In summary
Five domains, five commitments. Every one of them opens to the full evidence — what we commit to, how the suite meets it, and the charter clause or ADR it rests on.
Data, privacy & identity
No patient signs in, and no directly identifying patient information is held.
4 commitments
Accessibility
WCAG 2.2 AA is the floor, and every step carries a plain-language twin.
3 commitments
Clinical governance & safety
Nothing reaches a patient without a named clinician’s signature behind it.
6 commitments
Hosting, residency & portability
UK-hosted, and yours to take elsewhere at any time, at no cost.
3 commitments
For your practice manager
Registered, certified, insured, and the data-processing schedule published before you sign.
5 commitments
Data, privacy & identity
The patient-facing apps hold no directly identifying patient information and authenticate no patient — by design, not by policy.
Show the evidence — 4 commitments
| Area | What we commit to | How Patient Compass Suite meets it | Basis |
|---|---|---|---|
| No directly identifying patient information | No accounts, no logins for patients, no email capture. | The patient apps need no sign-in and hold no name, email address, date of birth or clinical identifier; reading choices are kept on the device only. A patient access token is pseudonymous, not anonymous — it is deliberately linkable to a record inside the clinician’s own environment. | Charter §7.2 · UK GDPR data-minimisation · ADR-0115 |
| No health data (PHI) | No patient-identifiable health information is stored, processed or transmitted. | Patients stay anonymous; the suite is a delivery layer for approved content, not a clinical record system. | Charter §7.2 |
| No patient authentication | Patients are never authenticated — absolute and unchanged. | Only clinicians authenticate, and only on The Helm (never a patient, never patient data). | Charter §7.2 · ADR-0107 |
| No tracking | No advertising trackers, no cross-site tracking, no behavioural profiling. | Cookieless, aggregate-only analytics (Plausible); nothing that can re-identify a user. | Charter §7.2 · ADR-0119 |
Accessibility
Accessibility-first delivery is the central clinical and commercial promise of the suite, not an add-on.
Show the evidence — 3 commitments
| Area | What we commit to | How Patient Compass Suite meets it | Basis |
|---|---|---|---|
| WCAG conformance | WCAG 2.2 AA minimum; AAA target for text contrast. | Audited against 2.2; reduced-motion respected, 44×44px touch targets, high-contrast support, no autoplaying media. | Charter §11.5 · WCAG 2.2 |
| Dual-track easy-read | Every step exists in both a standard and an easy-read version. | The choice is offered on the first screen and persists across the journey; easy-read is one tap away on every page. | Charter §11.1–§11.2 |
| Predictable structure | Branching is visible and predictable; nothing is hidden without reason. | A persistent progress indicator, plain-language branch labels, and content warnings before any anatomical detail. | Charter §11.4 |
Clinical governance & safety
Nothing reaches a patient until a registered clinician takes professional responsibility for it.
Show the evidence — 6 commitments
| Area | What we commit to | How Patient Compass Suite meets it | Basis |
|---|---|---|---|
| Informed consent | Supports patient-specific consent discussions. | Approved information about material risks and alternatives supports the clinical conversation; it does not establish consent or legal compliance. | Montgomery v Lanarkshire (2015) · §16.1 |
| Clinician sign-off | No content reaches a patient until a registered clinician signs it off. | Sign-off writes an immutable record: name, registration number, document + version, attestation and timestamp. | Charter §14 · ADR-0113 |
| Continuous source alignment | Content reflects the current approved source — no frozen content. | On source reissue, affected content is flagged for review, then realigned and re-signed within a defined workflow window. | Charter §14.1 · §15 |
| No clinical decision logic | The suite presents information; it never advises, triages or recommends. | No decision-making logic anywhere in the patient surfaces — it is not a clinical system. | Charter §7.2 |
| Complication data honesty | Literature-sourced and attributed; never fabricated or averaged. | Single cited values (authority + year + DOI); local-cohort figures only as an audited, clearly-labelled exception. | Charter §14.5 |
| Trust mark (where applicable) | PIF TICK certification, separate from publishing. | An optional clinician-ticked gate lights a patient-facing PIF TICK badge; it de-certifies automatically on source reissue. | ADR-0120 · ADR-0124 |
Hosting, residency & portability
UK-regional today, and movable to an environment your practice controls at no cost.
