Assurance & onboarding

  1. Agree your scope and contract

    • Decision-maker
    • Authorised signatory
    • G-Cloud 15

    Confirm what you are buying and who will lead the rollout.

    Ready when

    • Service contract reviewed and agreed by your authorised signatory.
    • Product scope, commercial terms and rollout owners agreed.
    Request these documents
  2. Review your data processing agreement

    • Information Governance Lead
    • UK GDPR

    Check how your data is handled throughout the service.

    Ready when

    • DPA reviewed and agreed before processing begins.
    • Data flows, retention, subprocessors and exit arrangements reviewed.
    Request these documents
  3. Complete your local data protection review

    • Information Governance Lead
    • DPIA

    Use the templates for the products you are adopting.

    Ready when

    • Relevant DPIA templates reviewed: Triage, Documents and Ambient Scribe.
    • Your local DPIA completed, with risks and actions addressed.
    Request these documents
  4. Confirm clinical safety and technical readiness

    • Clinical Safety Lead
    • IT Lead
    • DCB0129 / 0160
    • Cyber Essentials Plus
    • DSPT
    • IM1
    • MHRA Class I · Scribe
    • DTAC

    Review the evidence against your local workflows.

    Ready when

    • DCB0129 safety case and hazard log reviewed; local DCB0160 responsibilities and actions agreed.
    • DTAC, Cyber Essentials Plus, DSPT, CHECK-standard penetration testing and IM1 integration evidence reviewed.
    • For Scribe, MHRA Class I registration and intended use reviewed; local readiness signed off.
    • For Documents, filing settings and high-impact code warnings reviewed.
    Request these documents
  5. Plan the rollout

    • Practice Lead

    Agree the launch date and how work will reach the right people.

    Ready when

    • Rollout plan agreed, with owners for receiving, reviewing and completing work.
    • Teams defined before routing rules are configured.
    • For patient-facing changes, communications planned at least two weeks before launch, with PPG involvement where possible.
  6. Set up and test

    • Practice Administrator
    • IT Lead

    Configure the products and clinical system you use.

    Ready when

    • Staff accounts and permissions checked; EMIS or SystmOne connection test passed.
    • For SystmOne, each user’s EHR username and the practice ODS code checked.
    • Relevant workflows tested, including Documents filing and routing, or Triage access days and hours.
  7. Prepare your people

    • Team Leads
    • Reception Lead

    Practise everyday tasks and brief reception before contacting patients.

    Ready when

    • Admin SOP reviewed and staff briefed on their tasks and escalation contacts.
    • For Triage or Andi, patient messages, website banners and FAQs prepared.
    • Staff know how to help patients who cannot use the service online.
  8. Go live and review

    • Practice Lead

    Launch the agreed workflows and support the first weeks of use.

    Ready when

    • Launch checks completed and support contacts confirmed.
    • For patient-facing launches, messages sent, answerphone updated and FAQs published.
    • First-week digital support arranged and an early review scheduled; plan to share patient-facing results in weeks two to four.

Policies, docs & support

Contracts and data protection

The DPA and product-specific DPIA templates are available on request. Your organisation completes its own DPIA; the supplier template supports that work.

Privacy policyTerms of serviceRequest a DPA or DPIA template
Clinical safety and integrations

Request the clinical safety case, hazard log and integration evidence for your selected products. DCB0129 concerns the supplier; DCB0160 concerns the organisation deploying and using the system.

NHS clinical safety guidanceRequest clinical safety and integration evidence
Security and assurance evidence

Review the scope and validity dates of the evidence: DSPT submission, Cyber Essentials certification, penetration testing and DTAC documentation.

Anima DSPT record · R3U6MView the linked Cyber Essentials certificateRequest current security and DTAC evidence