Built for clinical data, from the first line of code.

The application and its database run on EU infrastructure (Hetzner, in Germany). Your patient data stays in the EU. Where a sub-processor sits outside the EEA, the transfer is covered by the UK International Data Transfer Addendum to the Standard Contractual Clauses.

All traffic runs over TLS. Clinical photos and signed consent PDFs are held in private storage, reachable only through short-lived signed links and never on a public URL, and access to every record is controlled at the database.

Every record is fenced to your clinic by row-level security applied in the database itself and denied by default, so the boundary holds even if a query is wrong, not just hidden in the interface. Access inside your clinic is role-based: owners, prescribers, practitioners and reception each see only what their role allows.

Who did what, and when, is recorded across the platform. Signed consent forms are timestamped and locked to the exact version the patient signed, with a full history of what each patient agreed to.

You are the data controller and AesthetiClinic is your processor. The UK GDPR Article 28 Data Processing Agreement, including the full list of sub-processors, is recorded against your account when you onboard.

A one-click full export gives you everything, any time, at no cost, and GDPR-ready erasure removes a patient's data on request. Portability is a built-in right here, not a paid add-on or an exit tax.

The built-in consent and medical-history library was reviewed with an insurer, so the forms your patients sign are ones that stand up where it matters, rather than something we drafted alone.