Technical & organisational measures

Last updated · 16 Sep 2026

Radiant Science UG acts as a processor, and in some engagements as a sub-processor, for healthcare providers. This document describes the technical and organisational measures we apply under Article 32 of the UK GDPR and EU GDPR, and serves as the description required by Annex II of the Standard Contractual Clauses.

It describes our measures at the level of the control, not the product. Further security documentation is available to controllers on request under the heading Further information below.

Data Hosting & Location

Patient audio, transcripts and call records are processed and stored in the United Kingdom or the European Economic Area.
The platform — databases, object storage, caches, secrets, message queues and application hosting — runs in Microsoft Azure's UK South region.
Transfers from the United Kingdom to the EEA rely on the adequacy decision made under Article 45 of the UK GDPR.
A limited set of business systems used to run the company, rather than to deliver the service, are operated by providers whose processing takes place outside the UK and EEA. These are named in our subprocessors list with the transfer mechanism relied on for each. They do not receive patient audio, transcripts or call records.
Where personal data is transferred outside the UK or EEA, we rely on an appropriate transfer mechanism such as an adequacy decision, Standard Contractual Clauses, or the UK International Data Transfer Addendum, supported by a transfer risk assessment.

Encryption and Pseudonymisation

Data in transit is encrypted using TLS 1.2 or higher.
Data at rest on durable storage — databases, object storage and backups — is encrypted using AES-256.
Encryption keys, application secrets and certificates are held in a managed key management service with restricted access, soft delete and purge protection.
Identifiers are removed from transcripts and traces once the identifiable retention window closes, so that the retained record cannot be linked back to an individual.

Access Control

Access to personal data is restricted to authorised personnel and granted only for a documented business purpose.
Multi-factor authentication is required for administrative and remote access to systems holding personal data.
Access to production systems, which are segregated from day-to-day working environments, requires an additional hardware-backed authentication factor and is limited to a small number of named individuals recorded in our access register.
Administrative tasks use accounts separate from routine work, and privileged access is granted as a time-bound elevation scoped to the task rather than as standing permission.
Accounts are individually named. Credentials are never shared between users.
New accounts are created with minimal rights under a dual-approval process and require multi-factor authentication before any access is granted.
Access rights are reviewed periodically and at least annually, on any role change, and immediately when a person leaves or the business need ends.

Customer Access to the Service

Access to the dashboard requires multi-factor authentication.
Where a password is used, a minimum length is enforced with no maximum, and common or breached passwords are blocked.
Repeated failed authentication attempts are throttled or locked out.
Each clinic's data is segregated, and access is scoped to the organisation the user belongs to.

Leavers and Credential Handling

When a person leaves, we disable their identity and accounts at or before their confirmed leaving time, revoke active sessions, tokens, certificates, authentication factors and recovery methods, remove role memberships, and recover or remotely restrict company devices.
Credentials and keys the person could reach are rotated where exposure is possible.
Completion is recorded and independently checked against the access register.
Where a credential is known or suspected to be compromised, we disable the account, revoke sessions and recovery tokens, rotate affected secrets, review the relevant audit logs to establish cause and extent, and restore access only after containment and verification.

Endpoint and Network Security

Organisational data is accessed only from company-provided, centrally managed devices. Personal and unmanaged devices are not used.
Managed devices enforce disk encryption, screen lock with a biometric or passphrase, host firewall, malware protection with automatic updates and malicious-site blocking, and disabled automatic execution of downloaded files.
Remote access to organisational data over networks we do not control is made through an authenticated, encrypted channel, which is mandatory on work devices.
Production services require authentication and authorisation on every request, and are reachable only through managed service endpoints with access-control rules applied. Inbound exposure requires a documented business need, named approval and periodic review. Webhook endpoints validate provider signatures or tokens.
Processing takes place in certified third-party data centres operated by our cloud provider. Radiant operates no server rooms or physical processing locations of its own, and personal data is not held on removable media.

Patching and Software Management

Only vendor-supported operating systems and software receiving regular security updates are used.
Security updates are applied on a risk-prioritised basis, with high-risk and critical vulnerabilities prioritised for prompt remediation. Automatic updates are enabled where the platform supports them.
Application dependencies are monitored and updated through automated dependency scanning.
Underlying platform and server operating systems are maintained by our cloud provider under its managed service model.

