TRUST · GOVERNANCE, SAFETY & DATA

Certified, audited, accountable.

NHS buyers don’t need promises; they need paperwork. Here’s ours: the certifications, the safety model, where your data lives, and how to buy.

UKCA · Class I Medical Device

Spectral, the AI engine inside Toca Health, is UKCA-marked as a Class I medical device. Clinical safety is a certification, not a claim.

ISO 42001

AI management systems, among the first teams in the UK to be certified.

ISO 27001

Information security management, audited across the platform.

NHS assurance

DTAC compliant, DSPT completed every year, and a DCB0129 safety case with a named Clinical Safety Officer, who takes part in every Trust onboarding.

All certificates

Certificate numbers, scope, expiry dates and independent verification links.

Human-in-the-loop

eTriage never makes the call: your clinicians do. Spectral acts on its own only where your Trust’s Clinical Safety Officer has agreed it, and sends every disagreement to a clinician.

The clinician decides. The system proves it.

eTriage never makes a clinical decision: your clinicians make every triage call. Spectral reads at a volume no team could, so in some areas, such as discharge analysis, clinical coding or finding specific clinical comments, findings the models agree on can be actioned, because hundreds of thousands of unread decisions or open encounters are the greater risk. Which areas, and at what thresholds, is agreed with your Trust’s Clinical Safety Officer. Wherever the models disagree, a clinician accepts, returns or escalates, and every step is written to an audit trail with the reasoning attached. Consensus Validation adds a second layer: independent models must agree before an extraction even reaches a reviewer, and disagreement routes to a human by design.

Where it runs, what it touches, who’s accountable.

Hosting: eTriage runs on-premise at your Trust or ICB, or UK-hosted by Toca for you. Spectral’s models can run entirely within your boundary.
Integration: NHS e-RS for referrals and Advice & Guidance; your EPR, PAS and document store via the Trust’s existing integration route. No rip-and-replace.
Data control: Your data is processed for your deployment under your governance, with data-flow maps and DPIA support supplied as standard in the IG pack.
Audit: Every action, human or system, is logged with who, when and why, including the model evidence behind each extraction.
Support: Your service desk keeps first line; Toca provides second and third line during UK business hours, with defined clinical-safety escalation routes.
Procurement: Available through G-Cloud with a standard Call-Off Contract, and we’ll work with your procurement team either way.

Request the governance pack.

Certifications, data flows, DPIA support materials and the clinical safety approach, ready for your IG and clinical safety teams to take apart.

Request the pack See the evidence →