(e) and Article 9(2)(h) (direct care).

How is data secured?

TLS 1.2+ in transit; encryption at rest
RBAC and MFA for staff access
Full audit logging
UK-only hosting
Controls aligned to DTAC, DSPT, ISO 27001, Cyber Essentials+