Security and privacy

Trust Center

How Doccure protects patient data. HIPAA-ready and GDPR-ready. We sign a BAA.

Request a BAA Request our security overview
  • HIPAA-ready
  • GDPR-ready
  • We sign a BAA
  • HL7 FHIR standards

HIPAA and GDPR have no official certificate, and we do not claim one.

Built into the platform

How we protect patient data

  • Data isolation

    Each organisation's data is isolated by Postgres row-level security in the database itself, not only in the app. Your data belongs to you.

  • Audit trail

    A hash-chained, tamper-evident audit log records who opened or changed a record. Patients can see who viewed their record.

  • Signed records

    Prescriptions and lab results carry tamper-evident signatures. Doctors sign prescriptions with a PIN.

  • Consent

    Consent records for care, telehealth, recording, marketing and data sharing, kept on the patient record.

  • AI and patient data

    Patient details are redacted before data is sent to an AI provider. You choose the provider, or switch AI off. AI outputs are suggestions reviewed by a licensed clinician. Not a medical device.

  • Payments

    Card data never touches Doccure servers. Payments are processed by PCI-compliant gateways, through your own account.

  • Compliance records

    Registers for BAAs (with expiry alerts), breaches, data-subject requests and retention, so your team keeps its records in one place.

  • Hosting

    US, Europe or Asia, on request. On-premise or private cloud for Enterprise. Azure servers in India for Doccure India.

For your review

Documents on request

Business Associate Agreement

We sign a BAA with US covered entities and business associates before they handle patient data on Doccure.

Request a BAA

Security overview and subprocessors

Our security overview and the list of subprocessors (cloud, AI, SMS, email, video and payments) are available on request.

Request the overview
FAQ

Security questions

Is Doccure ready for HIPAA and GDPR?

Doccure is HIPAA-ready and GDPR-ready, and we sign a BAA. HIPAA and GDPR have no official certificate, and compliance also depends on how your organisation uses the platform.

How is our data kept apart from other organisations?

Each organisation's data is isolated by Postgres row-level security in the database itself, not only in the application. Your data belongs to you.

Where is our data hosted?

In the US, Europe or Asia, on request. Enterprise deployments can run on-premise or in your private cloud. Doccure for clinics in India is hosted on Azure servers in India.

Is patient data sent to AI providers?

Patient details are redacted before any data is sent to an AI provider. You choose the provider (OpenAI, Azure OpenAI, Anthropic or self-hosted), and AI can be switched off. AI outputs are suggestions reviewed by a licensed clinician. Not a medical device.

Who are your subprocessors?

Our list of subprocessors (cloud, AI, SMS, email, video and payments) is available on request. Ask us for our security overview.

Questions from your security team?

Book a call