Built for Trust. Designed for the NHS.

EMMA is fully DTAC-approved, DSPT-compliant, and Cyber Essentials Plus certified.

All patient data is processed within NHS-approved Microsoft Azure data centres in England, encrypted at rest and in transit using AES-256-bit encryption.

Every release is reviewed under DCB0129 and DCB0160, ensuring continuous compliance and clinical safety.

Your surgery remains the data controller under UK GDPR.

QuantumLoopAI acts as the data processor, handling information only under your instruction and solely for the purpose of supporting patient care.

Our Data Processing Agreement clearly defines these roles and responsibilities.

All data is encrypted end-to-end using TLS 1.2+ and AES-256, stored only within the UK.

We operate a Zero-Trust Security Model, maintain immutable audit logs, and conduct regular CREST-accredited penetration tests.

Independent cybersecurity reviews are completed annually and after every major update.

Yes.

QuantumLoopAI holds Cyber Essentials and Cyber Essentials Plus certification, verified by independent government-approved assessors to confirm our defences against cyber threats.

To manage calls and automate administrative workflows, EMMA processes:

• Patient contact information and call details

• Interaction transcripts and outcomes

• Administrative and triage data logged during calls

  All data remains within NHS-approved cloud infrastructure, processed strictly under NHS information governance requirements.

Yes — but securely.

Every patient call is recorded, transcribed, and auditable. Surgeries can review calls for training, governance, or complaint handling.

Access is strictly limited to authorised practice users and all call data is fully encrypted.

If a call disconnects unexpectedly, SOPHIA, our intelligent SMS follow-up assistant, automatically reaches out to the patient to complete the interaction.

This ensures no patient is left behind and that all contacts remain traceable.

No separate consent is required for EMMA’s operation.

Under UK GDPR, data is processed under Article 6(1)(e) and Article 9(2)(h) — supporting the provision and management of healthcare.

This is the same legal basis used for normal surgery communications and clinical systems.

EMMA runs entirely on Microsoft Azure’s NHS-approved UK cloud infrastructure, meeting all NHS Digital and NCSC security requirements.

No patient data is transferred or stored outside the UK.

Yes.

Every call, transcript, and action is timestamped, logged, and fully auditable.

Surgeries can review these records for internal governance, CQC compliance, or clinical safety audits at any time.

In the unlikely event of downtime, calls are automatically re-routed to your existing phone system within seconds.

This built-in failover ensures no disruption to patient access or continuity of care.

Absolutely not.

QuantumLoopAI never shares, sells, or repurposes data for marketing, analytics, or any non-clinical use.

Your data remains yours — under your control, within the NHS environment.

All deployments are overseen by a dedicated Clinical Safety Officer, supported by an Advisory Board chaired by Sir David Sloman, former NHS England COO.

Every new release undergoes formal hazard logging, testing, and clinical sign-off.

We provide NHS partners with all required documentation, including:

• DTAC and DSPT certificates

• DPIA templates

• DCB0129 Clinical Safety Case Report

• Cyber Essentials Plus verification

  All available on request.

QuantumLoopAI was built for the NHS — by clinicians, engineers, and patients.

Unlike generic AI systems, EMMA is designed around primary care workflows, meeting every NHS assurance standard while improving patient experience and staff wellbeing.