Security and data protection
Your patient records deserve clear answers. See where they are held, who can access them and how you can take them with you.
Controls and boundaries
The application and its database run on Hetzner infrastructure in Germany. Uploaded photographs and documents are stored in Cloudflare R2 under EU jurisdiction.
Email, SMS and encrypted off-site backups use US services under Standard Contractual Clauses. Cloudflare may process traffic worldwide. The register below sets out each service’s location.
DPA, sections 4 and 5 and the AnnexNetwork connections use TLS. Uploaded R2 files are encrypted at rest, and off-site backups are encrypted. Clinical photographs and signed documents use private storage and short-lived signed links.
Data on our application servers is protected by access controls. We do not claim full-disk encryption at rest for the database. Traffic between components on the same server is not separately encrypted.
DPA, section 4: security measuresRow-level security fences records to each clinic at the database, with access denied by default. Staff access is controlled by role.
Your clinic chooses who has access. Give each person their own login, keep credentials secure and remove access when someone leaves.
DPA, section 4; subscription agreement, section 3Audit logging records activity across the platform. Consent forms signed in AesthetiClinic are timestamped and locked to the version the patient signed.
An imported legacy PDF remains an original document. Importing it does not create a new signature or retrospectively version its wording.
Read the migration scopeEncrypted off-site backups of the database and uploaded files are held in Google Cloud Storage in the United States under Standard Contractual Clauses.
The DPA requires notification without undue delay, and within 72 hours of becoming aware of a breach affecting your data. This is a contractual notification term, not an uptime or restore-time commitment.
DPA, section 4 and the AnnexThe shared register
The complete DPA register, with each service’s location and role.
Core services and optional connections have different scopes. Tools connected through your own account are covered by the responsibilities in DPA section 8. Optional AI scribes run under our accounts and are addressed in section 6.
Read the processor and connector terms
Your data over time
A free structured export includes your records and uploaded files. Very large media libraries are supplied separately on request, also free.
Export scope and accessYour account becomes read-only, with export access for at least 30 days after the agreement ends. There is no exit fee.
Agreement, sections 6, 15 and 16Your clinic remains responsible for lawful retention. Where a signed clinical record must be kept, some free text and security or audit records are not automatically scrubbed. Ask us to handle those records.
DPA, section 4: data-subject rightsAt the end of the service, data is returned or deleted at your choice, except where the law requires retention. Copies may remain in encrypted backups until overwritten in the ordinary course. Written deletion confirmation is available on request.
Agreement, section 16Optional AI
See which optional tools process a clinical draft, and which help our team answer support questions.
Heidi receives consultation audio, a patient reference and name, and the clinician’s email and identifier. Its UK service stores data in the UK and processes it in the UK or EEA. The draft returns for clinician review; AesthetiClinic does not hold the audio or transcript.
The published DPA notice says AssemblyAI and Amazon Bedrock have not yet received data. AssemblyAI’s EU endpoint excludes audio and transcripts from training; a zero-retention setting is not confirmed. Bedrock is described as processing in Ireland without sharing inputs with the model provider.
Anthropic is listed for drafting support replies for a member of our team to review. It is not the service that processes clinical scribe drafts. The register records its US location and transfer safeguards.
Listed integrations are not necessarily enabled for your clinic.
Questions
The application database is hosted in Germany. Uploaded files are stored in Cloudflare R2 under EU jurisdiction and encrypted at rest. Some processing takes place outside the UK and EEA: email, SMS and encrypted off-site backups use US services under Standard Contractual Clauses, and traffic may be processed worldwide. See the full register and DPA for each service’s scope.
Row-level security is enforced in the database and denied by default. Staff access within your clinic is role-based. Your clinic is responsible for giving each person their own login, assigning appropriate access and removing it when they leave.
The DPA is recorded against your account at onboarding. It describes your clinic as the controller and AesthetiClinic as the processor, with obligations under UK GDPR Article 28. The dated version and legal-review status are shown with the document below.
Yes. The agreement provides a free structured export of your data and uploaded files, with no exit fee. Very large media libraries are supplied separately on request, also free. Export access continues for at least 30 days after the agreement ends.
Read the evidence
Keep the data responsibilities and account terms with your clinic’s own records.
Copy checked against the published documents on 11 October 2026, not an infrastructure audit.
Roles, security measures, transfers and the complete processor register.
Version 1.5 · 25 September 2026 · Draft pending final legal review.
Account responsibilities, free export, cancellation and retained records.
Version 1.1 · 15 September 2026 · Draft pending final legal review.
How AesthetiClinic handles information about visitors and enquiries.
Send a specific security or data-protection question to our team.
Email hello@aestheticlinic.ioTry the platform free for 14 days. Card required. Cancel before the trial ends and you pay nothing.