Empowering a start-up to take on a regulated market
Mindstep is a digital front door platform for mental health and mental fitness, leveraging AI to provide clinical assessments, care, and onwards care navigation.
The London-based start-up operates a B2B2C model, connecting patients with healthcare and health insurance providers to provide 'right time, right care, right value' support that works.
Mindstep's application is regulated as a software as medical device (SaMD) product, in a digital sector reliant on close control of patient data.
Co-founder and COO Dr. Aaron Lin therefore had 3 broad groups of compliance activity to take on as he began to scale the company:
1. Data privacy: the UK and EU GDPRs, the UK DPA, and the EU-U.S. Data Privacy Framework (DPF)
2. Information security: ISO 27001, SOC 2, Cyber Essentials and NIS2
3. Medical device regulations: the UK MDR and EU MDR
These complex regulatory demands were made even more difficult by the small size of the company and its early levels of quality and compliance maturity.
There were little bits and pieces of documentation everywhere.
It wasn't comprehensive. It wasn't regularly reviewed. We struggled to get our information together and maintain it in a single location.
And we're a small team: we didn't have a dedicated person with experience of medical devices or information security.
Aaron wanted a way to ease the burden of Mindstep's compliance demands without the additional cost of an FTE salary.
It was critical that the 'resource-intensive' and 'time-consuming' headache of compliance was minimized, to free up Aaron and his team to focus on developing their product and business.
As an eQMS provider with deep experience of the medical device, data privacy and information security fields, Qualio stood out as the natural choice for the company to invest in.
We basically said, "let's scrap everything we've done already because it's not working, and start fresh".
We knew Qualio were experts and this is what they do. And so we knew we could trust Qualio to ensure we have a solid foundation and just go from there.
To accelerate Mindstep's quality maturity at a stroke, Aaron fed his new Qualio eQMS platform with Qualio's pre-built content and templates for key standards like ISO 27001, allowing the company to prepare for certification at rapid speed.
Mindstep went live with Qualio in early 2024.
The benefits of a dedicated quality platform, backed by expert-built industry content, paid off very quickly.
We had Qualio in place in Q1.
We got ISO 27001 in Q3.
We did our SOC 2 Type 1 at the end of the year, and then Type 2 in January.
It was a very quick timeline.
And all of the documents we used to pass our audits came from Qualio.
Qualio gave Mindstep the mature, connected and centralized quality system they needed to impress both auditors and clients while securing their regulatory standards.
All Mindstep's quality documentation now lives in Qualio, with key activities like training and quality events handled entirely within the system.
Aaron's product team, who work primarily in Jira, benefited from the integration between Jira and Qualio Design Controls too, allowing their development work to automatically sync with total compliance into the company eQMS platform.
And ultimately, Qualio's heavy lifting freed Aaron and his team to do the work they want to do:
Qualio allows us to put compliance at the back of our minds and focus on what we want to do, which is to build our product and to deliver mental health tools that help people.
Because we know we now have a foundation that will keep us on track of our compliance, it's no longer something we need to be constantly thinking about.
Aaron identifies a clear return on his Qualio investment, driven by time savings, the commercial benefits of securing his regulatory standards, and the confidence he can now enjoy in his company's long-term compliance.
Mindstep has gone from strength to strength since, even scooping the Good Initiative of the Year award at the British Data Awards 2025.
Aaron now plans to expand Mindstep's customer base and footprint, with the tough work of compliance taken care of in the background.
.png?width=20&height=20&name=Icons_Newsletters%20(3).png){kind=icon}
