You’ll find us in the toolkit’s public organisation search as BENAIAH AI LTD, ODS code H8O9P.

The short version

  • Who: Benaiah AI Ltd, the company that runs Telephonist.
  • What: we’ve published our Data Security and Protection Toolkit self-assessment. Our status: NHS Data Security and Protection Toolkit: Standards Met (2026–27).
  • When: published on 11 November 2026. Our certificate is valid to 30 June 2028.
  • What it isn’t: an audit, an approval or an endorsement. It’s a self-assessment we published on the toolkit, and a baseline.
  • Check it: search the toolkit for H8O9P, or open our entry.

What is the DSPT?

The Data Security and Protection Toolkit (DSPT) is NHS England’s online self-assessment tool. Organisations use it to measure their performance against the National Data Guardian’s 10 data security standards.

In the toolkit’s own words, all organisations that have access to NHS patient data and systems must use it “to provide assurance that they are practising good data security and that personal information is handled correctly”.

Each standard is broken down into assertions, backed by evidence items. To reach Standards Met, an organisation completes every mandatory evidence item for its type, confirms every assertion and publishes the result. It’s annual: organisations review their assessment and publish again each year.

For a company like ours, the toolkit covers any health and care data we handle, not everything the company does.

What our publication says

  • Organisation: BENAIAH AI LTD, ODS code H8O9P, 167–169 Great Portland Street, London W1W 5PF.
  • Status: “2026-27 (version 9) - Standards met”, as the toolkit lists it.
  • Published: 11 November 2026. Our certificate is valid to 30 June 2028.
  • Certificate: it says the organisation “has completed a Data Security and Protection Toolkit self-assessment to demonstrate it is practising good data security and that personal information is handled correctly”.

What it means, and what it doesn’t

It means we’ve worked through every mandatory part of the toolkit for an organisation of our type, and published the result where anyone can check it.

It isn’t an audit, an approval or an endorsement from the NHS. The DSPT is a self-assessment: we gave the answers, and no auditor checked them. The public entry shows our status, not our answers; the toolkit says that “No information on the content within your toolkit is available publicly.”

It’s a baseline, and it’s for the organisation, Benaiah AI Ltd. It isn’t a certificate for Telephonist or any other product, and Telephonist isn’t a clinical or emergency service.

Why it matters for Telephonist

Telephonist answers calls for businesses, and callers sometimes mention their health. A GP surgery, pharmacy or dental practice thinking about Telephonist can check our status for itself, without taking our word for it.

Here’s what we’ve already promised in our privacy notice:

  • It says it’s an AI. Every Telephonist says it’s an AI at the start of the call.
  • Your calls don’t train AI. We never use your calls or messages to train AI models, and we never sell your data or use it for advertising.
  • Breaches reported fast. Our data processing terms commit us to telling a business within 24 hours of becoming aware of a breach affecting its data, and list who processes that data and where.
  • Kept apart and encrypted. Each business’s records are kept separate and shown only to its signed-in owners, and every connection between Telephonist, our customers and our sub-processors is encrypted in transit.
  • No web search for healthcare. Public web search on a business’s calls stays off unless the business turns it on, and healthcare providers can’t.

It sits alongside our Cyber Essentials certification and our registration with the ICO.

Check it yourself

Search the toolkit’s organisation search for H8O9P or BENAIAH AI LTD, or go straight to our entry. To learn more about the toolkit, read NHS England’s overview.

Questions about how we look after data? Email privacy@telephonist.ai.