Security & data protection

• The clinic is the controller of its patients' data. ClinForms acts as a processor under a written Data Processing Agreement (UK GDPR Article 28).
• A Data Protection Impact Assessment is completed with the clinic before go-live – health data is special category data.
• Every sub-processor (hosting, and the contracted drafting service) is listed in the DPA's sub-processor schedule, and the clinic is told before any change.
• A proof of concept uses anonymised data only: your own referrers' forms with anonymised notes, before any identifiable patient data is processed.

• Drafting the answers and reading referrer forms are performed by a contracted sub-processor, under a data processing agreement.
• It receives only the minimised record shown in the data step: the patient's name is replaced with “[CLAIMANT]”; date of birth (age only), address, phone, e-mail and NHS-style numbers are never sent.
• Names, dates of birth and references on the referrer's form are filled in by our own code from the clinic record.
• Employer and case-manager forms: past medical and social history are removed before drafting.
• Referrer forms are read as blank forms; if one arrives already filled in, the patient details are removed first and staff are asked for the blank form.
• Your data is not used for training. Retention by the sub-processor is limited as set out in the DPA, and the sub-processor is listed in the DPA's sub-processor schedule. Where processing happens outside the UK, the transfer is covered by those data processing terms and recorded in the DPIA.

When you complete a form, the data step has “See exactly what the drafting service receives”, which shows the minimised record for that patient.

• Every answer cites the note it came from. Anything not in the record is left blank and flagged – opinions are never invented.
• Approval needs the clinician's name, HCPC number and four attestations, and is tied to their sign-in.
• The server signs an approval receipt over the exact content and the form's mapping. A changed answer, or a different mapping, needs approving again.
• Only the final file issued for that approval can be saved to the patient's record.

• Clinic accounts with multi-factor authentication and roles (clinician, practice manager, admin).
• Opened from TM3, a session covers that one patient's episode and expires after an hour; launch links work once.
• Staff see the clinic's own reports and forms only.

• UK hosting, encrypted at rest and in transit.
• The completed form is filed to the patient's record in TM3; working copies are kept only as long as the clinic's retention policy allows.
• Uploaded forms and documents are processed with size limits and in an isolated converter without network access.

• Every draft, edit, gap resolution, approval and filing is recorded with who did it and when.
• Resolving a gap says who answered it; nobody can mark an opinion as answered without writing it.
• Every draft is labelled with how it was produced – drafted live, a prepared demo draft or a sample draft – never passed off as something else.

• The clinic sets the retention period. Working drafts are deleted after the final form is filed, unless the clinic chooses to keep them.
• Data is exported and deleted on request, and at the end of the contract.

• Access, correction and deletion requests are handled by the clinic as controller, with full support from ClinForms.
• Disclosure to a referrer follows the consent recorded in the clinic system – the record check flags a missing consent before approval.