Data Processing & Security (UK)

For your patients’ personal data your practice is the controller and Grovique is the processor under Article 28 of UK GDPR. We process it only to provide the service and only on your documented instructions, and we never use it for our own marketing or sell it.

Practice and patient data for UK practices — leads, messages, review requests and your site’s structured content — is stored in a database in London, UK. The application servers that read and write it run in the UK or the EU (Frankfurt), which the UK recognises as adequate. UK data is kept separate from our Australian service and is never stored in Australia. Public website files may be served through a global CDN for speed, but the source data stays in the UK.

• Encryption in transit (TLS) and at rest.
• Row-level access controls, so one practice can never see another’s data.
• Least-privilege access for our team, with no standing access to your live data beyond what support requires.
• Backups and monitoring, with a documented process for restoring service.

The AI chatbot answers operational questions (opening hours, parking, NHS or private, how to book) and captures enquiries. It is never sent clinical records and never gives clinical advice.

• Supabase — database, London (UK).
• Render — application servers, Frankfurt (EU).
• Vercel and Cloudflare — website hosting, CDN and DNS (global edge; public site files only).
• An SMS provider with UK numbers — named in your data processing agreement before SMS is switched on.
• Amazon SES — email delivery, London (UK).
• Sentry — error monitoring, with patient details scrubbed.
• OpenAI / Google (Gemini) — chatbot answers to operational questions; never clinical records.
• Infinity — payment collection for your subscription (your billing details only, no patient data).

Each is bound to protect your data and use it only for its part of the service. The confirmed list is in the data processing agreement we sign with you before any patient data is processed, and we tell you before adding one.

If a personal data breach affects your practice’s data, we tell you without undue delay, with what we know, so you can meet your 72-hour duty to report to the ICO where it applies.

Every UK practice using the portal gets a signed data processing agreement covering Article 28. Email hello@grovique.com for a copy.