Data Security

Your patients’ data deserves the same standard of care as their health.

Pharmacy1st.ai is a registered Class I Medical Device built to handle the most sensitive data in healthcare. Every layer of our platform — from infrastructure to application logic — has been designed with clinical-grade security at its core.

Built on a Compliance-First Infrastructure

Pharmacy1st.ai is hosted on Amazon Web Services (AWS) through Aptible, a compliance-first Platform as a Service trusted by hundreds of healthcare organisations worldwide.

This means your patient data is protected by an infrastructure stack that is independently audited and certified against the most rigorous security frameworks in the industry:

• SOC 2 Type 2— Continuous independent audit of security, availability, and confidentiality controls
• HITRUST CSF Certified— The gold standard for healthcare information security, allowing our pharmacy customers to inherit verified security controls directly from our infrastructure
• ISO 27001— AWS data centres are certified to the international standard for information security management
• PCI DSS Level 2 Compliant— Payment card industry security standards for service providers

By hosting on Aptible’s dedicated stack, Pharmacy1st.ai inherits enterprise-grade security controls out of the box — including encryption, DDoS protection, host hardening, intrusion detection, vulnerability scanning, and network segregation — without compromise.

Encryption Everywhere

Patient data is encrypted at every stage of its lifecycle:

• In transit: All data moving between your pharmacy, our platform, and our servers is encrypted using TLS 1.2 or higher. No exceptions.
• At rest: All databases, backups, and stored files are encrypted using AES-256, the same standard used by governments and financial institutions worldwide.
• In backups: Automated encrypted backups ensure your data is protected even in disaster recovery scenarios.

Encryption keys are managed through AWS Key Management Service (KMS), with strict access controls and automatic key rotation.

Your Pharmacy Controls the Data

Pharmacy1st.ai operates a clear and transparent data governance model:

• Your pharmacy is the Data Controller.You determine how and why your patients’ data is processed. You maintain the relationship with your patients and handle their data rights requests.
• Infohealth Ltd is the Data Processor. We process patient data solely on your behalf, under your instructions, and in accordance with a formal Data Processing Agreement (DPA) compliant with Article 28 of the UK GDPR.

We never use your patient data for our own purposes. We never sell it. We never share it with third parties for marketing. Your data stays yours.

Access Controls and Authentication

We enforce strict controls over who can access what:

• Role-based access control (RBAC) ensures that only authorised pharmacy staff can access patient consultations and QA documents
• Multi-factor authentication (MFA) is available for all platform accounts
• Principle of least privilegegoverns all internal access — our own staff can only access customer environments when necessary for support, under strict audit logging
• Session management with automatic timeouts protects against unattended access

Every action on the platform — by patients, pharmacists, and our own team — is logged in an immutable audit trail.

Network Security

Our infrastructure is designed to repel threats at every level:

• Dedicated, segregated network environments— each customer’s data is logically isolated
• DDoS protection— built-in mitigation at the infrastructure layer
• Web Application Firewall (WAF)— protects against common web exploits and injection attacks
• Host-based Intrusion Detection System (HIDS)— continuous monitoring of all hosts for anomalous activity, with automated alerting and response
• Vulnerability scanning— regular automated scanning with prompt remediation of identified risks
• Hardened host operating systems— configured to CIS (Centre for Internet Security) benchmarks

Clinical Safety by Design

As a registered Class I Software as a Medical Device (SaMD), Pharmacy1st.ai is subject to the regulatory expectations of the MHRA. Our security measures are part of a broader clinical safety framework:

• Risk management aligned with ISO 14971 and ISO 13485 quality management
• Clinical safety case maintained in accordance with DCB0129 (manufacturer) and DCB0160 (deploying organisation) standards
• Post-market surveillance— we continuously monitor the platform for safety and performance issues
• Complete audit trail— every consultation, every AI output, every pharmacist decision is recorded and traceable

The AI never prescribes. It produces a structured QA document that the pharmacist uses as a clinical decision-support tool. The pharmacist always makes the final call.

Incident Response and Breach Notification

We maintain a documented incident response procedure that includes:

• 24/7 monitoring of infrastructure and application security events
• Defined escalation paths for security incidents, with severity classification and response timelines
• Data breach notification to affected Customer pharmacies without undue delay, and in any event within 72 hours, in accordance with Article 33 of the UK GDPR
• Post-incident review with root cause analysis and corrective action

If something goes wrong, you’ll know about it quickly and you’ll know exactly what we’re doing to fix it.

Regulatory Compliance

Pharmacy1st.ai is designed to support your pharmacy’s compliance obligations across multiple regulatory frameworks:

Continuous Improvement

Security is not a one-time exercise. We invest in it continuously:

• Regular penetration testing by independent third-party security firms
• Ongoing vulnerability management with defined SLAs for remediation
• Staff security training— all Infohealth staff complete data protection and information security training
• Policy reviews— our security policies are reviewed at least annually, or sooner when regulations or threats change
• Aptible Security & Compliance Dashboard— provides continuous, real-time evidence of our infrastructure’s security posture

Transparency

We believe pharmacy customers should be able to verify our security claims, not just trust them. We provide:

• A Data Processing Agreement to every Customer pharmacy before patient data is processed
• A sub-processor list detailing all third parties involved in processing
• Access to our security documentation and compliance reports under NDA
• A named Data Protection Officer available to answer your questions

Questions?

If you have questions about how we protect your data, or if you’d like to review our security documentation, we’d welcome the conversation.