Show the evidence — 3 commitments
| Area | What we commit to | How Patient Compass Suite meets it | Basis |
|---|---|---|---|
| Hosting & residency | UK regional hosting. | Vercel UK configuration with managed TLS; content in a Sanity-hosted dataset. | Charter §7.1 |
| Migration path | Migration to hosting your practice controls, at no cost. | Your practice can move its hosting, content and web address to its own or an NHS-approved environment without losing its licence. | Charter §7.3 |
| Audit trail | A medico-legally defensible record. | Provenance metadata per content item plus full Sanity edit history (author and timestamp) constitute the audit trail. | Charter §15.4 |
For your practice manager
What a practice checks before adopting a supplier, in one place.
Show the evidence — 5 commitments
| Area | What we commit to | How Patient Compass Suite meets it | Basis |
|---|---|---|---|
| ICO registration | Registered with the Information Commissioner’s Office. | GGO Systems Limited, company no. 17268411, is registered with the ICO under number ZC174006. | ICO register · Companies House |
| Cyber Essentials | Cyber Essentials certified. | GGO Systems Limited holds Cyber Essentials certification, valid to 30 September 2027; the certificate is verifiable on the public registry. The mark is in the footer of every page. Verify the certificate (opens in a new tab) | Cyber Essentials (NCSC) · docs/legal/15 |
| Hosting and regions | Where each part of the service runs, stated plainly. | The website and the suite run on Vercel with a UK regional configuration; content lives in a Sanity-hosted dataset. The operational database (Neon Postgres) is configured in AWS London (eu-west-2); Neon publishes no guarantee that data never leaves that region. Website analytics (Plausible) are hosted in the EU (Germany). Clinician sign-in for The Helm uses Clerk (Clerk, Inc., USA); onboarding records and signed packs are held in Notion (Notion Labs, Inc., USA). Both are listed as sub-processors in the data-processing note. See the data-processing note | Charter §7.1 · Data-processing note §3 · Provider records (Neon, Vercel) |
| Insurance | Insured for professional indemnity and public liability. | Professional indemnity and public liability cover, £1m each, with Hiscox. | Policy schedule held by GGO Systems Ltd |
| Data-Processing Agreement and Information-Governance Note | The data-processing schedule is public before you sign. | Read the Data-Processing Agreement and Information-Governance Note before you sign. It is the schedule your practice acknowledges during onboarding, and it is published in full. Read the Data-Processing Agreement and Information-Governance Note | Tenant Licence schedule · docs/legal/05 |
In plain words
The matrix above, restated as plain statements — each one stands on its own.
Patients never create an account on Patient Compass Suite and are never authenticated. They reach their pathway through a link issued by their own clinical team, and they cannot self-enrol. The patient-facing apps hold no directly identifying patient information and no patient health information. The patient access token is pseudonymous, not anonymous — it is deliberately linkable to a record inside the clinician’s own environment. The platform is cookieless, runs no advertising trackers, and uses only aggregate, non-re-identifying analytics.
Nothing patient-facing is published until a registered clinician signs it off; the sign-off records the clinician’s name, registration number, the document and version, and a timestamp. Published content is versioned, so there is a record of exactly what the information said, in which version, on any given date. Every pathway records the approved source document it reflects and is flagged for review when that source is reissued. Complication figures are single values from a cited source — never an averaged range — and figures taken from the literature say so in the patient-facing text.
Every pathway step exists in a standard and an easy-read version, with the choice offered up front and available on every page. The patient surfaces are built to WCAG 2.2 AA, with an AAA target for text contrast. The suite contains no clinical decision logic: it presents information and never advises, triages or recommends. Hosting is UK-regional, and your practice can move its hosting, content and web address to its own or an NHS-approved environment without losing its licence.
On the accessibility duty itself — what the Accessible Information Standard (DAPB1605) requires of a surgical service, and where private practice stands — see the Accessible Information Standard, applied to surgical patient information.
