Physitrack for NHS Trusts: Digital Rehab Procurement Guide

Physitrack’s certifications, reported NHS deployments, and Epic integration make it a candidate for multi-department rehabilitation services, but buyers still need to verify its current assurance evidence, procurement access, system interfaces, and contract scope.

• Buyers should verify the current DSPT submission, DTAC evidence pack, GDPR controls, and ISO 27001 certification.
• Physitrack integrates with EHRs including Epic. It adds home exercise programme (HEP) and remote therapeutic monitoring (RTM) functions without replacing clinical documentation. It also supports PROMs and patient engagement.
• Procurement leads should confirm current G-Cloud or Digital Marketplace access, lot status, pricing, and call-off terms directly with Physitrack.
• Physitrack reports deployments across acute, community, MSK, paediatric, occupational health, and primary care services at multiple named trusts.
• Procurement leads can use Physitrack’s ISO 13485 certificate and multi-department deployment references when reviewing clinical governance and planning a phased rollout.

Physitrack also reports serving UK private healthcare providers, including Bupa, Nuffield Health, and Circle Health Group.

What NHS trusts need to check before procuring rehab software

Use the following five checks before shortlisting any rehabilitation software supplier.

• Information governance and data protection. Confirm the supplier’s current DSPT submission, supporting evidence, UK GDPR controls, ICO registration, retention policy, access controls, and incident procedures. DSPT operates as an annual self-assessment, with submissions due by 30 June for the previous financial year. Supplier category affects assessment depth, and Category 2 suppliers require an external audit.
• DTAC evidence. Request a current DTAC evidence pack covering clinical safety, data protection, technical security, interoperability, and accessibility. DTAC is an assessment framework rather than a certification. Its data protection section requires evidence of GDPR and DSPT compliance, so procurement leads should review these materials together.
• Interoperability and system boundaries. Document which EHR, identity, reporting, and patient communication systems the product connects to. Confirm what data moves between systems, who controls each record, and whether the software complements or duplicates existing clinical documentation.
• Procurement route and commercial scope. Verify current availability through G-Cloud, the Digital Marketplace, another approved framework, or a local procurement route. Review the call-off terms, pricing basis, implementation costs, contract length, support arrangements, and exit provisions before selecting a route.
• Deployment and clinical governance. Ask for evidence of live use across comparable NHS services and multiple departments. Define clinical safety ownership, local configuration controls, outcome reporting, accessibility testing, staff training, rollout responsibilities, and the process for reviewing content or product changes.

NHS deployment across acute, community, MSK, paediatrics, occupational health and primary care

Physitrack reports NHS deployments across acute hospitals, community services, MSK, paediatrics, occupational health, and primary care. The deployment record includes large teaching trusts and services operating across several departments.

Acute and specialist care. Guy’s and St Thomas’ NHS Foundation Trust uses Physitrack through its main account and its Paediatric Rheumatology and Chronic Pain service. Royal Brompton and Harefield hospitals also use the platform. Other acute settings include Newcastle upon Tyne Hospitals NHS Foundation Trust and Halton General Hospital. Barking, Havering and Redbridge University Hospitals NHS Trust and Epsom and St Helier University Hospitals NHS Trust also use Physitrack, while the deployment record includes Mile End Hospital. Newcastle’s deployment extends to its Institute of Human Genetics.

Community and MSK services. Mersey Care NHS Foundation Trust uses Physitrack within its MSK team and Knowsley Community Therapy Team. Royal Free London NHS Foundation Trust runs the platform across Adult Community Therapies and its Private Patients Unit. Oxleas NHS Foundation Trust uses it in physiotherapy and Adult Learning Disabilities services.

Paediatrics and complex care. Paediatric use includes the specialist service at Guy’s and St Thomas’ and Children’s Services within Mersey and West Lancashire Teaching Hospitals NHS Trust. Mersey and West Lancashire also uses Physitrack in Ormskirk Orthopaedics and Acute and Critical Care, covering services with different patient groups and clinical workflows.

Occupational health and primary care. Oxford University Hospitals NHS Foundation Trust uses Physitrack within Occupational Health and Wellbeing. Reported primary care settings include North Arden Primary Care Network and Liverpool John Moores University Primary Care Network.

