What does an NHS trust need to clear before using Node XR?
For staff-only training the list is shorter than most teams expect, but it sets the timeline. In most trusts the clinical case is the easy part and information governance decides when anything launches.
Which gates come up every time?
Six gates come up in almost every trust.
- DTAC: the NHS baseline assessment for digital tools. Request the completed DTAC from the supplier before the first IG meeting
- DSPT: the supplier's Data Security and Protection Toolkit submission. Node XR's security page lists it as DSPT compliant; ask for current status
- DPIA: what personal data is processed and why. Node XR supplies a DPIA pack
- Cyber Essentials Plus: Node XR holds it. Confirm the current scope in writing
- Data residency: Node XR is hosted on AWS in the eu-west-2 (London) region
- DCB0129 and DCB0160: usually out of scope for staff training that does not influence clinical decisions. Take local advice
Which assumptions slow approval down?
Three myths add weeks. Clinical risk standards do not automatically apply to staff-only training, and UK-only data residency is not a blanket national requirement. Accessibility is the opposite case: WCAG 2.2 AA is a real requirement, so ask for the current accessibility statement early.
Who makes the final decision?
Your information governance lead does. Nothing here is legal or procurement advice, and certification scope should be confirmed with Node XR in writing before submission rather than taken from a web page. How long to keep gaze and motion data is worth settling in the DPIA early.