For a practice manager’s checks: GGO Systems Limited (company no. 17268411) is registered with the Information Commissioner’s Office under ZC174006, holds Cyber Essentials certification, and carries professional indemnity and public liability cover of £1m each with Hiscox. The Data-Processing Agreement and Information-Governance Note a practice acknowledges at onboarding is published in full at /data-processing, before anyone signs.
Declared openly
What the suite does not claim.
Because there is no patient sign-in and no patient identifier, the suite does not, on its own, prove that a named individual viewed a given asset. Its defensibility is at the population level: more complete, more accessible, dual-track content, kept aligned to the current approved source, with a clinician sign-off audit trail. That limitation is stated upfront — it is a known boundary, not a hidden defect.
Video tutorials
See the review and release controls
Explore how a team inspects patient information, completes a review and looks back at earlier releases. These demonstrations do not establish that a patient has read, understood or consented.
Recorded with demonstration data and British English synthetic narration.
Inspect information before the consent conversation
Inspect risks, options and source information before an individual discussion.
0:58 · British English · Alistairn synthetic narration
Recorded with demonstration data. YouTube loads when you press Play.
Read transcript
Inspect the information
Before an individual consent conversation, inspect the information. This offline example contains no clinical advice or risk figures.
Compare both reading versions
Read the risks and options section. Switch between Standard and Easy-read to inspect both versions before discussing the information.
Check the recorded references
Content and references shows the sources recorded for each part. A listed reference is not proof of support. This example still needs source review.
Inspect source details
Open Sources and evidence to inspect source details. Here, Not checked means the source has not been verified. No approval is being recorded.
The patient’s reading choice
On the patient page, open Display settings and turn on Easy Read. Close the settings to read the simpler version of the demonstration step.
Return to the conversation
The reader can return to the standard version. These controls support reading; they do not show understanding or replace the individual consent conversation.
Review and approve the information your patients will see
Review standard and easy-read information and complete clinical approval.
1:16 · British English · Alistairn synthetic narration
Recorded with demonstration data. YouTube loads when you press Play.
Read transcript
Read both versions
In the Helm, open Review changes. Read the standard and easy-read versions against the approved source. This fictional demonstration contains no medical advice. Check the meaning in each version, not just the wording.
Check the recorded sources
Scroll to Content and references to inspect the references recorded for the section. A listed reference does not prove that every passage is supported. Resolve any gaps before approving the information.
Review every changed section
After reading a changed section to its end, choose Mark as reviewed for this release. Repeat for every changed section. These review marks prepare the release; they do not release content to patients.
Name the release
Choose Continue to release and give the release a clear name. The Helm adds the version number. Check the responsible reviewer and read the clinical responsibility statement before confirming it.
Approve the reviewed release
Only confirm when you are satisfied with the reviewed information. Sign-off releases the content for patients. Here, the real interface shows a synthetic local result: no clinical signature or release is created. There is no separate required publish step.
See exactly what an earlier release said
Open an earlier release and inspect the information it contained.
1:33 · British English · Alistairn synthetic narration
Recorded with demonstration data. YouTube loads when you press Play.
Read transcript
Earlier release
See exactly what an earlier release said. These are synthetic content archives, with no genuine sign-off.
Choose two versions
Choose Compare beside the earlier version. Then choose a second version to compare.
Compare recorded sources
The comparison runs from the earlier release to the later one. Evidence changes show the recorded source details: here, edition one becomes edition two.
Inspect the wording
Open the changed page to inspect its wording. Read Before and After together. This example changes the welcome sentence.
Return to the list
Clear the comparison to return to the version list.
Open the earlier release
Choose See it as it was beside the earlier release. This opens its archived documents, rather than a replay of the patient screen.
Inspect the stored record
Expand the document to inspect the words and source details stored in that version. The original welcome sentence and the earlier source edition remain in this record.
Content history
Content history records what was stored. It does not establish patient access, delivery or reading.
Reviewing us for adoption?
We are glad to walk a clinical-governance or information-governance team through any line of this matrix. Ask for it in your demo request.
Orientation summary for clinical and information-governance reviewers — not legal advice and not a contract. It reflects the platform charter and the architecture decision records; where a signed agreement differs, the signed agreement governs.