Royal Free London and Mersey and West Lancashire are the clearest reported examples of Physitrack use across multiple services within one trust. The named departments demonstrate clinical variety, but the list alone does not establish their governance, reporting, or rollout arrangements. Procurement leads should confirm each reference’s current scope and request relevant contacts when assessing a comparable multi-department rollout.

Compliance and clinical governance credentials

Physitrack’s ISO 27001 and ISO 13485 certifications support due diligence but do not complete it. ISO 27001 covers the management of information security risks, while ISO 13485 covers the quality management processes used for medical device products. Procurement leads should request current certificates and verify the legal entity and certification scope. They should also check the issuing body and expiry dates.

Physitrack supports GDPR compliance and offers EU data hosting. Your information governance review should confirm the proposed hosting region and data flows for the deployment. It should also examine retention controls and subprocessors, along with access and deletion procedures. The hosting and data-control details should form part of the evidence Physitrack provides for the Trust’s DSPT and DTAC review.

Physitrack appears in the FDA medical device establishment registration database. FDA establishment registration does not amount to FDA approval, and procurement documents should preserve that distinction. Physitrack should not be described as an EU MDR-registered medical device. Buyers should ask for a current regulatory statement covering the product version and intended use. The statement should identify the relevant UK or EU jurisdiction and any applicable US requirements.

To complete supplier assurance, the Trust should review Physitrack’s current DTAC evidence pack and DSPT position, as well as its data protection, clinical safety, and incident-management documentation.

Your Trust’s clinical leads should assign ownership for programme templates and prescribing permissions. They should define how staff use outcome measures and obtain patient consent. Clinical leads should also set escalation procedures. Physitrack supplies the exercise prescription and patient engagement software, while the Trust retains responsibility for clinical decisions and local governance.

How Physitrack fits alongside existing NHS systems and EHRs

Physitrack extends a trust’s existing clinical environment rather than replacing its EHR. It provides home exercise programme delivery, remote therapeutic monitoring, PROMs, telehealth, and patient engagement functions. Patients use PhysiApp to receive programmes and report completion. They can also record pain or difficulty and communicate with their care team.

Physitrack supports integration with Epic, but each trust must confirm the required interface during technical discovery. Digital leads document clinician access, patient matching, and which information passes between platforms, and establish whether data returns automatically to the EHR or requires an export.

Physitrack does not provide native clinical documentation. Clinicians cannot use the platform for SOAP notes or manual muscle testing records. The platform also does not provide general range-of-motion charting, appointment scheduling, or billing. The trust’s EHR remains the system of record, and Physitrack handles prescribed rehabilitation and engagement between clinical contacts. The platform does not include a dedicated integration for AI scribe tools.

The integration checklist should answer four practical questions.

• Trust IT leads should identify the authentication and access method.
• Clinical owners should define which patient information Physitrack receives.
• Information governance leads should map where programme, adherence, and PROMs data resides.
• EHR owners should confirm which information returns to Epic and how clinicians view it.

Procurement routes: G-Cloud, the Digital Marketplace and framework access

The available evidence does not confirm a current G-Cloud lot or Digital Marketplace listing, so procurement leads should verify Physitrack’s purchasing route before setting an approval timetable. Ask Physitrack for the applicable listing details and framework agreement. Request the supporting commercial documents, including the current service description and pricing document, together with the call-off terms.

Framework availability can change between procurement cycles, so an earlier listing is not proof of current access. If an available framework meets the Trust's requirements, procurement follows the local governance and commercial approval process. If none does, the procurement team identifies another permitted route under the Trust's standing financial instructions.

Before award, the trust should check that the proposed contract matches the Physitrack evidence reviewed during DSPT and DTAC due diligence. The contract should define data-processing responsibilities and the required integration scope. The contract should also specify licensing and implementation support, along with service management arrangements.

A written route-to-market request gives Physitrack enough information to confirm the appropriate purchasing option. Include the intended departments, user volumes, rollout phases, and required EHR connections. Procurement and clinical leads can then compare the commercial route with the planned deployment model before approving rollout.

