Security & data protection

Our approach

Clovaar is a UK product built for UK aesthetic clinics. Patient data is treated as special-category health data under the UK GDPR, and we design around that from the start: encryption, per-clinic isolation, access control and an audit trail. This page describes the measures in place today; it isn't legal advice, and your clinic remains the data controller for its own patients.

Where your data is hosted

• Hosted in the United Kingdom (London region) on DigitalOcean's managed platform.
• A managed PostgreSQL database with automated, encrypted backups and point-in-time recovery.
• Served over encrypted connections (HTTPS / TLS) only.

How data is protected

• Encryption in transit: all traffic is encrypted with TLS.
• Encryption at rest: sensitive patient identifiers are encrypted at the field level (AES-256) before they are stored, in addition to the database's own at-rest encryption.
• Per-clinic isolation: data is separated at the database level (row-level security), so one clinic cannot see another clinic's records.
• Access control: staff sign in to their own accounts, with role-based permissions controlling who can do what.
• Audit trail: changes to patient records are recorded, with who made the change and when.

Consent records

Digital consent is captured as a signed, timestamped record that can't be altered after the fact: who consented, to what, and when. Your consent history stays searchable and defensible.

Roles & responsibilities

• Your clinic is the data controller; Clovaar acts as a data processor handling data on your instructions.
• You stay responsible for managing your staff's access, training your team, and obtaining valid patient consent.
• Our data processing agreement sets this out formally. It applies to every clinic automatically, so there is nothing separate to sign.

AI features, and what leaves the UK

Some features draft a consultation note, summarise your own figures, or read a supplier document. They use a large language model run by Anthropic in the United States, which is the one place data can leave the UK. We would rather state that plainly than bury it.

• Dictated audio is transcribed in the UK, on our own servers. The recording is turned into text by software we run ourselves in the same London region as the rest of the platform. There is no transcription supplier, the audio never leaves the country, and it is never written to disk or logged. Only the text goes any further.
• Identifiers are stripped before anything is sent. Names, dates of birth and contact details are replaced with placeholders and re-inserted locally afterwards, so the real values never leave our systems.
• If that stripping cannot run, nothing is sent and the feature reports that it failed. It never falls back to sending the raw transcript.
• Nothing is used to train a model, ours or anyone else's.
• Every output is a draft for a clinician to check and approve. No clinical decision is automated.
• You can turn the AI features off, and then nothing is sent at all.

What we don't claim

We'd rather be straight than oversell. Clovaar is a UK GDPR-focused product: we do not currently claim US HIPAA compliance, SOC 2, or ISO 27001 certification, and we won't display badges we haven't earned. As we formalise further certifications, we'll say so here.

Reporting a concern

Found a security issue, or have a data-protection question? Email [email protected] and we'll respond promptly.