Nova Guide runs inside clinical systems and holds data about how staff use guidance. This page sets out where that data is held, what is recorded, and how the service, the extension and the content are protected.
1
Hosting
The service is defined to run in Microsoft Azure’s UK South region.
1.1Region
Nova Guide’s database, file storage, application services and keys are defined in Microsoft Azure UK South.
1.2Services
Azure Container Apps, Azure Database for PostgreSQL Flexible Server, Blob Storage, Key Vault and Application Insights, defined as infrastructure code. Alert emails are sent through Azure Communication Services, set up with its data location in the United Kingdom.
1.3Backups
Point-in-time restore of the database, with 35 days of backups in production.
1.4If Nova Guide is unavailable
Staff carry on in the application without guidance. A workstation that cannot check for withdrawals for 15 minutes stops showing guidance until it can.
2
Identity and access
Your staff sign in to the portal and the studio with their own Microsoft accounts.
2.1Sign-in
Microsoft Entra ID single sign-on with your organisation’s own directory, using OpenID Connect with PKCE and no client secret.
2.2Authors
An author’s sign-in from the extension is brokered by the browser, so no password passes through the extension.
2.3Organisation isolation
Every record belongs to one organisation, identified from the sign-in token.
2.4Roles
Admin, moderator, contributor and reviewer, each with its own permissions. Separation of duties is set per risk tier.
2.5Staff following guidance
Need no Nova Guide account. Where the application or workstation names the person, that reference is pseudonymised as it arrives.
2.6Safe start
Outside development, the service refuses to start unless Entra ID sign-in and its storage are configured.
3
The browser extension
The extension carries the guidance layer and the authoring tools into the browser.
3.1Package
Manifest V3, for Microsoft Edge and Google Chrome. Its identity is fixed by its signing key and is the same on every machine.
3.2Deployment
Installed and configured by browser policy through Microsoft Intune or Group Policy. Staff cannot remove or reconfigure it, and its settings page is read-only while a policy applies.
3.3Where it runs
Its code runs only on the applications your managed policy enrols by web address. The extension’s browser permission covers all sites, because a packaged extension cannot name each organisation’s applications in advance; enrolment decides where it acts.
3.4Code
The extension runs only the code in its signed package. Guidance arrives as data.
3.5The application’s page
Nova Guide draws in a closed shadow root and leaves the application’s page as it is: no classes are added to its elements and nothing is wrapped round them.
3.6Footprint
The guidance layer is under 50 kB compressed, a limit enforced on every build. The authoring tools load only when an author opens them.
How the extension is installed and configured is on the Deployment page.
4
Content integrity
What reaches a clinical screen is exactly what a named reviewer approved, and can be stopped at any time.
4.1Signed bundles
Published content is delivered as a bundle signed with ECDSA P-256. The browser verifies the signature before reading it, and shows nothing if verification fails.
4.2Structured content
Authored content is structured text and is never rendered as HTML. Links must use https, and images load only from Nova Guide’s own storage.
4.3Approval
Each item is approved against the SHA-256 hash of its exact content, checked again at every publish.
4.4Withdrawal list
Served apart from the content and never cached. A workstation that cannot reach it for 15 minutes stops showing guidance.
5
Data protection
Nova Guide records how guidance is used. It records nothing about patients.
Stays on the workstation
The application and the browser
The application’s page and anything typed into it
Patient data
Ward, site and staff group, used to choose content
→Sent from the workstation to the service: Usage events The guide, the step and the screen’s path. A staff reference is pseudonymised on arrival.
←Sent from the service to the workstation: Signed content bundle Verified before it is read.
←Sent from the service to the workstation: Withdrawal list Checked every 30 seconds.
Held by Nova Guide
The service, in Azure UK South
Guidance content, its versions and approvals
Pseudonymised usage events
The team’s names, email addresses and roles
What crosses between a workstation and the Nova Guide service.
5.1What is held
Guidance content and its history; the team’s names, email addresses and roles; pseudonymised usage events; and, where switched on, step screenshots.
5.2Patient data
Events have no field for page text, typed values or web address parameters, and screens are recorded by path only.
5.3Pseudonymisation
Staff identifiers are replaced on arrival with HMAC-SHA256, using a key held for each organisation.
5.4Audience attributes
Ward, site and staff group are read in the browser and are not sent to Nova Guide or recorded in events.
5.5Screenshots
Off unless switched on for an application. NHS numbers and UK dates are found and filled with solid blocks before upload, and the author can fill further areas.
5.6Small numbers
Counts of fewer than five people are withheld from reports.
5.7Retention
Events are kept for 24 months by default, then deleted by a nightly scheduled job. The period is agreed with each organisation.
5.8Your assessment
A description of the data Nova Guide processes and why, for your data protection impact assessment, with a separate note on workflow analytics.
Each organisation’s agreement includes Nexus Nova’s data processing agreement and its list of sub-processors. To read them while you assess Nova Guide, choose “The assurance documents” in the contact form.
Nexus Nova holds Cyber Essentials certification. A copy of the certificate is available on request.
The full list of events, and what is never recorded, is on the Analytics page.
6
Network and application security
Each part of the service accepts only the requests it needs.
6.1Boundaries
The administration interface accepts requests only from the portal’s address. Application pages reach a narrow delivery and authoring interface that cannot approve, publish or withdraw.
6.2Secrets
Managed identities for storage and email, and the database credential held in Azure Key Vault.
Reporting a vulnerability
To report a security vulnerability in Nova Guide or this website, email admin@nexusnova.co.uk. Nexus Nova acknowledges each report within one working day. Please describe how to reproduce the problem, and leave out any patient or personal data you may have seen. The same contact is published at /.well-known/security.txt.
A demonstration records a guide, takes it through review and publishing, and shows it as staff see it. It also covers how Nova Guide would be deployed and assured in your organisation.
