Snapshot 257730
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Heidi Health builds AI tools that take the admin burden off doctors, so they can focus on what matters most, their patients. Our platform helps with things like writing up patient notes, managing templates, creating care plans, and even sorting out billing. We use natural language processing and machine learning to do this in a way that feels simple and intuitive for clinicians. Whether you're in a hospital, clinic, or on the go, Heidi is built to fit into your day without getting in the way. By taking care of the repetitive admin work, Heidi helps make healthcare more efficient and accurate while giving clinicians back time for their patients and themselves. Compliance SOC 2 ISO 27001:2022 ISO/IEC 42001:2023 HIPAA GDPR UK Cyber Essentials Plus Australian Privacy Principles C5 (Cloud Computing Compliance Criteria Catalogue) DE TX-RAMP PIPEDA POPIA (South Africa) Q Quebec Privacy Act, Quebec Canada (Law 25) P Personal Information Protection Act (PIPA) and Health Information Act (HIA)- Alberta, Canada P Personal Health Information Protection Act (PHIPA) - Ontario, Canada P Personal Health Information Protection Act (PHIA) Manitoba, Canada P Personal Information Protection Act (PIPA) British Columbia, Canada P Personal Health Information Act (PHIA) Nova Scotia Canada H Health Information Protection Act (HIPA)Saskatchewan, Canada P Personal Health Information Act (PHIA) Newfoundland and Labrador, Canada H Health Information Act (HIA) Prince Edward Island, Canada P Personal Health Information Privacy and Access Act (PHIPAA) New Brunswick, Canada Personal Data Protection Act 2010 (PDPA), Malaysia Personal Data Protection Act 2012 (PDPA), Singapore Personal Data (Privacy) Ordinance (PDPO, Cap. 486), Hong Kong Resources View all Certifications ISO/IEC 42001:2023 Certification View 2 more NHS Compliance Documentation Heidi Clinical Risk Management Plan.pdf Data Processing Agreement (UK) UK Incident Response Plan System Security Plan View 14 more EU Compliance documentation Data Processing Agreement (EU/GDPR) Data Processing Agreement (Spain) Data Processing Agreement (South Africa) DPIA Scribe (EU) View 2 more Canadian Compliance Documentation PIA (Ontario) PIA (British Columbia) PIA (Alberta) View 5 more Other resources Personal Information Impact Assessment (PIIA) (South Africa) v.1.pdf Data Processing Agreement (German) Heidi Business Associate Agreement Controls View all Infrastructure security Device and media disposal policies implemented Device and media movement recorded Media removal policies implemented View 6 more Infrastructure security controls Organizational security Device and media disposal policies implemented Device and media movement recorded Media removal policies implemented View 6 more Organizational security controls Product security Device and media disposal policies implemented Device and media movement recorded Media removal policies implemented View 6 more Product security controls Internal security procedures Device and media disposal policies implemented Device and media movement recorded Media removal policies implemented View 6 more Internal security procedures controls Data and privacy Device and media disposal policies implemented Device and media movement recorded Media removal policies implemented View 6 more Data and privacy controls Data collected Customer personally identifiable information Employee personally identifiable information Credit card information Personal health information Subprocessors View all Amazon Web Services • Cloud provider Provides on-demand cloud computing platforms and APIs. We utilise AWS for data storage and hosting facilities in certain regions such as US, Canada, EU, UK, Australia and Switzerland. Stripe • Finance and payments (No PHI) Payment services provider (No PHI) Google Cloud Platform (GCP) • Cloud Storage and Processing Provides hosting and processing for many of our AI models Microsoft Azure • Cloud provider Provides on-demand cloud computing platforms and APIs. We utilise Microsoft for data storage and hosting facilities in certain regions such as US, Japan, Australia, Sweden and UAE. FAQ View all Updates View all Compliance Cyber Essentials Plus certification Published July 6, 2025 We’re proud to share that Heidi is now Cyber Essentials Plus certified. Cyber Essentials Plus is a UK government-backed certification that involves a hands-on technical audit of our systems to confirm that essential security controls are in place and functioning effectively. This includes real-world testing of our defences against common cyber threats such as malware, phishing, and unauthorised access. This certification builds on our existing ISO27001, SOC 2 Type II, ISO9001, GDPR and HIPAA compliance frameworks, and is another step forward in our commitment to protecting sensitive health information and maintaining best-in-class security practices. For questions about our security and compliance posture, or to request a copy of our latest certification