Clinical safety
Intended purpose and clinical safety
Last updated 19 October 2026 · Version 0.1 (draft)
This is a draft. It is published openly so that clinicians and NHS organisations can see how Show Me Where is meant to be used and what could go wrong. It has not yet been reviewed by a Clinical Safety Officer, and the risk ratings below are proposed, not approved.
Intended purpose
Show Me Where is a free website that shows simplified, adjustable 3D pictures of the body. A healthcare professional sets a picture up from the patient’s own report, uses it to explain the findings and the treatment they have discussed, and can give the patient a picture sheet to take home.
Intended users
- Healthcare professionals (doctors, nurses and allied professionals) explaining findings and treatment in an appointment.
- Patients, families and carers, looking again at a picture their clinician set up, from the QR code on the sheet, or browsing normal anatomy and general information.
Intended setting
Outpatient clinics, pre-assessment, wards and remote consultations in the UK, and at home afterwards. It runs in a web browser on a computer, tablet or phone. No login, installation or connection to clinical systems is needed.
What goes in and what comes out
- In: values the clinician reads from the patient’s report and types in, such as a size in millimetres, a side or a position, and the treatment they have discussed. Optionally a name and a short note for the sheet.
- Out: an illustration on screen, a plain-words summary, and an A4 picture sheet (PDF), which can be translated into 11 languages for the patient.
What it does not do
- It does not diagnose, stage, grade or predict anything.
- It does not read or analyse scans, images or test results; it only shows what a clinician types in.
- It does not recommend, rank or choose treatment.
- It does not store, send or receive patient data, and does not connect to any clinical system.
- It is not a substitute for the report, an examination or professional advice.
Regulatory position
We consider Show Me Where to be general information and communication support, in the same way as a diagram in a patient leaflet or a plastic model on a clinic desk, and not a medical device under the UK Medical Devices Regulations 2002: it has no diagnostic, monitoring, prediction or treatment purpose, and it does not process data to give information about a particular patient beyond showing back what the clinician enters. This is our own assessment and will be confirmed with regulatory advice. Features are designed to stay within this purpose; see the important information page.
How clinical risk is managed
Although it is not a medical device, Show Me Where is used in clinical conversations, so clinical risk is managed following the principles of the NHS standard DCB0129 (clinical risk management for the manufacture of health IT systems). An NHS organisation using it would carry out its own assessment under DCB0160.
- Clinical Safety Officer: to be appointed. Until then this page is a draft and the ratings are proposed.
- Hazard log: below. It is updated when an explorer is added or changed, and when a problem is reported.
- Specialist review: each explorer has a list of clinical figures and statements for review by a specialist in that area.
- Testing before release: each explorer is checked for the picture sheet, the QR link reopening the same picture, phone layout, translated sheets fitting the page, and the treatment text before and after each treatment.
- Reporting a problem: email hello@showmewhere.org.uk. Safety reports are looked at first, and the change is recorded in the hazard log.
- Safety case report: to be written once the Clinical Safety Officer has reviewed the hazard log.
How risks are rated
Each hazard is rated for likelihood and consequence, before (initial) and after (residual) the controls, using the DCB0129 matrix. 1 is acceptable; 3 or more needs further action; 5 is unacceptable.
| Minor | Significant | Considerable | Major | Catastrophic | |
|---|---|---|---|---|---|
| Very high | 3 | 4 | 4 | 5 | 5 |
| High | 2 | 3 | 3 | 4 | 5 |
| Medium | 2 | 2 | 3 | 3 | 4 |
| Low | 1 | 2 | 2 | 3 | 4 |
| Very low | 1 | 1 | 2 | 2 | 3 |
Hazard log (summary)
| ID | Hazard | Initial | Residual |
|---|---|---|---|
| H1 | The picture is taken to be the patient’s own anatomy or scan | 3 | 2 |
| H2 | A report value is entered wrongly | 3 | 2 |
| H3 | A value shown differs from the value entered (software fault) | 2 | 2 |
| H4 | A figure calculated by the model is taken as a measurement | 2 | 2 |
| H5 | Treatment wording does not match the treatment discussed | 3 | 2 |
| H6 | The tool is seen as recommending a treatment or making a diagnosis | 2 | 2 |
| H7 | Clinical content is inaccurate or out of date | 3 | 3 |
| H8 | A translated sheet is wrong or unclear | 3 | 3 |
| H9 | Urgent help is signposted wrongly | 3 | 2 |
| H10 | A helpline number or web link is out of date | 2 | 1 |
| H11 | Someone uses the tool on their own to work out what is wrong | 2 | 2 |
| H12 | Personal details are disclosed | 2 | 1 |
| H13 | A QR link opens a different picture from the one given | 2 | 1 |
| H14 | The picture does not display, or displays incompletely | 1 | 1 |
| H15 | A picture causes distress | 2 | 1 |
| H16 | Left and right are confused | 2 | 1 |
Hazard log (in full)
H1. The picture is taken to be the patient’s own anatomy or scan
- Possible causes
- The 3D model looks realistic; the patient sees it without the clinician’s explanation (for example from the QR link at home).
