---
title: "Trust Center"
url: "https://doccure.io/trust-center/"
updated: "2026-10-25T22:08:03+00:00"
type: "page"
business:
  name: "Doccure"
  phone: "+44 7438 823475"
  location: "City Business Centre, 11a Lower Road, London SE16 2XB, United Kingdom"
---

# Trust Center

Security and privacy

# Trust Center

How Doccure protects patient data. HIPAA-ready and GDPR-ready. We sign a BAA.

[Request a BAA](https://doccure.io/book-a-demo/) [Request our security overview ](https://doccure.io/book-a-demo/)

- HIPAA-ready
- GDPR-ready
- We sign a BAA
- HL7 FHIR standards

HIPAA and GDPR have no official certificate, and we do not claim one.

  Built into the platform

## How we protect patient data

- ### Data isolation
  
    Each organisation's data is isolated by Postgres row-level security in the database itself, not only in the app. Your data belongs to you.
- ### Audit trail
  
    A hash-chained, tamper-evident audit log records who opened or changed a record. Patients can see who viewed their record.
- ### Signed records
  
    Prescriptions and lab results carry tamper-evident signatures. Doctors sign prescriptions with a PIN.
- ### Consent
  
    Consent records for care, telehealth, recording, marketing and data sharing, kept on the patient record.
- ### AI and patient data
  
    Patient details are redacted before data is sent to an AI provider. You choose the provider, or switch AI off. AI outputs are suggestions reviewed by a licensed clinician. Not a medical device.
- ### Payments
  
    Card data never touches Doccure servers. Payments are processed by PCI-compliant gateways, through your own account.
- ### Compliance records
  
    Registers for BAAs (with expiry alerts), breaches, data-subject requests and retention, so your team keeps its records in one place.
- ### Hosting
  
    US, Europe or Asia, on request. On-premise or private cloud for Enterprise. Azure servers in India for Doccure India.

  For your review

## Documents on request

### Business Associate Agreement

We sign a BAA with US covered entities and business associates before they handle patient data on Doccure.

[Request a BAA](https://doccure.io/book-a-demo/)

### Security overview and subprocessors

Our security overview and the list of subprocessors (cloud, AI, SMS, email, video and payments) are available on request.

[Request the overview](https://doccure.io/book-a-demo/)

  FAQ

## Security questions

 Is Doccure ready for HIPAA and GDPR?Doccure is HIPAA-ready and GDPR-ready, and we sign a BAA. HIPAA and GDPR have no official certificate, and compliance also depends on how your organisation uses the platform.

 How is our data kept apart from other organisations?Each organisation's data is isolated by Postgres row-level security in the database itself, not only in the application. Your data belongs to you.

 Where is our data hosted?In the US, Europe or Asia, on request. Enterprise deployments can run on-premise or in your private cloud. Doccure for clinics in India is hosted on Azure servers in India.

 Is patient data sent to AI providers?Patient details are redacted before any data is sent to an AI provider. You choose the provider (OpenAI, Azure OpenAI, Anthropic or self-hosted), and AI can be switched off. AI outputs are suggestions reviewed by a licensed clinician. Not a medical device.

 Who are your subprocessors?Our list of subprocessors (cloud, AI, SMS, email, video and payments) is available on request. Ask us for our security overview.

  ## Questions from your security team?

[Book a call](https://doccure.io/book-a-demo/)