WealHealSecurity & subprocessors
Implemented controls, assurance gaps and hosting information.
Company details and legal review are outstanding. These pages do not certify legal or clinical compliance.
Implemented foundations
Care-data requests require authentication. Organisation-scoped data policies restrict access. Care record and service-user writes create audit events. A central deployment control can pause care writes. Browser inactivity sign-out is implemented, but is not a server-enforced session timeout.
Infrastructure and assurance
The database and authentication platform is delivered through Lovable Cloud; database region is Ireland. The application uses Lovable hosting and asset delivery. A contractual subprocessor inventory, exact legal entities and onward locations must be confirmed. This page does not claim ISO 27001, Cyber Essentials, DSPT completion, penetration-test clearance or CQC certification.
Outstanding operational controls
Independent penetration testing, tenant-policy regression testing, enforced MFA, offboarding, backup retention and restore drills, monitoring and incident response must be verified before sensitive production reliance. See the software review for current findings.