- Possible effect
- Wrong expectations about size, position or what an operation involves; avoidable worry or false reassurance.
- Initial risk
- 3 Medium likelihood, considerable consequence
- Controls in place
- Every explorer opens at normal anatomy and is set up by the clinician from the report.
- Positions and sizes that are not entered from the report are labelled “example” on screen, in the colour key and on the sheet.
- The sheet says the picture is a simplified illustration and that sizes and shapes are approximate; every page footer and the important information page say it does not diagnose, measure or recommend treatment.
- Further actions
- Clinician guides to state plainly that the picture is explained, not handed over unexplained.
- Keep the release test scripts in the code repository so they run the same way every time.
- Residual risk
- 2 Low likelihood, considerable consequence
H2. A report value is entered wrongly
- Possible causes
- Typing error, wrong units, or a value from a different report or a different patient.
- Possible effect
- The picture and sheet show the wrong size, distance or position; the patient is misinformed.
- Initial risk
- 3 Medium likelihood, considerable consequence
- Controls in place
- Each value is shown as a number box with a slider, in the units the report uses, with a range check.
- The value entered is repeated in the plain-words summary and the key measurements on the sheet, so it can be checked against the report.
- The important information page asks clinicians to check the set-up against the report and to check the sheet before giving it.
- Further actions
- Consider a “check these values” step before the sheet is created.
- Residual risk
- 2 Low likelihood, considerable consequence
H3. A value shown differs from the value entered (software fault)
- Possible causes
- A fault in how the model, summary or sheet uses the entered value.
- Possible effect
- The patient sees a figure that is not in their report.
- Initial risk
- 2 Low likelihood, considerable consequence
- Controls in place
- A fault of this kind was found and fixed in October 2026 (an entered 2.0 cm was shown as 2.7 cm after a treatment response was drawn): entered values are now always the ones shown.
- Before release, test scripts build the sheet for each explorer and reopen its QR link to check the summary is identical.
- Further actions
- Add a regression check that every entered value appears unchanged on screen and in the sheet, for every explorer, before each release.
- Residual risk
- 2 Very low likelihood, considerable consequence
H4. A figure calculated by the model is taken as a measurement
- Possible causes
- Some explorers draw distances or margins that follow from the model rather than the report.
- Possible effect
- The patient relies on a number that is not a measurement of their body.
- Initial risk
- 2 Medium likelihood, significant consequence
- Controls in place
- Calculated figures are labelled “model estimate”; where an estimate could mislead (for example some margins on low rectal tumours) it is not shown as a number.
- The important information page states that numbers calculated by the model are not measurements of any person.
- Further actions
- Review every calculated figure with the relevant specialist.
- Residual risk
- 2 Low likelihood, significant consequence
H5. Treatment wording does not match the treatment discussed
- Possible causes
- Shared wording written for one treatment appears with another.
- Possible effect
- The patient is told about consequences of a treatment they are not having (a fault of this kind was found and fixed: watch-and-wait wording mentioned a stoma and surgery).
- Initial risk
- 3 Medium likelihood, considerable consequence
- Controls in place
- Each treatment has its own text for before and after; only an operation is captioned “after surgery”.
- The sheet text for every treatment, before and after, is read through for each new explorer and after shared changes.
- Further actions
- Specialist sign-off of every treatment text.
- Residual risk
- 2 Low likelihood, considerable consequence
H6. The tool is seen as recommending a treatment or making a diagnosis
- Possible causes
- The order of options, or the fact that the picture changes, is read as advice.
- Possible effect
- A patient feels steered towards, or away from, a treatment.
- Initial risk
- 2 Low likelihood, considerable consequence
- Controls in place
- The tool never ranks or chooses treatment; the clinician picks what to show, and the sheet heading reads “The treatment you discussed”.
- No diagnosis, stage or prognosis is derived from what is entered.
- The important information page and every sheet say the tool does not diagnose or recommend treatment.
- Further actions
- None identified yet.
- Residual risk
- 2 Very low likelihood, considerable consequence
H7. Clinical content is inaccurate or out of date
- Possible causes
- Figures such as recovery times, hospital stays, normal ranges or descriptions of procedures are wrong, or practice changes.
- Possible effect
- The patient is given incorrect information.
- Initial risk
- 3 Medium likelihood, considerable consequence
- Controls in place
- Content follows NHS and national guidance and is written to be general (“often”, “usually”, “your team will explain”).
- Each explorer lists the claims that need specialist review; the sheet tells the patient their own team will explain what applies to them.
- Further actions
- Specialist review of each explorer, recorded with the reviewer’s role and date.
- A review date for each explorer, at least yearly.
- Residual risk
- 3 Medium likelihood, considerable consequence
H8. A translated sheet is wrong or unclear
- Possible causes
- Machine-assisted translation of clinical wording; text not reviewed by a medical translator.
- Possible effect
- A patient reading their own language misunderstands their condition or treatment.
- Initial risk
- 3 Medium likelihood, considerable consequence
- Controls in place
- Only the sheet is translated; the screen, which the clinician uses, stays in English.
- The tool tells the clinician that translations have not yet been checked by a professional medical translator.
