AtlacareAtlacare is built for UK and EU practices, so GDPR compliance is designed in rather than bolted on. Patient health data is special category data under Article 9, and Atlacare treats it accordingly. Here's what the platform does for you — and what stays your responsibility as the data controller.
What Atlacare provides
- EU data residency. All data is stored in EU regions. See Where is my data stored? for detail.
- Consent tracking. Every patient record carries a treatment-consent answer and a separate marketing-consent flag. You can see the breakdown at any time under Settings → GDPR & Consent.
- Marketing consent enforced automatically. Campaigns only ever send to patients who have given marketing consent — Atlacare blocks the rest, so you can't accidentally email someone who opted out.
- Audit logging. Significant actions — creating and erasing patients, exporting data, changing plans — are written to an audit log, so you have a record of who did what.
- Country-aware retention. Atlacare knows the clinical and financial record-retention rules for your country and enforces them during erasure. See How do retention periods work?
- Data export. You can export a patient's full record, and every bulk export is logged. See How do I handle a right-to-erasure request? and your reports.
What stays your responsibility
You are the data controller for your patients; Atlacare is your data processor. That means you decide what you collect and why, you provide your patients with a privacy notice, and — in the UK — you register with the ICO where required. Atlacare gives you the tooling; the lawful basis and patient relationship are yours.
The one rule for patients
Patients never send health information to Atlacare. Anything clinical goes to their own clinic through the patient portal. Atlacare, the software vendor, only handles platform and account issues — which is what keeps patient health data out of our hands.
For specifics, see the other articles in this section, or use the Help button to ask us.