Neolung

Trust center

How Neolung protects your patients' data and your reports, for your information governance, clinical safety and IT teams. Updated 22 October 2026.

Invented cases only, for now

Neolung is used with invented cases until your organisation is approved for patient data. That needs your organisation's DPIA, its clinical safety sign-off (DCB0160) and an agreement with Neolung.

Where your data is kept

  • Hosted in LondonThe app, its database and its speech recognition run on Fly.io in London. The database and the speech service are on a private network, with no public address.
  • Photos and backups in LondonCase photos, profile files and database backups are kept in storage that holds data in London only.
  • Patient data only to AI in the UK or EUFor an organisation approved for patient data, dictations, slide photos and CV text go only to its own Azure OpenAI account in the UK or EU. Neolung checks the region on setup and on each answer that reports one, and turns the AI off if one comes from elsewhere. Your admin confirms the deployment type, which Neolung can't see.
  • Voice isn't kept by NeolungDictation audio is transcribed in London, or by your own Azure deployment under your agreement with Microsoft, whose retention terms apply.
  • On the deviceWork not yet saved when a session ends stays in the browser or the desktop app for up to 12 hours, not encrypted.

Encrypted

  • In transitHTTPS only, with HSTS.
  • At restThe database volume is encrypted. Every photo and file is encrypted (AES-256-GCM) before it leaves the server, so storage only ever holds ciphertext.
  • Your AI keysEncrypted, and never sent back to the browser.
  • BackupsThe nightly copy is encrypted with a key the hosting and storage providers don't hold; the daily snapshots stay on the hosting provider's encrypted volumes.

Only the right people see a case

  • Each organisation apartEvery request works in one organisation, checked on the server against the person's membership there; the database also stops records moving between organisations.
  • RolesConsultants and trainees read cases. Staff who don't report cases, such as managers or IT, never see case content. Only consultants given the permission sign.
  • Sign-inThrough Neolung's identity provider (OpenID Connect), with a second factor when you sign in, remembered while that sign-in session lasts: an authenticator app or a security key, never SMS. Signing in with your organisation's Microsoft Entra ID is planned.
  • Neolung's own staffDay-to-day actions go through a console that requires multi-factor authentication, and each is recorded. Approving patient data is done only by Neolung's owner, with a separate tool, also recorded.
  • Second opinionsOff until an admin turns them on. Whoever is asked sees one case, read-only, for 30 days at most.

Clinical safety

  • The pathologist decidesNeolung never signs or sends a report: the pathologist reviews, decides and signs.
  • The AI fills only what was said or seenFrom the dictation, or suggested from slide photos. Each value it filled is marked, and confirmed by the pathologist before signing. The pT and pN are checked against the findings by fixed rules, not by the AI.
  • Checks warn, never changeChecks against the guidelines point out what's missing or contradicts; they never change the report.
  • Patient identifiersText that looks like an NHS number, a hospital or laboratory number or a date blocks signing, and is refused in dictated text before it reaches the AI. Names, text inside images and identifiers spoken aloud aren't detected: users crop labels and don't say identifiers.
  • Only approved report typesWith patient data, an organisation can only start, sign or amend cases with report types Neolung's clinical lead has approved, version by version.
  • Signed is finalA signed report can't be changed. An amendment is a new version, with its reason; earlier versions stay.
  • Clinical risk managementFollowing DCB0129: a clinical risk management plan and a hazard log, kept with the code. Both are drafts until a Clinical Safety Officer is appointed and signs them.

Every action recorded

  • Audit logWho did what and when. The app can't edit or delete it: the database refuses it. It goes with your export, and is erased with the rest at the end of a contract.
  • EditsEach edit records which fields changed and where each value came from, never the values.
  • Each case's historyShown with the case to those who can see it.

Your data, yours to take and delete

  • Export everythingAn admin who reports cases can export, at any time, one file: every case with its signed reports and PDFs, photos, the team and the audit log.
  • At the end of a contractThe organisation is locked for 30 days with only the export open. Then every record and photo is erased, and Neolung sends you a certificate of deletion. Neolung keeps only the organisation's name, the dates and the record of the closure.
  • Deleted means deletedA deleted draft or a removed photo is erased after 7 days. A photo that is part of a signed report stays with that record.
  • Backups expireAfter 30 days, so what's erased is gone from them too by then.

Kept running

  • BackupsDaily snapshots of the database and a nightly encrypted copy, each kept 30 days. Restoring the nightly copy was tested on 20 October 2026.
  • MonitoringOnce a day: the site, its database and the latest backup. Checks every minute, with alerts on errors, aren't in place yet.
  • If something goes wrongA written incident plan (a draft, not yet exercised): we aim to tell your information governance contact within 24 hours of suspecting a breach, and your Clinical Safety Officer of a serious clinical safety issue within 24 hours, with what users should do meanwhile.
  • Reporting a vulnerabilityTo trust@neolung.io, under our published policy (security.txt). We confirm we received it within 3 working days.
  • Every change tested and reviewedTested automatically and reviewed independently (by a second AI agent) before it ships. Production dependencies are watched, and a known high or critical vulnerability blocks a release.
  • AccessibilityThe main screens are checked automatically against WCAG 2.2 AA before each release, on desktop and phone, in light and dark mode; a failure blocks the release. Not yet audited by hand, and the report PDF isn't tagged for screen readers yet.

Who handles your data

  • Fly.ioHosting, database and speech recognition, in London. A US company, certified under the UK Extension to the EU-US Data Privacy Framework; its data processing agreement is to be signed by Neolung's company.
  • TigrisStorage of photos, files and backups, in London, encrypted before it arrives, so it never holds file contents it can read. A US company: its data processing agreement provides for the standard contractual clauses with the UK Addendum, still to conclude in the name of Neolung's company.
  • Auth0 (Okta)Sign-in, in the EU. Okta, a US company, is certified under the UK Extension to the EU-US Data Privacy Framework, Auth0 included; its data processing agreement is to be accepted by Neolung's company.
  • ResendEmail, in the EU, under a signed data processing agreement; Resend is certified under the UK Extension to the EU-US Data Privacy Framework. Emails never carry patient data.
  • Your AI providerUnder your own contract. For patient data, only Azure OpenAI in the UK or EU.
  • OpenAINeolung's demo account, in the US: only for organisations without their own AI account, with invented cases. It will be removed before Neolung handles patient data.

Not done yet

Before Neolung is used with patient data:

  • Neolung's company and its registration with the ICO
  • A Clinical Safety Officer appointed, who signs the clinical safety case (DCB0129)
  • Clinical approval of each report type (all are drafts today)
  • Data processing agreements with Fly.io, Auth0 and Tigris in the name of Neolung's company, and a solicitor's review of the transfer assessment
  • Cyber Essentials certification
  • An independent penetration test
  • A manual accessibility audit (WCAG 2.2 AA), with the accessibility statement
  • The Data Security and Protection Toolkit (DSPT) submission
  • A second person able to respond to incidents, central logs with alerts, and a status page
  • Removal of the demo AI account
  • Registration as a medical device with the MHRA, under a quality system (ISO 13485)

The documents for your DPIA and DCB0160 (data flows, DPIA support, hazard log, security controls, DTAC evidence) are drafts. Ask for them, or about anything here, at trust@neolung.io.