Trust centre and standards: clinical safety (DCB0129), the National Health Service (NHS) Digital Technology Assessment Criteria (DTAC) and medical device regulationHow Orwyn is held to account.
Building to the standard before anyone requires it
Clinical software earns trust by being open to inspection, and that applies to the company as much as the code. This page sets out the standards Orwyn is being built to, and where each one stands today. Where work is in progress, this page says so. We will only claim that Orwyn formally meets a standard once the assessment or certification is complete.
Where each one stands today
Status on 15 October 2026
| Area | Status | What that means |
|---|---|---|
| Clinical safety (DCB0129) | In place | Process in place, with a named clinical safety officer; safety case report in progress. The clinical safety officer is Dr Arj Imbuldeniya, appointed on 19 August 2026. |
| NHS Digital Technology Assessment Criteria (DTAC) | Being mapped | Orwyn is being mapped against every DTAC criterion as it is built. |
| Cyber Essentials | Planned | Certification is planned before Orwyn is first used in a service. |
| Data protection registration with the Information Commissioner’s Office (ICO) | Registered | Orwynhealth Ltd is registered with the ICO, number ZC270779. |
| Medical device regulation: UK Conformity Assessed (UKCA) marking | Not certified | Built towards the standards for regulated clinical software. Not certified. Formal software records to be set up before Orwyn is first used in a service. |
| Data Security and Protection Toolkit | Planned | Planned before Orwyn is first used in a service. |
What we build to, and where each one stands
Clinical safety: DCB0129
DCB0129 is the NHS clinical risk management standard for manufacturers of health software. It requires a named clinical safety officer who is a suitably qualified and experienced clinician. That role is held by Dr Arj Imbuldeniya, appointed on 19 August 2026, who is also the author of the clinical rules. The standard permits this, and it is usual at our stage. We state it plainly rather than imply a separation that does not exist.
A hazard log and a clinical risk management plan are in place. A hazard log is a list of what could go wrong and how each risk is controlled. Orwyn's knee safety rules are written and reviewed by its clinical safety officer. The current demonstration (version 0.19, October 2026) uses draft rules awaiting final sign-off, and example patients only. Before Orwyn goes live in any service, the clinical safety case report will be completed. The NHS organisation will also carry out its own assessment, with our support. That assessment follows DCB0160, the companion standard for organisations that use health software. An independent clinical review is planned before Orwyn is first used in a service.
Status: clinical safety officer appointed 19 August 2026. Safety rules in draft for evaluation, awaiting final sign-off. Safety case report in progress. Independent review planned, not yet in place.
Medical device regulation
Orwyn is health technology being built towards the engineering and documentation standards expected of regulated clinical software under UK medical device regulation. No decision on how Orwyn is classified will be made without specialist regulatory advice. We intend to certify Orwyn.
Status: built towards the standards for regulated clinical software. Not certified. Formal software records to be set up before Orwyn is first used in a service.
NHS Digital Technology Assessment Criteria
The DTAC sets the minimum checks the NHS expects of digital health technologies. It covers clinical safety, data protection and technical security. It also covers how well a product works with other systems, and how easy it is to use. Orwyn is being mapped against every DTAC criterion as it is built. The aim is to be ready if an NHS organisation assesses it.
Status: mapping in progress.
Data protection and cyber security
Orwyn is designed from the start around UK data protection law, including the UK General Data Protection Regulation (UK GDPR). Collecting as little data as possible (data minimisation) is the starting point, not an afterthought. This website sets no cookies and runs no advertising or tracking; page visits are counted without cookies. Cyber Essentials certification is planned before Orwyn is first used in a service, alongside the NHS Data Security and Protection Toolkit.
Status: nothing collected from patients; certifications planned before Orwyn is first used in a service.
Nothing collected back from the patient
Orwyn collects nothing back from the patient: no app, no login, nothing to fill in. If an NHS organisation uses Orwyn, we intend the clinician’s record of the consultation to be held for that organisation. It would stay under that organisation’s control, in the UK, with access logged. Where and how it is held will be agreed with each organisation before any use.
Who handles data for the demonstration
| Supplier | What it does | Where | Safeguard for data leaving the UK |
|---|---|---|---|
| Supabase | Database and server functions | London (UK) region | UK Addendum to the EU standard contractual clauses, in its data processing agreement |
| Vercel Inc. | Hosting for this website and the demo | USA, with a global network | UK Addendum, in its data processing agreement |
| Twilio Inc. | Demo text messages | USA | UK Addendum to the EU standard contractual clauses |
| Resend | Demo emails | Sends from Ireland; main processing in the USA | UK Addendum to the EU standard contractual clauses |
These serve the demonstration, which uses example patients only. Every supplier will be reviewed again before any real patient’s data is handled.
Who writes what you read here
The reference pages on this site are written by Dr Arj Imbuldeniya, consultant orthopaedic knee and hip surgeon. They draw on national guidance from NHS England and the relevant professional bodies. Every important claim is linked to its source. If anything is out of date or wrong, tell us and it will be corrected. No organisation named or linked on this site has reviewed, approved or endorsed Orwyn.
Privacy, safety and evidence
What this website does with your information is set out in the privacy notice. How the clinical rules are kept safe is on the safety page. What has been tested, and what the first trial will measure, is on the evidence page.
Accessibility statement
This website aims to meet the Web Content Accessibility Guidelines (WCAG) 2.2 at level AA. If anything on it is hard to read, hear or use, please tell us at hello@orwynhealth.com. Say which page it was and what went wrong. We will fix it, or send you the information in another format.
Security questions
Questions about security, or a security problem you have found, can be sent to hello@orwynhealth.com.
Surgeon-governed decision support for first contact musculoskeletal (MSK) clinicians.
The demo uses draft rules awaiting final sign-off, and example patients only.