Last reviewed: 7 November 2026. Applies to the Mobility UK account and supplier platform.
Clear safeguards. Accurate information.
We use encrypted AWS services and server-side access checks to protect account information and private files. The NHS workspace is under development. Do not upload identifiable patient records or clinical documents until your organisation has agreed the processing arrangements and the workspace has been approved for that use.
Storage and encryption
Core account services, application records and private uploads are configured in the AWS London region (eu-west-2). Application records use Amazon DynamoDB with AWS KMS encryption at rest. Private uploads use Amazon S3 with AES-256 server-side encryption. Sign-in and API requests use HTTPS.
Public website content may be delivered through a global content delivery network. A London hosting region does not mean every service, email, support process or subprocessor operates only in the UK. Any NHS processing agreement must specify applicable locations, subprocessors and transfer safeguards.
Private documents
Public access to the upload bucket is blocked. The application checks ownership before issuing a download link. Links currently expire after two minutes and should be treated as confidential while valid. Upload permissions also expire and restrict accepted content types and file size. These checks are not a claim that uploaded files have passed malware scanning.
Accounts and access
Amazon Cognito manages passwords, account email verification and password recovery. Passwords must contain at least 12 characters, uppercase and lowercase letters and a number. The application validates access tokens with Cognito and checks the expected application and user pool.
Personal account records and uploads are scoped to the signed-in account. Supplier workspaces require an active authorised membership or an authorised Mobility UK staff or reviewer role. Choosing a supplier or professional account type during registration does not itself grant access to another organisation's records.
NHS teams and separate organisations
The NHS workspace implementation checks organisation membership on the server. One account can have membership of more than one workspace, with access checked separately for each. Roles distinguish clinical teams, approvers, finance and workspace administrators. Finance and approver responses omit clinical profile snapshots and notes.
Current clinical visibility is at workspace level. Access limited to individually assigned cases, narrower support permissions and the complete NHS access matrix require further validation before clinical use. Organisation administrators must review memberships and remove access when responsibilities change.
Patient references and minimum information
The NHS equipment workflow uses local patient references, equipment requirements, height and weight. It asks users not to enter patient names or NHS numbers. Free-text fields must not contain unnecessary identifiers or clinical records.
A reference does not automatically make information anonymous. Information that can be linked back to a person remains protected personal information. The trust should retain the reference-to-patient mapping in its own authorised system and agree what information Mobility UK needs for quotations, supply and delivery.
Sign-in protection
The current platform uses password sign-in. Email verification during registration or password recovery is not two-factor authentication on every login. Optional passkey sign-in is available in the NHS portal after setup from a signed-in account. Separate authenticator or email two-factor prompts remain planned enhancements.
Passkeys allow a supported device to use fingerprint, face recognition or its screen lock to authorise sign-in. Mobility UK receives a public-key credential, not biometric templates. Password sign-in remains available.
Activity history and monitoring
NHS portal sign-ins, workspace views and record changes have separate server-written event records. These are not independently certified immutable logs. Selected supplier and case workflows record the acting account, timestamp and a description of changes. Technical application logs are retained for 30 days. Existing workflow histories are not a complete, immutable audit trail of every login, view, download or action.
Comprehensive access auditing, protected audit retention, alerting and organisation-scoped audit reports form part of the NHS readiness work. We will only claim complete logging after coverage and protection have been verified.
Retention, recovery and deletion
Retention periods must reflect the purpose of each record, contractual requirements and applicable legal obligations. A complete schedule for accounts, enquiries, orders, uploads and audit records is being finalised. Contact us to request access, correction or deletion; requests are reviewed against applicable rights and retention duties.
Backup recovery, file version retention and deletion from recoverable copies require a documented policy and restore testing before NHS clinical use. Encryption alone does not demonstrate that recovery arrangements meet an organisation's requirements.
Information for NHS IT and data teams
Before enabling patient-related processing, agree the controller and processor responsibilities, lawful basis and any relevant special-category condition, processing agreement, data flow, approved subprocessors, retention schedule and incident notification process. The organisation's assessment should also address access controls, independent security testing and any required data protection impact assessment.
This page does not assert NHS approval, a completed Data Security and Protection Toolkit assessment, ISO 27001 certification or Cyber Essentials certification. Applicable assurance status and supporting evidence must be established before those claims are made.
Data protection and security contact
Mobility UK is operated by The Mobility Organisation Limited. Contact hello@mobility.org.uk for data protection questions, security concerns or an NHS assurance enquiry. Do not include passwords, authentication codes or patient records in an initial email.
Read our privacy information for information about collection and use. You can also contact the Information Commissioner's Office.