Security & GDPR

You are the data controller for your patients' data; MyNewClinic is your data processor. We process patient data only to provide the service to you, and we give you the tools to meet your data-protection obligations.

Data at rest: AES-256 encryption via Supabase, hosted in the UK (London region). Supabase is SOC 2 Type II certified.

Data in transit: TLS 1.2+ enforced on every connection, browser to API, API to database, and API to sub-processors.

Access controls: role-based staff permissions, strict tenant isolation between clinics, record-access logging, and optional two-factor authentication.

Data location: patient data is stored in the UK (Supabase, London region). It is processed on our application server in the EU (Hetzner, Germany), which is covered by UK adequacy. Optional features you switch on yourself may send limited data to the US under the UK International Data Transfer Addendum: AI features to Anthropic and OpenAI, SMS to Telnyx, and card payments to Stripe.

The AI Assistant is off by default. No patient data is sent to Anthropic until your clinic explicitly enables AI features in Settings, after your data-processing agreement is in place. Per Anthropic's commercial API data-processing agreement, API inputs and outputs are not used to train models and are retained for up to 30 days for trust-and-safety purposes only. This describes our provider's contractual terms, not something MyNewClinic separately enforces in code, confirm it against Anthropic's current DPA. Card details are never stored by MyNewClinic, they are held by Stripe.

Our AI, safety & trust page sets out, feature by feature, exactly what each AI feature does, what data it sees, and where a clinician stays in the loop.

Built into MyNewClinic so you can answer patient requests directly:

• Full clinic export, the owner downloads every record the clinic holds as one ZIP (CSV, JSON and documents), any time.
• Subject-access export, one click downloads everything held on a patient.
• Right to erasure, anonymises a patient's identity while keeping de-identified records for your retention period.
• Access log, see who viewed or changed each patient's record.
• Two-factor authentication for staff logins.

The third-party services that process data on our behalf:

The "Trains on data?" and retention positions reflect each provider's own contractual terms, which we surface here but do not separately enforce in code.

Every night an encrypted copy of the database and of every patient document is written to a separate data centre, held independently of the live systems. Restores are rehearsed against the live data, most recently by rebuilding a full copy of the database and checking record counts against production. Any clinic owner can download the whole clinic as one ZIP from Settings at any time, so your records never depend on us to leave.

If the service were ever discontinued, every clinic would have at least 90 days' notice, with the full export available throughout, and its data deleted only after that period.

MyNewClinic is run by a practising clinician, so you reach the person who built it, by email at hello@mynewclinic.com or by phone. The platform is monitored around the clock, with a live status page at mynewclinic.com/status. We aim to answer every request within the working day. A security problem, or anything that stops access to the diary or clinical records, is treated as urgent and worked on as soon as it is known, whatever the day.

A signed Data Processing Agreement is available to clinics on request, email hello@mynewclinic.com.

Clinical records are kept for the period required by healthcare record-keeping rules (typically 8 years for adults), then securely deleted or anonymised.

If you believe you've found a vulnerability, please email hello@mynewclinic.com and we'll respond promptly.

MyNewClinic is operated by OsteoRise Limited, a company registered in England & Wales (company no. 15200521), registered with the UK Information Commissioner's Office (ICO) under reference ZB762812.