Compliance Dashboard
Regulatory roadmap, DPIA, data flows, and language guidelines
Regulatory Roadmap
Phase 1
Regulatory Classification
Complete
Confirm tool provides general health information only (not a medical device)
Avoid diagnostic/treatment claims in all user-facing content
Document intended purpose: "Supports informed decision-making"
Review against MHRA guidance on clinical decision support software
Phase 2
Data Protection & DPIA
Complete
Complete Data Protection Impact Assessment (DPIA)
Identify lawful basis for processing (legitimate interest / consent)
Implement privacy-by-design: no personal identifiers collected
Document all data processors (including AI providers)
Set data retention policy (30-day automatic purge)
Phase 3
Technical Safeguards
In Progress
Encryption at rest and in transit
UK/EU cloud hosting only
Anonymised logging (no PHI in logs)
Pseudonymisation pipeline for AI layer
Access control and audit logging
Phase 4
Content & Disclaimers
Complete
User-facing disclaimer on every screen
Consent gate before symptom collection
Avoid prohibited claims (diagnosis, clinical proof, outcome improvement)
Use approved language only (understand symptoms, informed decisions)
Phase 5
Ongoing Compliance
Pending
Periodic DPIA review (annual or on material change)
User feedback and adverse event monitoring
Data retention enforcement and purge verification
Staff training on regulatory boundaries