Clinical safety and information governance
Clinical Safety and Compliance
Yes, an AI receptionist can be safe and UK GDPR compliant for healthcare, provided it is built and governed like any other regulated tool in the patient pathway. InTouchNow AI is registered with the MHRA as a Class I medical device, complies with the NHS clinical safety standards DCB 0129 and DCB 0160, and is built to UK GDPR and the Data Protection Act 2018. AI never makes clinical decisions: it follows your practice’s call flows, signposts red-flag symptoms to 999 or 111, and hands over to a person whenever a call needs one.
This page sets out our clinical safety, compliance and information governance position for practice managers, ICB digital leads and IG leads. It covers the standards we meet, how patient data is handled, how calls are recorded and what evidence you can request for your own assurance.
medical device, registered with the MHRA
NHS clinical safety standards
information security
practices and enterprise customers
Is an AI receptionist safe for healthcare?
Safety comes from three things: what the software is allowed to do, how it is governed, and what happens when a call goes beyond its limits. At InTouchNow AI, all three are designed in from the start.
AI is a non-clinical, administrative tool
InTouchNow AI is purposefully designed as a non-clinical, administrative tool. It does what your reception team does: answers calls, follows call flows, completes triage admin and books appointments or escalates when needed. It does not diagnose, treat or advise on treatment, and it never judges urgency. Triage decisions stay with your clinicians, exactly as they do today. You can see how this works in practice on our total triage page. For a supplier checklist, read our guide: is an AI receptionist safe for GP practices?
What happens if a patient describes an emergency?
Every conversation carries NHS-safe signposting. Red-flag symptoms are checked conversationally as the call goes on. If a patient describes anything urgent, they are directed to 999 or 111 immediately, and the safety-netting given is recorded on the call transcript. The patient is never left unsure what happens next.
When does AI hand a call to a person?
- When anything falls outside protocol, or there is any sign of risk.
- When a patient asks to speak to a person.
- When AI detects frustration, or a call needs nuance, empathy or discretion.
Calls AI can’t complete are transferred to your practice team, in line with your rules, with the full context passed across so the patient never repeats themselves. If a call needs to go back to your reception team, you are not charged for it. To understand the full journey of a call, read how an AI receptionist works.
What makes voice AI clinically safe?
Clinically safe voice AI is not a feature you switch on. It is a governance framework that runs through development, deployment and every day of live use.
Clinical safety oversight
All clinical safety and data protection activities are overseen by an NHS-accredited Clinical Safety Officer and an in-house Data Protection Officer. Development and deployment are clinically governed, with continuous monitoring and auditing.
A clinical safety case for every deployment
Every implementation is fully risk assessed, documented and maintained within our Clinical Safety Case framework, including hazard logs and continuous audit processes. This supports your own obligations under DCB 0160 as the organisation deploying the system.
Configured to your practice, not one size fits all
Every installation of InTouchNow AI is uniquely configured to the local policies, systems and triage flows of the practice we support. Each site keeps its own triage flows, appointment rules, opening hours and voice, so safety and consistency are built around how your practice actually works. Our on-the-day booking follows the same principle, offering only what your rules allow.
Why is InTouchNow AI a registered medical device?
InTouchNow AI is registered with the MHRA as a Class I medical device (UKCA). That may sound unusual for an administrative tool, but there is a grey area. Once software starts influencing the direction of a patient’s care journey, even by following agreed signposting or triage steps, it could be seen as supporting clinical decision-making.
Rather than make assumptions, we chose to go through the full Class I medical device process, alongside compliance with DCB 0129 and DCB 0160 and robust internal governance. For your practice, that means:
- A platform built for safety and consistency.
- A system that knows when to escalate to a human.
- Clear documentation, accountability and process oversight.
- Confidence that you are not exposing your patients or practice to unnecessary risk.
We believe this level of assurance should become the minimum standard for any tool that plays a visible role in patient access, triage and navigation. Read more in certification and what it means for you.
Which standards and certifications does InTouchNow AI hold?
