You hold your clients’ trust. We hold the data.
You are the data controller for your clients' records. We are your processor. This page sets out exactly what that means in practice — what's protected, who can see what, and every third party involved.
GDPRHow your data is protected
Every connection runs over TLS. Passwords are hashed with bcrypt, never stored or recoverable, and stored third-party credentials are encrypted at the application layer.
Files shared through the client portal carry per-file visibility. A document is private until you share it, downloads are guarded so only the client it belongs to can open it, and you can revoke access at any time.
You can export your clients, appointments and transactions as CSV files and take them with you. Closing your account doesn't hold your records hostage, and we don't sell client data to anyone, ever.
SMS carries a mandatory STOP opt-out that cannot be removed, and a client who opts out is blocked from further messages immediately. Opt-outs are recorded per practice, as ICO and PECR rules require.
Practice websites are snapshotted automatically with version history, so a bad edit is a restore rather than a rebuild.
Login history and activity logs are available in Settings, so you can see every sign-in and failed attempt on your account, and when it happened.
Who else touches your data
Running a practice platform means using specialist services for payments, messaging and storage. Under UK GDPR these are our subprocessors, and you're entitled to know who they are. These are the services that handle practice and client data. Our Privacy Policy lists every provider we use, including sign-in, analytics and marketing tools.
Need a Data Processing Agreement, or our current terms with any of these providers? Ask us — we'll send them.
Questions clinics ask us
Ask us for the current terms with each AI provider before you enable AI features — we’ll send them.
Software your compliance officer can sign off
Start free, and ask us anything about how your data is handled.
Would rather be shown? Book a 20-minute demo