reports, please contact us at compliance@heidihealth.com. Compliance New NHS England Guidance on the Use of Ambient Voice Technology Published April 29, 2025 NHS England has just released pivotal guidance on using AI-enabled ambient scribing products (https://www.england.nhs.uk/long-read/guidance-on-the-use-of-ai-enabled-ambient-scribing-products-in-health-and-care-settings/Opens in new tab) in healthcare. At Heidi, we're genuinely excited to see this guidance because it provides clear, practical steps for healthcare teams keen to embrace AI responsibly and effectively. Here's an approachable breakdown of what this guidance involves, alongside practical tips for healthcare providers—and importantly, how Heidi supports you every step of the way: Clinical Safety and Risk Management (DCB0160 Compliance) What You Need to Do: Assign a Clinical Safety Officer and complete your own DCB0160 clinical safety assessment, documenting potential risks and outlining clear mitigations. How Heidi Helps: Heidi has thoroughly completed our DCB0129 clinical safety assessments, and our detailed documentation can support you in preparing your own DCB0160. Our team collaborates closely with your clinical safety officers, providing guidance and support every step of the way. Data Protection Impact Assessment (DPIA) What You Need to Do: Conduct your own DPIA to clearly identify and mitigate any privacy risks, ensuring patient data is handled securely and transparently. How Heidi Helps: Our team has compiled all necessary documentation, examples, and resources that can assist you in completing your DPIA. Reach out to us anytime for expert advice and practical support—we're here to simplify and clarify the process, ensuring you have all the tools needed for successful compliance. Transparency and Patient Engagement What You Need to Do: Clearly communicate to your patients about how their data is being captured, processed, and protected. Ensure they’re fully informed and comfortable with the technology used during their visits. How Heidi Helps: Transparency is integral to Heidi. We provide patient-friendly resources such as easy-to-understand leaflets and digital consent tools, helping your patients understand exactly how their data is used and providing reassurance during their interactions. Information Governance and Security Assurance What You Need to Do: Validate robust data governance and security measures, thoroughly vetting third-party providers and regularly reviewing your security practices. How Heidi Helps: At Heidi, security is foundational. Our platform holds ISO27001, Cyber Essentials, SOC2 certifications, and our rigorous vendor assessments are fully aligned with NHS requirements. Rest assured, your data—and your patients' data—is protected to the highest standards. Staff Training and Competence What You Need to Do: Ensure your team is trained, confident, and skilled in using ambient AI tools, clearly understanding the strengths and limitations of the technology. How Heidi Helps: Our training programs are designed to empower your clinical teams through practical workshops and continuous, accessible support. Our dedicated support team is always available to assist, ensuring everyone feels confident and skilled in using Heidi effectively. The new NHS guidance represents an important milestone toward safely integrating AI technology into healthcare. At Heidi, we’re committed to making these steps clear, manageable, and stress-free. We’re here to support you throughout your journey, helping you streamline workflows, reduce administrative stress, and enhance patient interactions in a secure and compliant way. If you need any help or have any questions, get in touch with us! Compliance Heidi is now ISO 9001 certified! Published April 25, 2025 We’re proud to share that Heidi is now ISO 9001 certified—ISO 9001 is an internationally recognised standard for quality management systems. This certification reflects our commitment to delivering a consistently high-quality, reliable product and ensuring continuous improvement across all aspects of our operations. For our healthcare partners, ISO 9001 provides assurance that Heidi is built and supported through comprehensive, accountable processes that prioritise safety, customer satisfaction, and service excellence. Compliance NHS Compliance documents available Published March 25, 2025 We are committed to supporting safe, responsible, and compliant adoption within NHS settings. All NHS clinicians, practice managers, and data protection professionals can request access to the key documentation required to bring Heidi into your practice, including: DCB0129 Clinical Risk Management Compliance DPIA Digital Technology Assessment Criteria (DTAC) To request access, please visit our Trust Centre (https://trust.heidihealth.com/Opens in new tab) and scroll down to the Resources section in the bottom-left corner. From there, you can submit a request for the relevant documents. Our compliance team will review your request and provide access as appropriate.