Security and trust, UK GDPR
UK GDPR, and how wai handles your clinic's patient data
Under UK GDPR your clinic is the controller of its patient records and wai is the processor, acting only on your instructions under a written data-processing agreement. Records are encrypted, access is logged against named accounts, and each clinic's records are hosted in its own country.
Updated .
Where wai stands today
- Role for clinic records
- Processor, under a written data-processing agreement with your clinic.
- Role for its own website and accounts
- Controller, under the privacy policy.
- International transfers
- Where a provider operates outside the clinic's region, the UK International Data Transfer Agreement or the addendum to the EU Standard Contractual Clauses, with encryption in transit.
- Encryption
- AES-256 at rest and TLS 1.3 in transit.
What UK GDPR asks of a clinic and its software
Health data is special category data under UK GDPR, which carries extra conditions for processing it.1 The clinic decides why and how patient data is processed, which makes it the controller, and a supplier processing it on the clinic's behalf is a processor.2
A controller must have a written contract with each processor, setting out the processing, the security measures, the use of subprocessors and help with patients' rights.3 Large-scale processing of health data, and new technology such as AI combined with another risk factor, usually needs a data protection impact assessment first.4
What wai does
- 01
Acts as processor for your clinic's records, on your instructions, under a written data-processing agreement.
- 02
Names every subprocessor, with what it does and the agreement in place, and gives thirty days notice before anything changes.
- 03
Encrypts data with AES-256 at rest and TLS 1.3 in transit, and enforces role-based access in the database.
- 04
Exports a patient's record on request, so your clinic can answer a subject access request on time.
- 05
Supplies the facts your DPIA needs, in writing, on hosting, access, retention and subprocessors.
What stays with your organisation
- Your lawful basis, your privacy notice to patients and your retention periods for clinical records.
- Your DPIA, as controller, and your records of processing.
- Answering patients' rights requests, with wai's help on the record itself.
The agreements we sign
As of 16 October 2026, wai acts as processor for UK and EU clinics under a written data-processing agreement, and signs a business associate agreement with US practices before go-live. We send the evidence for your intended use in writing, each item with a status and a date.
Questions
Who is the controller, the clinic or wai?
Your clinic, for its patient records. wai is the processor and acts only on your instructions. For its own website, sales enquiries and accounts, wai is the controller.
Will you help with our DPIA?
Yes. We answer every question on hosting, access, retention and subprocessors in writing, for the processing you intend.
Can we see the subprocessor list?
Yes. Every subprocessor is named, with what it does and the agreement in place, and we send the current list on request.
Further reading
Security and trust- Read nextWhere your data is stored
- Read nextThe NHS Data Security and Protection Toolkit
- Read nextUK GDPR and ambient AI scribes
- Read nextCQC compliance hub
- SecurityHIPAA, and how wai protects your practice's patient data
- SecurityThe NHS DSPT, and how wai supports your assurance
- SecurityData residency, and where wai keeps your clinic's records
- SecuritySOC 2 Type II, and the controls behind it
Bring your security questions to a demo.
A 15 minute video call on your own clinic, with your UK GDPR questions answered in writing afterwards, control by control. Prices for clinics, groups and hospitals are on the pricing page.