Privacy by design
Collect and identify only what the commissioned service needs. neo360 can support highly anonymous workflows, including needle exchange configured to be as anonymous as the service requires.
Safety, Security & Governance
Confidence built into every layer.
Harm reduction services handle information that can be highly sensitive. neo360 is designed so privacy, controlled access, traceability and operational resilience sit alongside the workflows themselves — helping services and commissioners manage information responsibly without losing the flexibility that effective harm reduction requires.
Assurance FrameworkBuilt around the deployment
Protect the information. Preserve the purpose.
Controls are designed around who should access data, why it is being processed and how the service is configured.
AccessRole and permission controls support appropriate access.
AuditabilityHistories and transaction records support accountability.
ProtectionSecure connections protect data in transit.
ResilienceManaged continuity and recovery arrangements support service availability.
Governance designed for sensitive harm reduction information
Good governance is not a single security feature. It is the combination of privacy-conscious configuration, controlled access, traceable activity and clear accountability across the life of the information.
Controlled access
Access to sensitive records should reflect a person’s role and responsibilities. Account, permission and service-location controls are used to keep information available to authorised users rather than simply making everything visible to everyone.
Accountability & traceability
Comprehensive histories, activity records and audit information help services understand what was recorded, what happened next and how operational activity can be reviewed when required.
Security is a system, not a feature.
neo360 combines technical safeguards with managed operational controls. The exact hosting, contractual and assurance arrangements are agreed for each deployment, particularly where jurisdictions or commissioner requirements differ.
Authentication, permissions and access controls protect authorised use of the platform.
Data transferred between supported neo360 services and infrastructure is protected through encrypted connections.
Security monitoring, vulnerability management and controlled maintenance form part of ongoing platform assurance.
Managed backup and recovery arrangements support resilience and restoration when required.
Governance across the information lifecycle
The strongest controls begin before the first record is created. Deployment decisions should define what is needed, who can use it, how long it is required and what happens when that need ends.
1
Define & minimise
Agree the information needed for the service, monitoring requirement or commissioned outcome — and avoid unnecessary collection.
2
Control access
Configure users, roles, locations and permissions so information is available to the people who need it for their work.
3
Use & review
Maintain histories and auditability so activity can be understood, service quality reviewed and issues investigated appropriately.
4
Retain & dispose
Retention, archiving, extraction and deletion requirements are defined through the relevant contract, law and local governance arrangements.
Clear responsibility across commissioner, service and platform
Governance works best when responsibility is explicit. Exact data-controller and processor roles vary by deployment and should always be confirmed contractually.
Commissioners
Set the purpose, monitoring requirement and system-wide governance expectations.
- Define commissioned purposes and required outcomes
- Agree data requirements and reporting expectations
- Set contractual, retention and information-governance requirements
- Define provider access and programme-level assurance arrangements
Services & providers
Apply local operational governance where neo360 is used day to day.
- Manage appropriate staff access and local user responsibilities
- Maintain accurate recording and local service procedures
- Follow safeguarding, confidentiality and information-handling policies
- Escalate incidents, errors or access concerns through agreed routes
neo360
Operate and support the technology within the agreed contractual model.
- Maintain the platform and its security controls
- Support configuration, permissions and technical administration
- Maintain controlled change, support and incident-management processes
- Meet agreed processor, hosting and service obligations for the deployment
These are general governance principles rather than a statement that one legal model applies everywhere. International and multi-provider deployments can require different controller, processor, hosting and retention arrangements.
Privacy that can reflect the service model
Harm reduction provision does not always require the same degree of identification. neo360’s configurable approach allows services to match data collection to purpose. For example, the Needle Exchange module can be configured to be as anonymous as the service wants it to be, while other pathways can record identifying or clinical information where there is a legitimate service need.
Anonymous where appropriateConfigure workflows to avoid unnecessary identification where the intervention does not require it.
Identifiable where necessarySupport follow-up, results, referrals or treatment-related workflows where identification is legitimately required.
Purpose-led collectionCapture information because it supports delivery, safety, monitoring or agreed reporting — not simply because a field can be added.
Deployment-specific governanceHosting location, sharing, retention and contractual roles can be defined for the relevant jurisdiction and programme.
Assurance in day-to-day practice
Security and governance must survive contact with real services. neo360 therefore combines technical controls with operational features that make responsible use easier to maintain.
Comprehensive histories
Relevant modules maintain detailed presentation, transaction, supply, test, supervision or intervention histories so authorised teams can review what has occurred.
Compliance workflows
The Compliance module can require service providers to acknowledge SLAs, policies, procedures or other defined documents and can enforce acknowledgement timescales.
Controlled reporting & extracts
Reporting can be filtered for the required purpose and exported to screen or CSV, with data extracts available for agreed organisational data-warehouse use.
Operational alerts
Module-specific alerts and recalls help services surface follow-up such as missed supervision, retraining or affected naloxone stock rather than relying on memory alone.
Controlled change
Configuration and platform change should be governed so new requirements can be introduced without losing consistency, accountability or supportability.
Jurisdiction-aware deployment
neo360 has deployment experience across the UK, Canada, United States and Australia. Governance, hosting and contractual arrangements can therefore be considered in the context of the programme and jurisdiction.
Built for trust — without overclaiming it
Governance is deployment-specific
Contracts and local requirements determine the exact legal and operational model.
Security is continually managed
Controls must be maintained and reviewed as threats, technology and requirements change.
Data quality remains a shared responsibility
Technology can support good recording, but services still govern how information is entered and used.
Assurance evidence is available through engagement
Commissioners can discuss the relevant security, governance and technical evidence for their proposed deployment.
Need to understand the assurance behind your deployment?
Talk to us about information governance, security controls, hosting, access, auditability, resilience and the contractual model required for your service or commissioned programme.
Discuss Assurance