What a multi-site or multi-department rollout looks like

A phased rollout lets your Trust test its operating model before extending Physitrack across more services. Your Trust can begin with one department and confirm the information governance and integration arrangements. It can then add departments under an agreed expansion plan.

Each participating service defines its clinical use before launch. Clinical leads choose approved home exercise programme content and outcome measures, and the Trust sets staff permissions, patient enrolment processes, and local support responsibilities.

A first phase should test how Physitrack works alongside the existing EHR and referral pathways. The platform handles home exercise programmes and patient engagement, including remote monitoring, without replacing the clinical record. Staff training can then focus on prescribing programmes and reviewing patient-reported data within established workflows.

Reported deployments at Royal Free London and Mersey and West Lancashire show use across departments with different clinical functions. They do not, by themselves, prove that those departments launched in phases. Buyers planning a phased rollout should ask these references about launch sequence, shared configuration, training, and governance before using their experience as a model.

Clinical governance remains with the trust throughout the rollout. Trust clinicians decide which programmes suit each pathway and how patient data informs care. Procurement and information governance leads retain responsibility for supplier assurance, access controls, and periodic review. Your Trust can administer licences centrally while each service retains control of clinical decisions.

Physitrack beyond the NHS: private provider use

Physitrack reports use by UK private healthcare providers, including Bupa, Nuffield Health, and Circle Health Group. These references demonstrate adoption outside the NHS, but they do not establish suitability for a specific Trust’s governance, integration, or clinical requirements.

Physitrack vs Rehab Guru for NHS procurement

NHS buyers should compare the products’ intended operating scope, evidence of NHS use, and fit with the existing EHR before comparing feature counts. Based on the evidence summarised below, Physitrack is positioned for broad or phased multi-department deployments, while Rehab Guru is positioned for narrower home exercise programme and clinic-management requirements.

Procurement leads should assess the operational boundary as well as the feature list. Rehab Guru may cover simpler clinic workflows in one system. Physitrack fits alongside an existing EHR, including Epic, and adds exercise prescription and remote monitoring without replacing clinical documentation. It also supports PROMs and patient engagement.

Next steps for procurement and clinical service leads

Consider bringing the people responsible for procurement and clinical delivery into one review with Physitrack. Include the information governance and IT owners. Ask Physitrack for its current framework access details. Request DSPT and DTAC evidence, along with GDPR and hosting documentation. Physitrack should also provide ISO certificates and relevant data-flow materials.

Request a Trust-specific discussion of the required Epic or other system connections and departmental licensing. Cover implementation support and the phased rollout plan in the same discussion. Physitrack should map each responsibility to the Trust, the supplier, or both.

Before shortlisting Physitrack, request current references from NHS services that match the proposed departments, integration requirements, and rollout scale, then verify the relevant due-diligence claims directly with those contacts.

FAQs

Who is responsible for renewing the DSPT submission?

The DSPT requires an annual supplier self-assessment. Physitrack maintains its own submission, while each Trust remains responsible for its organisational DSPT duties. Procurement leads should request the current submission status and supporting evidence during due diligence.

Where does Physitrack host NHS patient data?

A hosting region is the geographic location in which patient data is stored and processed; it helps determine the applicable jurisdiction and security controls. Physitrack offers EU hosting and should document the proposed region, data flows, retention terms, and subprocessors. Confirming those details before contract approval helps the Trust assess GDPR compliance and control international data-transfer risks.

Does Physitrack replace existing clinical documentation?

Clinical documentation is the formal patient record containing clinical notes, assessments, and related care information. Physitrack does not replace that record; it adds HEP, RTM, PROMs, telehealth, and patient communication alongside EHRs such as Epic. This separation lets the Trust retain its EHR as the system of record while using Physitrack for rehabilitation delivery and engagement.

How does licensing work across multiple departments?

Multi-department licensing defines which users, services, sites, and administrative roles a contract covers. Physitrack can manage licences and staff accounts centrally through PT Direct while department administrators retain operational control. A Trust-specific quote covering allocation, expansion terms, support, and account governance helps buyers forecast costs and assign responsibilities before rollout.