Heidi Health

Security and Compliance Review

The following assessment covers Heidi Health's approach to data protection, security controls, and compliance alignment relevant to UK veterinary practices. This review reflects information submitted directly to VetStack's vendor assessment process and documentation available at the time of assessment.

GDPR and Data Protection

• Data Processor Status. Heidi operates as a data processor on behalf of UK clinics, with the practice retaining data controller responsibility. This is the correct contractual structure for this type of technology relationship.

• Data Processing Agreement. A completed DPA suitable for UK clinical use is available and forms part of the contractual relationship.

• Patient Consent Infrastructure. Consent pop-ups can be configured and customised within the platform, with supporting materials available for waiting room use.

Data Storage and Residency

• Primary Data Location. Customer data is stored and processed in the UK. This is a stronger position than EU-only storage and is directly relevant for practices operating under UK GDPR.

• Residency Controls. Clinics can choose or restrict data residency, providing an additional governance control for practices with specific requirements.

Audio Retention and Data Use

• Audio Retention. Raw audio is not retained after transcription. Audio is processed and discarded; only the generated text output is held.

• Model Training. Customer audio and text data are not used to train AI models under any circumstances. This is confirmed unambiguously in the submission.

Encryption and Technical Controls

• Encryption in Transit. TLS 1.2 or above.

• Encryption at Rest. AES-256 or equivalent.

• MFA. Multi-factor authentication is supported.

Certifications

• ISO 27001

• SOC 2

• Cyber Essentials Plus

• ISO 9001

• ISO 42001

• HIPAA
  

ISO 42001 (AI Management Systems) is relatively rare in this market segment and indicates a structured, audited approach to AI risk management beyond information security alone. Cyber Essentials Plus is a UK government-backed standard and is a useful reference point for NHS-adjacent and UK public-sector-aligned organisations.

Clinical Safety Governance

Heidi reports operating under a DCB0129 Clinical Safety Case. This is a structured clinical risk management framework derived from NHS Digital standards for health software. It is not a veterinary-specific regulatory requirement, but its application here represents a materially higher level of safety governance than the absence of any equivalent framework.

Post-deployment monitoring is conducted independently by Bordercross Health. Heidi reports that clinical errors are triaged within one business day through a formal Clinical Safety Management System.

Key accuracy benchmarks reported by Heidi (self-reported, not independently verified by VetStack):

• 99.1% accuracy rate for high-severity clinical information

• Medical speech-to-text Word Error Rates of 0.07 to 0.16

Model Updates and Change Management

Heidi's change management process for model and algorithm updates includes:

• Staged rollout through development, staging, and pilot environments before production release

• Clinical Safety Officer approval required before any update reaches production

• Minimum 95% transcription accuracy required; rollback within 48 hours if not maintained

• Emergency rollback for critical safety issues within 4 hours

• Minimum 30 working days notice to customers for major updates

• Planned maintenance restricted to 23:00 to 05:00 UK time with at least 14 days notice

This is a notably structured approach relative to the broader market and reflects the governance obligations imposed by ISO 42001 and DCB0129.

Hallucination Mitigation

Heidi's approach to reducing clinical inaccuracies includes:

• Bounded prompting, constraining outputs to facts present in the consultation transcript

• Clinical entity extraction with post-generation validation checks

• Confidence scoring and uncertainty indicators

• Mandatory clinician review before any note enters the clinical record

• Side-by-side transcript display to support verification at the point of review

Clinicians do not interact directly with the underlying language model. The architecture is designed to prevent hallucinated content from reaching the clinical record without passing through explicit human review.

Summary Assessment

Heidi Health's compliance posture is strong across every material data protection checkpoint relevant to UK veterinary practice. UK data residency, a completed DPA, confirmed no-training data use, audio deletion post-transcription, and a broad certification stack collectively place Heidi at the more robust end of the assessed cohort.

UK GDPR Alignment

Strong. Correct processor/controller structure, completed DPA, confirmed no training use.

Data Residency

UK-based storage and processing. Residency controls available to clinics.

Audio Retention

Audio deleted after transcription. Not retained.

Certifications

ISO 27001, SOC 2, Cyber Essentials Plus, ISO 9001, ISO 42001, HIPAA.

Clinical Safety

DCB0129 Clinical Safety Case. Independent post-deployment monitoring by Bordercross Health.

Change Management

Formally governed. CSO sign-off required. 30 working days notice for major updates. 4-hour emergency rollback SLA.

UK Presence

UK legal entity. UK-based support team. In-person training available.

Notes and Limitations

This review is based on information submitted directly to VetStack's vendor assessment process and publicly available material at the time of assessment. It is not a legal certification, authorised compliance seal, or formal security audit performed by VetStack. Practices should conduct their own contractual and technical due diligence to confirm suitability within their specific governance and regulatory contexts.

VetStack is vendor-agnostic and takes no referral fees from any supplier assessed in this process.