Data security at GetClinic
GetClinic is built with UK clinical data security standards in mind. Here is an overview of the key protections in place.
Data storage
- Database: PostgreSQL hosted on Supabase (EU West region — Ireland)
- File storage: Vercel Blob (CDN with access control)
- Authentication: NextAuth v5 with secure session tokens
- Passwords: bcrypt hashed — plaintext passwords are never stored
Data isolation
Each clinic is a fully isolated tenant. Data from one clinic is never accessible to another clinic. All database queries are scoped to your clinicId.
Audit logging
GetClinic maintains a full audit log of security-relevant actions:
- Prescription signed (AES) — identity, timestamp, IP
- Prescription dispensed — pharmacy name, pharmacist GPhC, IP
- Patient record accessed or modified
Audit logs cannot be altered or deleted.
Advanced Electronic Signatures (AES)
All prescription authorisations use AES, which meets eIDAS Advanced Electronic Signature requirements. The AES payload includes the prescriber's verified identity, timestamp, and IP address, stored immutably at the time of signing.
Reporting a security concern
If you believe there has been a data breach or security incident, contact support@getclinic.io immediately.