2022 - GC4 “Compliance is Queen”

2022 - GC4 “Compliance is Queen”

Hey Friend👋🏽,

We’re the startup automating away admin tasks in Primary care. The last time I wrote to you, we celebrated hiring our Founding Engineer (Neil). Today, we’re incredibly excited to introduce Dr Lydia van Hamel-Parsons; Healthtech-1’s Founding Clinician.

Lydia brings a super rare combination of health-tech experience. On the health side, Lydia is a NHS GP, meaning that she deeply feels and understands the pressures in primary care 💙. On the tech side, she worked as accuRx's second employee before founding her own healthcare admin automation startup (EF 2021). Intro’d by a fellow DH.L Accelerator founder, a 10-minute call confirmed an unreal alignment of vision and purpose 🤯. Lydia is bold, thorough, energetic anddd … absolutely hilarious 😂! Have no doubts, we’re building a world class team to plug the NHS staffing gap. This is an age old story of doing more with less.


You know the drill by now - Growth Cycle 4 “Compliance Is King Queen 👑 ” (see what I did there 😏), covered the 6 weeks between Monday 9th May & Friday 17th June. So let’s get to it:



In this cycle, compliance took the centre stage, we:

  • ⚠️ Created a Healthtech-1 Hazard Log (Lydia’s test project). It goes without saying, that products interacting with patients must be clinically safe. To ensure digital products meet a safety standard, NHS Digital ask providers to complete a clinical safety review called the DCB0129, of which, the Hazard Log is a key component. Critically, being DCB0129 compliant is required to access key NHS APIs.
  • 🍞 Created a unique employment offer with First 4 Health Group. One of our unfair advantages is that we’re partnered with my parent’s GP practice. That means we were able to offer Lydia a unique employment offer: 1 day clinical & 4 days healthtech startup all within the same building 🤗. Lydia simultaneously gets to have impact 1-1 and at scale. Ht1 gets a team grounded in the everyday reality of primary care. This contract sets a precedent for future hires. Like Hovis, it’s the best of both. Can you imagine a growth team of GPs?
  • 🆕 Updated our Data Protection Documentation. Good products are always in flux. Secure products assess these changes as they happen. Our product has changed a lot since our first compliance run through. When speaking to central NHS bodies, we wanted to be unquestionable. So we’ve hired a straight talking Data Protection Officer (DPO) - more on him 👇. Together we reassessed our data security and compliance, made security improvements and updated our documentation.


  • 💻 Launched a new interface; the Practice Portal. Based off our DPO’s recommendations, we built a new practice interface. Beforehand, when a new patient registered, we’d send a full copy of their details to the practice via E-mail. Now, this information is protected in a secure portal. Email notifications are now an option, and we’ve got a new interface to communicate with practices. Pete did some incredible work here 👏👏👏 He deployed the portal, gathered feedback, and improved on it, all whilst juggling customer service and operations. He’s finding his flow, it’s a beauty to behold 😌
  • 🎉 Sally’s practice sign! - 10/10 of our original pilot practices have converted to paid! Remember Sally? (not her real name) The receptionist who loved patient registrations? Here’s what her manager had to say. “The portal is fab and easy to navigate. Now Sally isn’t getting email notifications of every registration she’s managing her workload better. We’re keen to carry on with automated registrations, it seems like a step backwards bringing them back in-house”.
  • 📈 Developed Bot Analytics. Producing custom analytics from a form is one thing, producing analytics on 1000s of automations is another. We’ve finally got aggregated data on where our automations fail. 80% of our automations complete on the 1st attempt & only 7% are passed-over to practices. This is one step closer to the mythical land of no-touch! Hat’s off to Neil our data cowboy 🤠


  • 🤨 Data security & compliance is confusing. DPIA, DPA, DSPT, GDPR, UKGDPR, Data Addendums, EU SSCs… Privacy Shield… HIPPA… there’s a lot to consume. In this confusing space, buyers look for badges of security and safety. If all your data is stored and processed in the UK, you’re good ✅. Before building the practice portal, we were securely processing personal patient data outside of the UK via our email provider. As a favour, we asked Umar (then First 4 Health Group’s DPO) to cast a discerning eye over our data flows, and he spotted the ‘out of country’ transfers. With one eyebrow raised, he asked. “Do you have Data Addendums with these providers?” He was met with blank faces. In a start up, time is relative. You’re bombarded with so much new info that the work you completed last week, feels like last year 😅. Pete took this one, “Umm, this provider is signed up to the privacy shield.” Umar cut in, “Well the privacy shield doesn’t mean shit here as you’re processing personal sensitive data.” He went on. “You and I know why you’re using these providers; you want to use the best tools. But your customers won’t understand that, all they’ll see is foreign processing of data. You need to have all your data processed in the UK, or signed Data Addendums in place. I’d opt for the former; the less questions the better.” Pete built the practice portal in a weekend. I read every one of the above documents and ensured we had legal agreements with our sub-processors documented and published. We then hired Umar to act as our Data Protection Officer. Umar provides DPO services to over 2000 GP practices and the Department of Health and Social Care. He’s pragmatic, excellent and has connections 🔗.
  • 📖 Theory and practice are different. A CCG requested we change the patient registration form to enable patients to register without providing an address. I read the registration authority’s guidance on Homeless patients: “In the field for the patient’s address, please enter the full address for the GP practice instead” 🔡. “How wonderfully simple”, I thought, giving clearance for go live. “What could possibly go wrong 🤷🏽‍♂️? Almost universally, our surgeries disagreed with the change!

“Hi Raj… I am a bit concerned about the prominence of this button…”

“Hi Raj… this button may be utilised by patients who are not genuinely homeless…”

“Hi Raj… our policy is NOT to use the practice address for registration, as we assume clinical risk for the patient… sorry, buy we’ve just found what works best over years of experience!”

By this point, we had 70 patients who had registered without an address, 51 of which had their addresses incorrectly coded on the clinical system. “Not again!” I thought. In our first incident, we had the correct patient data sitting in a neat table ready to be recoded. This time we were missing the patient’s address 🤦🏽‍♂️.

Pete convened an incident meeting. The sun set as the realisation dawned that we’d have to chase 70 patients for their missing addresses. Debate ensued. Then, genius struck ⚡️. With a tempo of keystrokes Pete carved out the registration form’s address page into a separate microform.

The microform went out, and within 24 hours 80% of patient records were corrected. Pete had inadvertently built the prototype for a compelling new feature - the ability to update patient details post-registration💡 - which incidentally is a new contracted requirement for GPs.

But what happened to remaining 20%? Neil chased, and chased. Emails, phone calls, carrier pigeons 🕊 - you name it. The experience made us truly empathise with the patient recall experience, and opened our eyes to a large new adjacent market 👀

The takeaways are basic 🥡:

  1. Theory and practice are different (especially in healthcare!)
  2. Consult your customers

So what’s next? GC5 entitled “Doubling up 👯‍♂️” will focus on cementing our founding team, and scaling up.


  • We’re building confidence. Our practices are loving what we’re building and want more. Do you know any brilliant Full Stack / Intelligent Automation developers searching for purpose? 👩🏿‍💻 
  • I owe you some answers to why innovation is primary care has been so lacklustre. Like a good cuppa, my thoughts need to brew ☕️

Last update: 🤝2022 - GC3 “We’ll go further together”