Patient feedback, handled carefully.

Start with what this is not

Healthcare is the sector where vendor marketing does the most damage, so the limits go first rather than in a footnote. NumoForms holds no ISO 27001 certificate, has not completed a SOC 2 audit, and makes no claim about the NHS Data Security and Protection Toolkit. It has no single sign-on or SAML, no qualified electronic signatures, no offline or kiosk mode, and no Zapier or Google Sheets connector. It is not a clinical system and holds no place in a care record.

What it does have is a set of controls you can check, written down on the security page, the UK GDPR page and the published sub-processor list. An information governance lead can read those in ten minutes and decide, which is faster than a sales conversation.

The problems healthcare teams actually bring

Data residency and access are the first question, every time

Survey content and responses are stored in London on UK infrastructure. Data is encrypted in transit with TLS and at rest with AES-256 by the platform. Row-level security applies throughout, and organisation isolation is pinned server-side rather than being derived from a value the browser sends — which is the difference between a policy and a control. Roles are owner, admin and member, and the last owner of an organisation cannot be removed or demoted, enforced at database level so an administrative mistake cannot orphan a workspace full of responses.

Uploaded files never sit on a public URL. They are written to a private bucket and read by members of the organisation through signed URLs valid for 300 seconds. Clearing test responses removes the uploads and partial responses with them, so a pilot does not leave documents behind.

Ask for as little as the question needs

Data minimisation is easier to achieve here than in most tools, because a survey stores exactly what you ask for and nothing else. There is no automatic identity capture. If a patient experience survey has no name, email, address or number question, there is no identifying answer in the response.

Where you do need a token — an appointment reference, a clinic code, a cohort marker — hidden fields are declared per survey and read from the query string, so what gets attached to a response is a decision you made explicitly and can point at in a DPIA. Use a pseudonymous reference rather than an identifier, and keep the key somewhere the survey tool never sees.

The people you most need to hear from find surveys hardest

Patient experience work over-samples the people who find forms easy. Three things push against that. Conditional logic means nobody reads a question that does not apply to their pathway. Save and continue issues a resume link keyed on a 24-character token, so a long form can be done in short sittings — which matters when fatigue is the reason for the appointment. And the respondent experience is designed against WCAG 2.2 AA, with the caveats set out plainly on the accessibility page: no independent audit and no VPAT.

The conversational layout — one question at a time, one-tap questions auto-advancing — is usually the right choice for a waiting-room QR code. Classic, a single scrolling page in document order, is the most predictable structure for screen readers and magnification. Paged, a section per screen, suits a long service-redesign consultation.

Nothing is ever run by one organisation alone

A place-based consultation involves a trust, an integrated care board, a local authority and a voluntary-sector delivery partner, and all four expect to appear on it. Collaborator logos are per survey, not per account, so one workspace can badge a different set of partners on each piece of work without any of them overwriting the others. Each survey also carries its own accent colour.

Consultation windows have to close properly

Close dates and response caps are enforced by a database trigger rather than by the user interface, because responses insert straight from the browser: hiding a form is not the same as closing it. A custom closed message can point people at the next stage or at the service that should actually be handling their issue.

What a healthcare survey typically looks like

A community trust running a patient experience survey after outpatient appointments would usually build something close to this.

1. A clinic hidden field carrying a site code from the QR poster's query string, so responses split by location without asking the patient to identify their clinic.
2. A Recommend score — the 0 to 10 question, labelled "Recommend score" in the builder rather than NPS — as the headline measure.
3. A Matrix rating six aspects of the visit on one shared scale, exporting as one CSV column per row.
4. A branch: anyone scoring low is shown a short set of follow-up questions on what went wrong; everyone else skips them. Scoring counts only what the respondent saw.
5. An open comment as a Paragraph question with a maximum length and a live character counter.
6. Optional demographics last, behind a Section break, with "Other (please specify)" free text stored separately from the label and exported in its own column.
7. A closing screen that states clearly this is not a route to clinical advice or a formal complaint, and gives the number for both.

Two things to design in deliberately. Email notification on a new response is available, but email can be filtered, missed or sent to someone on leave — so a survey must never be the only route for an urgent concern, and somebody should still be checking the results. And spam protection is on by default without a CAPTCHA, though an open public link is still worth pairing with a close date and a response cap.

Reporting

Live charts per question with response counts and completion, CSV export for the analyst, individual responses browsable one at a time when a comment needs escalating, and a print-to-PDF of any single response through the browser — no PDF library is shipped to respondents. Free-text summarisation by AI is planned, not built, and must not be assumed.

Related

Local government shares almost all of the governance ground, charities and non-profits covers the delivery partners on the other side of a contract, and HR and people teams covers the staff survey side. Back to all solutions.