Where data is stored
Your practice's data is stored in the EU.
Who is responsible for it
Compliance UK is a UK GDPR processor and your practice is the controller. Our Article 28 data processing agreement sets out what we may do with the data. The companies we use to run the service are on the sub-processors list.
Signed records
Each signed record is SHA-256 hashed and chained to the one before it. Nobody can edit or delete a signed record.
Sensitive staff records
DBS and immunisation records are kept as a status and a date only, with no document upload by default. They're never sent to an AI model. Every read of a special-category record is logged.
If you cancel
You get a full export of your data. We delete it 90 days after you cancel. Signature and audit records are kept where the law requires it.
Certifications
Compliance UK doesn't hold any security certifications yet.