Hi. As someone who builds medical and lab systems in Laravel, I completely agree about compliance and data governance often take much more effort than writing code itself. The best way is to focus your policies on data access and backup recovery that usually satisfies most compliance audits. For now i'm using locally backup in server premises and cloud backup.

Since your in UK, i think this few tips might help:

1. Laravel Cloud runs on AWS, you can reference AWS's ISO 27001, SOC 2, and GDPR compliance certifications for the infrastructure layer for your business continuity policy.
2. Focus on documenting your database backups (RPO/RTO), rolebased access control (RBAC), and using Sentry for incident monitoring
3. Make sure localy cached data on carers' devices like IndexedDB/Service Worker is encrypted
4. Implement strict activity logging for every view/edit on patient records.