Security and trust, Data residency
Data residency, and where wai keeps your clinic's records
wai hosts each clinic's records in its own country, under that country's rules, and we set this up with your clinic before go-live. A group with clinics in several countries keeps each clinic's records where that clinic operates.
Updated .
Where wai stands today
- Clinical records
- Hosted in the country the clinic operates in, under that country's rules.
- Set-up
- Agreed with your clinic before go-live.
- Transfers
- Where a provider operates outside the clinic's region, the UK International Data Transfer Agreement or the addendum to the EU Standard Contractual Clauses, with encryption in transit.
- Engineering access
- Through a separate credential, never a clinic's.
Why residency matters to a clinic
Where patient records sit decides which country's law governs them, and some health regulators and payers require records to stay in the country. Health systems often write residency into their contracts even where the law does not require it.
For a group across borders, the useful question for any vendor is per clinic, not per company. Where is each clinic's record, under which rules, and who can reach it from elsewhere.
What wai does
- 01
Hosts each clinic's records in its own country, under that country's rules.
- 02
Sets residency up with your clinic before go-live.
- 03
Names every subprocessor, with what it does and the agreement in place, and gives thirty days notice before anything changes.
- 04
Gives its own engineers a separate credential to reach production data, never a clinic's.
What stays with your organisation
- Telling us where each clinic operates and any contract terms on residency.
- Your retention periods for clinical records under your own rules.
The agreements we sign
As of 16 October 2026, wai acts as processor for UK and EU clinics under a written data-processing agreement, and signs a business associate agreement with US practices before go-live. We send the evidence for your intended use in writing, each item with a status and a date.
Questions
Where are records for a clinic in Dubai kept?
In the UAE, under the UAE's rules. The same principle applies in every country, each clinic's records where it operates.
Can a group with clinics in several countries use one account?
Yes. Each clinic's records are hosted in its own country, and the group sees its reports across them.
Do you list your subprocessors?
Yes. Every one is named, with what it does and the agreement in place, and we send the current list on request.
Further reading
Security and trust- Read nextUK GDPR
- Read nextHIPAA
- Read nextWhere patient data lives, and for how long
- Read nextDHA, Dubai Health Authority
- SecurityHIPAA, and how wai protects your practice's patient data
- SecurityUK GDPR, and how wai handles your clinic's patient data
- SecurityThe NHS DSPT, and how wai supports your assurance
- SecuritySOC 2 Type II, and the controls behind it
Bring your security questions to a demo.
A 15 minute video call on your own clinic, with your Data residency questions answered in writing afterwards, control by control. Prices for clinics, groups and hospitals are on the pricing page.