DTAC published DCB0129 signed off DSPT wording to confirm Cyber Essentials certified ICO registered WCAG 2.2 in progress

Governance and assurance

Everything your team needs to assess Melo.

Clinical safety, data protection, security, interoperability and accessibility, in one place. Certificates download directly, and every claim links to a register you can check without asking us.

Hazards assessed: 0
Documents published: 0 of 21
Frameworks: 0
Last reviewed: 1 Sep 2026

Digital Technology Assessment Criteria

Self-assessed

Full responses published on this page against all six DTAC sections. The completed NHS England template is available to download.

Assessment typeSupplier self-assessment

Supporting evidence21 documents

DCB0129 clinical risk management

Independently signed off

Clinical safety case report approved by the Clinical Safety Officer. 63 hazards assessed, 36 moderate and 27 low, none significant or above. Your organisation carries the matching DCB0160 duty for deployment.

Approved4 February 2026

Safety officerDr Stephen Mullin

Review cycleAnnual, plus every release

Data Security and Protection Toolkit

Status wording to confirm

2025-26 version 8 certificate held for Decently Limited and published on the NHS DSPT register. Do not put a status word on this page until someone has read the certificate.

Version2025-26, v8

VerifyDSPT register

Cyber Essentials

Certified

Certified June 2026. The certificate downloads from the library below and is checkable on the IASME register without contacting us.

CertifiedJune 2026

LevelCyber Essentials

ICO registration

Registered

Registered under Decently Limited and renewed for 2025-26. The reference below can be pasted straight into your supplier record.

ReferenceZB388781

Renewed2025-26

VerifyICO register

WCAG 2.2 AA

In progress

Currently conformant with WCAG 2.1. Work towards 2.2 AA is underway and the plan and timescales are being finalised.

CurrentWCAG 2.1

TimescalePlan in progress

Is Melo clinically safe to deploy?

Melo conforms with DCB0129, the clinical risk management standard for manufacturers of health IT. Your organisation carries the matching DCB0160 duty for deploying it, and our hazard log names the controls we expect you to put in place locally.

Hazards assessed

63 in total. 36 moderate, 27 low, none significant, high or very high. All judged tolerable with existing controls, so no further supplier-side mitigation is required.

Clinical Safety Officer

Dr Stephen Mullin

Consultant Clinical Neuropsychologist HCPC PYL17468 BPS 85168

Safety team

The CSO works with a named multidisciplinary team who all understand the product and how it is used clinically. James Chapman, Co-Founder and Product Manager. Jono Jones, Chief Technical Officer. Charlie Dowd, Product Designer. James Burch, Co-Founder and Compliance Manager.

Review cycle

Hazard analysis is repeated at least annually by a multidisciplinary team. Every production release is approved by the CSO.

What Melo does and does not do clinically

Melo digitises validated behavioural assessment instruments including ABC, ABS, OAS-MNR and SASBA. Staff record structured observations at the point of care, and the platform presents those observations back as charts and dashboards.

Melo does not diagnose, does not recommend, does not alert and does not automate any clinical decision. Scoring is rule-based and already inherent in the paper instruments it replaces. Results are presented without interpretation or instruction.

The four named hazards

HAZ01, Melo does not accurately reflect a patient's high risk profile. HAZ02, Melo does not accurately reflect a patient's low risk profile. HAZ03, Melo unavailable, so a user cannot record or review clinical information in time. HAZ04, inappropriate access to or sharing of confidential patient information.

Hazards coded R were identified through feedback from organisations already using Melo.

What your organisation is responsible for

Every hazard control assumes local training. Your staff need to know how to use Melo, how to report a fault, and how to record data during downtime. We supply the training material and you are responsible for making sure staff receive it.

Controls also assume staff hold current clinical governance training covering the safe use of IT systems and the handling of confidential clinical information.

AI-assisted summaries

Melo can generate written summaries from recorded observations. The feature is in beta. Summaries restate what has been recorded and do not add clinical interpretation.

The summary is designed to support your work, not replace it. Users are asked to review and verify the content before using it for any clinical or reporting purpose, and a disclaimer appears with every generated summary.

Read the full clinical safety case report

Is Melo a medical device?

No. Melo is not classified as a medical device in the UK under the Medical Devices Regulations 2002 and the MHRA's guidance on stand-alone software including apps. It is outside the scope of those regulations and is not registered with the MHRA.

Why not

Melo digitises existing validated instruments, applies only the rule-based scoring already built into those paper tools, and presents results without interpretation or instruction to the clinician.

Under review

This position is kept under review as AI features develop. Any change appears in the change log at the foot of this page.

Do you have the rights to the instruments?

Melo digitises validated behavioural assessment instruments rather than inventing its own. Reviewers ask whether we hold permission to do that, so the position is set out here rather than left to be asked.

SASBA

Permission obtained from the authors, Knight, Alderman, Johnson, Green, Birkett-Swan and Yorston, 2008, and from St Andrew's Healthcare, to include the St Andrew's Sexual Behaviour Assessment within Melo.

