Compliance & safety

Built to be trusted with a patient record.

Plasticity is an early-stage platform — and we'd rather be honest about that than pad a security PDF. Here's what's designed in today and the standards we're building toward, declared up front.

Built in / self-declared Planned — building toward Out of scope by design

UK MDR 2002 Class I Self-declared

UK MDR 2002 Class I via the MHRA self-certification route — self-declared; MHRA registration in progress. No external approval implied. Scope intentionally narrow.device

UK GDPR / DPA 2018 Built in

Designed to UK GDPR / DPA 2018 from the start — UK data residency and data minimisation.data

ISO 14971 Planned

The risk-management framework we're building the product against.risk

DCB0129 Planned

Clinical safety case for health IT — the standard we're working toward.safety

WCAG 2.2 AA Planned

Accessibility target — designed for tremor, low vision, fatigue and one-handed use.access

Cyber Essentials Planned

Target certification. Secrets management, audit trail and break-glass are in the design.security

Plasticity keeps the record so the clinician can decide — no risk scoring, no automated escalation, no AI inference, no diagnosis. The scope boundary is the reassurance, not the headline.

What it does — and won't do.

In scope

Exercise delivery and adherence tracking
Therapist-authored clinical notes
Outcome measures captured as raw scores only
Secure therapist–patient messaging
Patient-reported goal tracking

Out of scope, by design

Clinical decision support or treatment recommendation
Risk scoring or automated escalation
AI / ML suggestions or inference on patient data
Diagnosis, MCID flags or score interpretation
Dosage calculation

Crossing these lines would reclassify the device. We keep the line bright on purpose.

Reviewing us for your clinic?

We'll bring the DPIA, hazard log and clinical safety case to the walkthrough. Ask the awkward questions.

Request a private walkthrough →