Our information governance framework aligns with applicable NHS and UK standards for digital health systems. The table below summarises our standards, certifications and registrations.
| Standard or certification | What it covers |
|---|---|
| Registered with the MHRA as a Class I medical device (UKCA) | Medical device regulation for software used in the patient pathway |
| DCB 0129 and DCB 0160 | NHS clinical risk management for manufacturers and for deploying organisations |
| NHS Digital Technology Assessment Criteria (DTAC) | NHS baseline for clinical safety, data protection, security, interoperability and usability |
| ISO/IEC 27001:2022 | Information security management |
| ISO 9001:2015 | Quality management |
| ISO 22301:2019 | Business continuity |
| Cyber Essentials | UK government-backed cyber security certification |
| UK GDPR and Data Protection Act 2018 | Lawful, secure handling of personal and health data |
| NHS Data Security and Protection Toolkit (DSPT), organisation code J7V5S | NHS data security and protection assurance |
| ICO registration ZB496965 | Registered with the Information Commissioner’s Office |
Is an AI receptionist GDPR compliant in the UK?
An AI receptionist is only as compliant as the way it handles data. InTouchNow AI is built to UK GDPR and NHS standards, with privacy by design throughout.
Who controls the data?
Your practice remains the Data Controller. InTouchNow AI operates as the Data Processor, backed by a signed data processing agreement with defined retention terms. We provide DPIA support for your practice, so your IG lead has what they need before go-live.
How is patient data protected?
- UK-hosted data.
- Patient data handled under strict tenant isolation.
- Strict access controls and audit logs.
- No patient data used for model training.
- ISO/IEC 27001:2022 certified information security and Cyber Essentials certification.
Can we listen back to calls?
Yes. Calls are recorded and transcribed, and recordings and transcripts are available to the practice whenever you need them. That gives you clear evidence of what was requested, when and how it was handled, which is useful for training, monitoring, complaints, audits and clinical governance. Safety-netting advice is recorded on the transcript too.
What does this mean for ICBs and multi-site organisations?
For ICBs, PCNs, federations and provider groups, InTouchNow AI rolls out under one commercial, clinical safety and information governance framework. Every site gets the same clinical safety case approach, the same reporting and the same assurance, while each practice keeps control of its own call flows. Our enterprise page explains how estate-wide deployment works.
Fair access is part of safety too. AI speaks 85+ languages and understands 200 accents, so patients are not disadvantaged by how they speak. See our pages on AI-powered clinical translation and accents and dialects.
What evidence can we request for procurement?
We aim to be procurement ready from the first meeting. On request, and under NDA where needed, we can share:
- Our Information Governance Pack.
- Full security schedule.
- Data processing agreement.
- DTAC pack.
- Clinical safety case documentation.
150+ practices already trust InTouchNow AI to answer their patients’ calls. You can find more answers in our FAQs.
Frequently asked questions
Is an AI receptionist safe for a GP practice?
It can be, if it is built and governed as a regulated product. InTouchNow AI is registered with the MHRA as a Class I medical device, complies with DCB 0129 and DCB 0160, is overseen by an NHS-accredited Clinical Safety Officer and never makes clinical decisions. Red-flag symptoms are signposted to 999 or 111 and anything outside protocol escalates to a person.
Is an AI receptionist GDPR compliant in the UK?
InTouchNow AI is built to UK GDPR and the Data Protection Act 2018. We act as Data Processor to your practice as Data Controller under a signed data processing agreement, hold ISO/IEC 27001:2022 certification and Cyber Essentials, are registered with the ICO (ZB496965), host data in the UK and do not use patient data for model training.
Who is the Data Controller when we use InTouchNow AI?
Your practice remains the Data Controller. InTouchNow AI is the Data Processor, working under a signed data processing agreement with defined retention terms, and we support your practice with its DPIA.
Can we listen back to calls handled by AI?
Yes. Calls are recorded and transcribed, and recordings and transcripts are available to the practice for training, monitoring, complaints, audit and compliance.
Can we see your clinical safety case and DTAC evidence?
Yes. Our Information Governance Pack, full security schedule, DPA, DTAC pack and clinical safety case documentation are available under NDA for procurement and supplier risk review. Contact us to request them.
Does AI ever give medical advice?
No. AI is a non-clinical, administrative tool. It captures and structures the information your protocol asks for and never judges urgency or advises on treatment. Triage decisions stay with your clinicians.
Ready when you are
Talk to us about clinical safety and IG
Want to review our clinical safety case or Information Governance Pack? Book a demo or call us on 020 3929 3700. Talk to AI on 020 3879 4499.
Trusted by 150+ practices and enterprise customers · Free two-week trial · Most practices go live in days