Keeping data safe

Our approach

The residents in a Tellaris model are synthetic, but they are built and tested on real data: published statistics and, under agreement, your own activity data. That is what makes the results reflect what actually happens in your area. We use only the data a model needs, leave patient-level data where it already sits, and make sure no one can be identified from anything we produce.

How we handle data

• Only what is needed. We agree with you which data a model needs and use it only for the purpose agreed.
• Your data stays in your environment. Patient-level data is analysed where it already sits, inside your secure environment, by our data module. Only summary tables, with small numbers suppressed, come out to calibrate the model. We never receive names, addresses or NHS numbers.
• Synthetic residents. The residents in our model are synthetic. They match the real population statistically, but none is a copy of a real person.
• Safe outputs. Results are reported for areas and groups, with small numbers suppressed, so outputs cannot be traced back to individuals.

Where data is held

Patient-level data stays in your environment. Summary data and models are held and processed in the UK, in secure, access-controlled environments, and UK health data is not transferred outside the UK. Where you prefer, the whole model can also run inside your own environment.

Security controls

• Encryption of data in transit and at rest.
• Access limited to named people who need it, with multi-factor authentication.
• Each customer’s data kept separate from every other customer’s.
• Logging and audit of access to data.
• Secure development, regular updates and independent testing.
• Secure deletion of summary data at the end of an agreement, unless you ask us to keep it.

Information governance

We work within UK GDPR, the Data Protection Act 2018 and the Caldicott Principles, and design our services to meet NHS data security and protection standards. We work as a data processor under clear data sharing and processing agreements, check summary tables against the Information Commissioner’s anonymisation guidance before they leave your environment, and support our partners with data protection impact assessments. Where the national data opt-out applies, it is respected.

Responsible use of AI

• Every scenario records its assumptions, data versions and model run, so results can be checked and repeated.
• Plain-English answers are drawn from the model’s own results and show their working.
• Your data is never used to train general-purpose AI models.
• Tellaris supports decisions; people make them.

Our people

Everyone who works with data is trained in data protection and security, and bound by confidentiality.

Questions

For security or information governance questions, or to request our security documentation, contact us at [security contact email] or through our contact page.