Compliance & Certifications

RxSure is built to meet the highest standards of data security, clinical safety, and regulatory compliance required by UK healthcare organisations.

What Compliance Certifications Does RxSure Hold?

RxSure holds the following certifications and compliance registrations:

How Does RxSure Integrate With NHS Systems?

RxSure is registered with NHS Digital and integrated with core NHS infrastructure to enable secure, standards-compliant data exchange.

How Does RxSure Protect Patient Data?

RxSure protects patient data through a layered security architecture designed to meet NHS and UK GDPR requirements at every level.

• All data hosted in UK-based data centres
• TLS/SSL encryption for all data in transit
• AES-256 encryption at rest
• Role-based access controls (RBAC) with multi-factor authentication (MFA)
• Daily automated backups with 30-day retention
• Continuous vulnerability monitoring and regular penetration testing

How Is Clinical Safety Managed on RxSure?

RxSure maintains a clinical risk management framework aligned with NHS DCB0129. All clinical features undergo hazard identification, risk assessment, and mitigation before release.

Is RxSure GDPR and DSPT Compliant?

Yes. RxSure is fully compliant with UK GDPR and the Data Protection Act 2018. Our ICO registration number is ZB261485.

A Data Protection Impact Assessment (DPIA) has been completed covering all processing activities involving patient data. Processing of special category health data is carried out under Article 9(2)(h) of UK GDPR, processing necessary for the provision of health care.

RxSure publishes an annual DSPT submission demonstrating compliance with all 10 National Data Guardian standards. All staff with access to patient data complete annual data security awareness training.

The Caldicott Principles are applied to all patient data processing: we justify the purpose, minimise use of identifiable data, apply the duty to share where appropriate, and ensure access is on a strict need-to-know basis.

NHS Standards Alignment

Company Information

Compliance Documentation

The following policies and procedures are available on our website:

• Privacy Policy
• Terms of Service
• Accessibility Statement
• Complaints Procedure
• Backup & Disaster Recovery Policy

For copies of our DPIA summary, Data Processing Agreement, clinical safety case, or hazard log, please contact contact@rxsure.co.uk.

Compliance FAQs

What is the NHS DSPT?

The NHS Data Security and Protection Toolkit (DSPT) is an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards. All organisations that have access to NHS patient data and systems must use the DSPT to provide assurance that they are practising good data security and that personal information is handled correctly. RxSure submits an annual DSPT assessment demonstrating compliance with all mandatory assertions.

How does RxSure handle clinical risk management?

RxSure follows the DCB0129 standard for clinical risk management in health IT systems. We maintain a hazard log that identifies potential clinical risks, assesses their severity and likelihood, and documents mitigation measures. Our Clinical Safety Officer (CSO), Navid-Ul-Khurram Kaleem (GPhC: 2064676), oversees all clinical safety activities including hazard identification, risk assessment, and safety case reporting. All clinical features are reviewed before release to ensure patient safety.

Is RxSure registered with the ICO?

Yes. RxSure (operated by Qastco Limited) is registered with the Information Commissioner’s Office under registration number ZB261485. This registration covers all data processing activities carried out by RxSure including business operations and patient data processing on behalf of pharmacy partners. You can verify our registration on the ICO public register.

Does RxSure meet Cyber Essentials requirements?

Yes. RxSure holds Cyber Essentials certification, a UK Government-backed scheme that helps organisations protect themselves against common online threats. The certification covers five key technical control areas: firewalls and internet gateways, secure configuration, access control, malware protection, and software updates and patch management. This certification is renewed annually to ensure ongoing compliance with current cybersecurity standards.