Scoring

Melo applies only the rule-based scoring already inherent in each paper instrument. It does not alter thresholds, weightings or interpretation.

Clinical calculator

Melo includes the Agitated Behaviour Scale as a calculator. It performs the same arithmetic as the paper scale and adds no interpretation.

What happens to patient data?

What Melo processes

Structured behavioural observations recorded by clinical staff, held against a patient record created and maintained by your local administrators. Melo processes personal data and special category health data.

Where it is stored

UK region only, on AWS via Laravel Cloud. Live, test and backup environments are all UK-hosted.

Who else touches it

Two sub-processors, each with a data processing agreement in place. Both agreements are available on request.

Controller and processor

Your organisation is the controller. Decently Limited is the processor.

DPIA

We publish a template DPIA. Data flows vary with local integrations, so your own assessment will differ and we will support you in completing it.

Registered entity

Decently Limited Company 13604268

Department Campfield, Lower Byrom Street, Manchester, M3 4FP

How is Melo secured?

Certification

Cyber Essentials, certified June 2026.

Hosting

AWS UK regions via Laravel Cloud. Architecture and authentication diagrams available on request.

Authentication

Managed through Kinde. Single sign-on and multi-factor authentication are supported.

Incident and vulnerability handling

Clinical events and security incidents are reported through a documented process, and every ticket is assessed by the Clinical Safety Officer for clinical safety impact before it is prioritised.

How does Melo fit with our existing systems?

Melo is a browser-based application used alongside your clinical record system rather than inside it. We would rather be plain about the current limits than imply more integration than exists today.

Public API

None. Melo does not currently expose an API to third parties.

NHS number

Supported for identifying patient data when exchanging it. Melo does not connect to the Personal Demographics Service, so NHS numbers are not validated against a national source. Local administrators confirm patient details on setup.

Devices

Any modern browser on desktop, tablet or mobile. Nothing to install.

Interoperability standards

Common NHS components and patterns are not yet in use. They sit on the interoperability roadmap.

Accessibility

Current position

WCAG 2.1 conformant. Work towards 2.2 AA is in progress.

Accessible Information Standard

Read and reflected in design decisions.

Alternative formats

Available on request through the support address below.

User testing

Usability testing is carried out with intended users. A worked user acceptance testing example is available on request.

Service and support

Availability

Live availability and 90-day history are published at status.melo.health. We link the status page rather than printing a figure here, so what you read is always current.

Service level

99.9% uptime or above, offered to all healthcare organisations.

Release cadence

Every two to four weeks. Every change is published in the changelog.

Reporting

Customers receive a vendor dashboard covering usage and system performance, plus monthly reporting where required.

Support response

Technical issues raised through the in-app contact form or support@melo.health get a response from your Customer Success Manager within four hours.

Training and guides

Onboarding guides cover access, set-up, navigation and each assessment framework, published in the Help Centre. Customer Success Managers also run training demos.

Document library

Everything we hold, what it covers, when it was last updated, and how to get it. Documents marked download arrive immediately. Documents marked request are sent automatically once you tell us who you are.

Area

Access

Document	Area	Updated
Clinical safety case reportDCB0129, approved by the CSO	Clinical safety	4 Feb 2026
Clinical safety hazard log63 hazards with controls	Clinical safety
Clinical risk management policiesEight documents including audit, incident reporting and change control	Clinical safety
Completed DTACNHS England template	Clinical safety
DSPT certificate2025-26, version 8	Data protection	2025-26
ICO registrationZB388781, verifiable on the ICO register	Data protection	2025-26
DPIA templateStarting point for your own assessment	Data protection
Data flow document	Data protection
Privacy policy	Data protection
Terms and conditions	Data protection
Laravel data processing agreement	Data protection
Kinde data processing agreement	Data protection
Cyber Essentials certificate	Security	Jun 2026
Penetration test summaryExistence not yet confirmed	Security
Architecture diagram	Technical
Authentication diagram	Technical
User journey document	Technical
User acceptance testing example	Service
Monthly uptime and usage reportWorked example	Service

Pricing, service level terms beyond the headline figure, and anything specific to another customer are shared under contract only.

Who to ask

If something here does not answer your question, these are the people who can. Technical issues get a response within four hours.

Clinical safety

Dr Stephen Mullin

Clinical Safety Officer, HCPC PYL17468

Compliance and IG

James Burch

Co-Founder and Compliance Manager

Technical and security

Jono Jones

Chief Technical Officer

Support

support@melo.health

Four hour response on technical issues

What changed

Dated entries, so you can see this page is maintained rather than published once and forgotten.

1 Sep 2026

Governance hub published. Clinical safety and DTAC content consolidated from separate pages. All documents moved to Melo hosting.

Jun 2026

Cyber Essentials recertified.

4 Feb 2026

Clinical safety case report reviewed and approved. Hazard count updated to 63.

Top