- Translated sheets are checked automatically for missing text and for text that runs off the page.
- Further actions
- Professional medical translation review for each language.
- Print a short note on translated sheets that the English version is the reference.
- Residual risk
- 3 Medium likelihood, considerable consequence
H9. Urgent help is signposted wrongly
- Possible causes
- Wrong service named for the condition, or a service that does not apply to the patient.
- Possible effect
- Delay in getting help when unwell.
- Initial risk
- 3 Low likelihood, major consequence
- Controls in place
- Signposting follows NHS services: pharmacist, GP, NHS 111 (phone, online or NHS App) and 999. The 24-hour hospital number is mentioned only for people having cancer treatment, who are given one.
- Further actions
- Specialist review of condition-specific warning signs in each explorer.
- Residual risk
- 2 Very low likelihood, major consequence
H10. A helpline number or web link is out of date
- Possible causes
- Organisations change numbers, opening hours or addresses.
- Possible effect
- The patient cannot reach support.
- Initial risk
- 2 Medium likelihood, minor consequence
- Controls in place
- Contact details are limited to national NHS services and established charities; numbers are omitted where not certain.
- The sheet shows the date contact details were checked.
- Further actions
- Check every number and link at least every 6 months.
- Residual risk
- 1 Low likelihood, minor consequence
H11. Someone uses the tool on their own to work out what is wrong
- Possible causes
- Open public website; search box; worry about symptoms.
- Possible effect
- False reassurance or alarm; delay in seeking care.
- Initial risk
- 2 Low likelihood, considerable consequence
- Controls in place
- There is no symptom checker; every explorer opens at normal anatomy and needs a report to set up.
- Search shows pictures to look at together, and says it cannot tell you what is wrong.
- Pages direct people with symptoms to a pharmacist, GP or NHS 111.
- Further actions
- None identified yet.
- Residual risk
- 2 Very low likelihood, considerable consequence
H12. Personal details are disclosed
- Possible causes
- A name or note typed onto the sheet; a sheet left on a shared device or printer; a QR link shared.
- Possible effect
- Loss of privacy.
- Initial risk
- 2 Low likelihood, significant consequence
- Controls in place
- Nothing is stored or sent: no accounts, cookies or analytics; names and notes stay on the device and are forgotten when the page closes.
- The QR link holds the picture settings only, never the name or notes.
- The tool reminds clinicians to use their organisation’s approved route to send a sheet.
- Further actions
- None identified yet.
- Residual risk
- 1 Very low likelihood, significant consequence
H13. A QR link opens a different picture from the one given
- Possible causes
- A later change to an explorer alters how saved settings are read.
- Possible effect
- The patient sees a picture that does not match their sheet.
- Initial risk
- 2 Low likelihood, significant consequence
- Controls in place
- Links carry a version number; before release, test scripts reopen each link and compare the summary with the sheet.
- Further actions
- Keep older link versions readable whenever an explorer changes.
- Residual risk
- 1 Very low likelihood, significant consequence
H14. The picture does not display, or displays incompletely
- Possible causes
- Old browser, no 3D graphics support, low-powered device.
- Possible effect
- The explanation cannot be given with the picture, or a partial picture is shown.
- Initial risk
- 1 Low likelihood, minor consequence
- Controls in place
- The plain-words summary and sheet text do not depend on the 3D picture.
- Every explorer checks for 3D graphics support and, if it is missing, says so plainly instead of showing a partial picture.
- Further actions
- None identified yet.
- Residual risk
- 1 Very low likelihood, minor consequence
H15. A picture causes distress
- Possible causes
- Pictures of a tumour, a stoma or the result of an operation.
- Possible effect
- Upset, especially if seen without support.
- Initial risk
- 2 Medium likelihood, minor consequence
- Controls in place
- Pictures are schematic, not photographic; the clinician chooses what to show and when; Patient view hides the set-up.
- Help pages list support services.
- Further actions
- None identified yet.
- Residual risk
- 1 Low likelihood, minor consequence
H16. Left and right are confused
- Possible causes
- Pictures can be turned; cross-sections follow the scan convention, where the patient’s right is on the viewer’s left.
- Possible effect
- The patient believes a finding is on the wrong side.
- Initial risk
- 2 Low likelihood, significant consequence
- Controls in place
- Slices are labelled with the patient’s left and right and say how they are viewed; side choices use the patient’s left and right.
- Further actions
- Specialist check of laterality in each explorer.
- Residual risk
- 1 Very low likelihood, significant consequence
Open actions
- Appoint a Clinical Safety Officer, review this hazard log and write the safety case report.
- Specialist review of every explorer, recorded with the reviewer’s role and date (H7, H5, H4, H16).
- Professional medical translation review, and a note on translated sheets that the English version is the reference (H8).
- Confirm the regulatory position with regulatory advice.
- Automated check that entered values appear unchanged on screen and on the sheet in every explorer (H3).
- Six-monthly check of helpline numbers and links (H10).
- Repeat the accessibility review against WCAG 2.2 AA at least yearly and after major changes (first review 19 October 2026; see the accessibility statement).