Testing and Evaluation of Measures

Application dependencies are scanned automatically and vulnerabilities are triaged on a risk-prioritised basis.
Infrastructure changes are peer-reviewed before deployment.
The effectiveness of these measures is reviewed at least annually and on any material change to the service.

Infrastructure Management

All cloud infrastructure is defined and deployed as code, so every configuration change is version-controlled, peer-reviewed and auditable.
Production and non-production environments are separated. Non-production environments do not contain patient data.
Cloud resources are removed or disabled when their business purpose ends.

Subprocessor Management

All subprocessors are listed at www.radiantscience.io/subprocessors, with the purpose of processing and the processing region for each.
Each subprocessor is bound by a written agreement imposing obligations equivalent to those we owe our customers, including the obligation to assist the controller.
Before a subprocessor may process patient or other customer personal data, we confirm its data processing agreement, transfer mechanism, processing location, retention settings and training settings.
We notify customers of additions to and replacements of subprocessors in advance of the change taking effect.

Data Minimisation and Retention

We collect and process only the data needed to handle the call and produce the call record for the clinic.
Identifiable call content — audio, transcripts and the call record — is deleted 30 days after the record is acknowledged by the receiving system, or 30 days after the call ends, whichever comes first.
Personal data is otherwise retained only for the duration of the service. On termination, personal data is securely deleted within 30 days unless otherwise instructed by the Data Controller.
Database backups are retained on a rolling 7-day cycle within the United Kingdom, so data deleted under the rules above can persist in a backup for up to 7 further days before ageing out. A restored database re-runs deletion before it serves traffic.
Operational logs and telemetry, which are content-free by design, are retained for up to 90 days.

Model Training

Radiant does not use patient audio, transcripts or call records to train or fine-tune models. Agent development and testing are carried out on synthetic scenarios with synthetic callers.

Security Monitoring & Incident Response

Infrastructure is continuously monitored, with alerting configured for anomalous and suspicious activity.
Audit logs are reviewed periodically.
We maintain a documented breach response process. Data controllers are notified without undue delay and within 48 hours of a confirmed personal data breach, with the information needed to meet their own notification obligations.

Audit Logging

Access to personal data and significant system events are logged. Logs are centrally aggregated, access-controlled and retained for a defined period.

Staff Awareness and Confidentiality

Staff review our security and data protection policies at induction and complete training covering safe credential handling.
Confidentiality undertakings are required at onboarding, and personnel process personal data only on documented instructions.
Access is limited to job function and business need.

Business Continuity and Recovery

Encrypted backups are taken regularly and stored in the United Kingdom.
Object storage is geo-redundant within the United Kingdom.
Restore procedures are tested periodically.

Data Subject Rights

We support the Controller in fulfilling data subject rights under UK GDPR, including access, correction, and deletion.

No Automated Decision Making

Radiant Science does not perform any automated decision-making producing legal or similarly significant effects. Our AI-assisted systems support administrative workflows, such as processing voice input, structuring clinical notes, or assisting with communication. These tools do not make clinical decisions or offer diagnostic conclusions. All outputs are intended to assist healthcare professionals and are subject to review by authorised users.

Certifications and Assurance

We are registered with the Information Commissioner's Office under reference number ZB842255.
We hold Cyber Essentials certification for Radiant Science UG. Our current certificate and its scope are available on request.
We have completed the NHS Data Security and Protection Toolkit self-assessment. Our published status is available through the Toolkit's organisation search.

Further information

Further security documentation — including certification evidence, penetration test summaries, our information security policy set, and completed security questionnaires — is made available to controllers on written request under Article 28(3)(h) UK GDPR, subject to a non-disclosure agreement, normally within ten business days. Requests should be sent to support@radiantscience.io.

We may update these measures from time to time to reflect changes in technology and practice, provided that any update does not materially decrease the overall level of security of the service. Material changes are notified to customers.

Information Governance Contact

For privacy or data protection inquiries, contact our Data Protection Officer:

Felix Geilert Email: info@radiantscience.io