Backup & Disaster Recovery

How RxSure protects pharmacy and clinic data with automated backups, UK-only data residency, and a documented recovery framework aligned with CQC, NHS DSPT, and UK GDPR.

1. What Does This Policy Cover?

This policy sets out the backup, retention, and disaster recovery procedures for the RxSure platform. It is designed to ensure the availability, integrity, and recoverability of all clinical, operational, and configuration data processed by the system.

RxSure’s backup and recovery procedures are aligned with the following regulatory frameworks:

• CQC Regulation 17: Good governance, including maintenance of securely held records
• CQC Regulation 12: Safe care and treatment, including the safe management of information
• UK GDPR Article 32: Appropriate technical and organisational measures including the ability to restore availability and access to personal data in a timely manner
• NHS DSPT Version 8: Data security standards for organisations processing NHS data
• GPhC Standards Principle 1: Governance arrangements to support the safe and effective provision of pharmacy services
• DCB0129: Clinical risk management standard for IT systems used in health and social care

2. What Are RxSure’s Recovery and Backup Targets?

3. How Often Does RxSure Back Up Data?

All backup processes are fully automated. No manual intervention is required for routine backup operations. Backup jobs are monitored for success and failure, with automated alerts sent to the infrastructure team if any scheduled job does not complete.

4. How Long Does RxSure Retain Backup Data?

Clinical Record Retention

In addition to backup retention, clinical records within the platform are retained in accordance with NHS Records Management Code of Practice:

Deletion of records beyond their retention period is handled in accordance with UK GDPR data minimisation principles and documented in our data retention schedule.

5. How Quickly Can RxSure Recover From an Outage?

Recovery Objectives

Recovery Scenarios

6. How Is Backup Data Secured?

Encryption

All backup data is encrypted both in transit and at rest:

• In transit: TLS 1.3 encryption for all data transfers between production and backup locations
• At rest: AES-256 encryption applied to all stored backup files

Access Control

• Backup systems are accessible only to authorised infrastructure personnel
• Access is governed by role-based access control (RBAC) with multi-factor authentication (MFA)
• All access to backup systems is logged with a full audit trail
• Client pharmacies do not have direct access to raw backup files

Data Residency

• All production data and backup data is stored within the United Kingdom
• No data is transferred outside the UK at any point in the backup or recovery process

7. What Happens If RxSure Goes Down?

The RxSure platform includes built-in continuity measures designed to minimise disruption to pharmacy operations in the event of an outage:

Email-Based Continuity

• Prescriptions, consultations, and booking schedules are sent directly to the pharmacy’s registered email address
• GP notifications are sent automatically as part of the consultation workflow
• The platform is not a single point of failure. Critical communications are distributed via email

Automated Daily Booking Emails

• Next day’s bookings are sent to the pharmacy at 10 PM each evening
• Same-day confirmation is sent at 8 AM each morning

Additional Continuity Measures

• Offsite backup isolation: Backup data is stored at a physically separate UK location, ensuring recoverability even in the event of complete primary infrastructure loss
• Documented recovery playbook: Step-by-step recovery procedures are maintained and reviewed quarterly
• Monitoring and alerting: Real-time monitoring detects failures and triggers automated alerts to the infrastructure team
• Fallback procedures for pharmacy staff: Guidance is provided to pharmacy teams on how to continue dispensing during any platform downtime

8. How Does RxSure Test Its Recovery Procedures?

Backup Monitoring

• All backup jobs are subject to real-time monitoring
• Automated alerts are triggered on backup failure or delay
• Daily operational checks confirm backup completion and integrity

Recovery Testing

• Full restore tests are conducted quarterly (exceeds NHS DSPT annual minimum)
• Test results are documented and reviewed by the infrastructure team
• Any issues identified during testing are remediated within 30 days

9. Which Certifications and Standards Does This Policy Support?

RxSure’s backup and recovery infrastructure supports the following certifications and standards:

• Cyber Essentials: Certified
• NHS DSPT: Compliant
• DCB0129: Assured
• ICO Registered: ZB261485
• UK GDPR: Compliant
• Penetration Tested: Independent third-party assessment

Regulatory Mapping

10. Who Is Responsible for Backup and Recovery?

11. Questions About This Policy?

This policy is reviewed at least annually or following any significant change to backup infrastructure, hosting environment, or regulatory requirements. Next scheduled review: February 2027.

12. Backup & Recovery FAQs