Security

Patient data protected at every layer

GetClinic is built for healthcare. Security and compliance aren't features — they're the foundation of everything we build.

Compliant
UK GDPR
General Data Protection Regulation
Registered
ICO Registered
Information Commissioner's Office
Type II
Vercel SOC 2
Infrastructure provider
Type II
Supabase SOC 2
Database provider
Enforced
TLS 1.3
Data in transit encryption
Enforced
AES-256
Data at rest encryption

How we protect your data

Encryption in transit & at rest

All data is encrypted in transit using TLS 1.3. Data at rest is encrypted using AES-256. Prescription signing uses asymmetric cryptography — each prescription is cryptographically signed by the prescriber.

Row-level security

Our database enforces row-level security (RLS) on all sensitive tables. Even at the database layer, a clinic can only access its own patient records. Cross-clinic data leakage is architecturally impossible.

UK GDPR & ICO compliance

GetClinic is designed for UK GDPR compliance. We are registered with the Information Commissioner's Office (ICO) as a data controller and data processor. Data Processing Agreements (DPAs) are available for all clinic customers.

Infrastructure & hosting

Hosted on Vercel (global edge CDN, SOC 2 Type II) and Supabase (PostgreSQL, SOC 2 Type II, ISO 27001). All infrastructure is hosted in EU/UK-compliant regions. No data is processed outside the UK/EEA.

Full audit trail

Every action — prescription issued, record accessed, patient data modified — is logged in an immutable audit trail with timestamp, user ID, and IP address. Audit logs are retained for a minimum of 8 years.

Authentication & access control

Email-verified accounts, bcrypt-hashed passwords, OTP two-factor authentication, and role-based access control (RBAC) with 8 distinct roles. Prescribers use a separate PIN for prescription signing with a 30-minute session window.

Data minimisation

We collect only the data necessary for the platform to function. Patient data is never used for advertising or shared with third parties without explicit consent or legal basis.

Breach response

We have a documented data breach response procedure. In the event of a breach, affected parties and the ICO are notified within 72 hours as required by UK GDPR. See our Data Breach Response SOP for details.

Data retention

Clinical records & prescriptions8 years minimum (legal requirement for adults)After retention period, securely deleted
Children's recordsUntil age 25 (or 8 years from last entry)Whichever is later
Audit logs8 yearsImmutable — cannot be deleted
Account dataDuration of account + 90 daysDeleted on account closure
Payment dataHandled by Stripe (PCI DSS Level 1)GetClinic stores no raw card data

Report a security vulnerability

If you discover a security vulnerability in GetClinic, please disclose it responsibly. Email us at support@getclinic.io. We commit to acknowledging your report within 48 hours and keeping you updated on remediation. We will not pursue legal action against good-faith security researchers.

Report a vulnerability →