Atlacare is built for UK practices, so UK GDPR compliance is designed in rather than bolted on. Patient health data is special category data under Article 9, and Atlacare treats it accordingly. Here's what the platform does for you — and what stays your responsibility as the data controller.
What Atlacare provides
- Secure data. Patient data is encrypted in transit and at rest, access is controlled by team roles, and the database is backed up every night. See Where is my data stored? for detail.
- Consent tracking. Every patient record carries a treatment-consent answer and a separate marketing-consent flag. You can see the breakdown at any time under Settings → GDPR & consent.
- Marketing consent enforced automatically. Campaigns only ever send to patients who have given marketing consent — Atlacare blocks the rest, so you can't accidentally email someone who opted out.
- Audit logging. Significant actions — creating and erasing patients, exporting data, changing plans — are written to an audit log, so you have a record of who did what.
- Retention rules. Atlacare applies the UK record-retention periods for clinical and financial records and enforces them during erasure. See How do retention periods work?
- Data export. You can export one patient's record as a PDF for a Subject Access Request, and export all your clinic's data (or just the patient list) whenever you want. Every bulk export is logged. See exporting everything for one patient and exporting your data.
What stays your responsibility
You are the data controller for your patients; Atlacare is your data processor. That means you decide what you collect and why, you provide your patients with a privacy notice, and you register with the ICO where required. Atlacare gives you the tooling; the lawful basis and patient relationship are yours.
The one rule for patients
Patients never send health information to Atlacare. Anything clinical goes to their own clinic through the patient portal. Atlacare, the software vendor, only handles platform and account issues — which is what keeps patient health data out of our hands.
For specifics, see the other articles in this section, or use the Help button to ask us.