Security
Security and data.
How patient and clinic data is handled, and who helps us handle it.
Data handling
Our products process enquiry conversations and contact details and, for CareNova Practice, appointment and consent records. We process this data on behalf of the clinics and practitioners who use our products, and only to provide the product.
UK GDPR
We design to UK GDPR. Consent is recorded where it is needed, access is limited to the people who need it, and data is kept for the purpose it was collected.
Data residency
Product data is stored in Supabase's EU region.
Encryption
Data is encrypted in transit with TLS, and encrypted at rest by our infrastructure providers.
Access control
CareDental uses a five-role permission model: director, clinic admin, treatment coordinator, receptionist and dentist. Each role sees what it needs.
Sub-processors
Companies that process data on our behalf. Which of them apply depends on the product.
| Sub-processor | Purpose |
|---|---|
| Anthropic | AI processing of conversations (Claude) |
| Supabase | Database and authentication, EU region |
| Vercel | Application hosting |
| Twilio | SMS delivery |
| Resend | Transactional email |
| Stripe | Payments and deposits |
| Meta (WhatsApp) | WhatsApp Business messaging |
Data processing agreement
A data processing agreement is available on request. Email hello@etnahealth.co.uk.
Responsible disclosure
If you believe you have found a security issue, please email hello@etnahealth.co.uk with enough detail to reproduce it. We will acknowledge your report and keep you informed.