Security and patient data

Your clinic is the controller of its patients’ data. Vahue Ltd is its processor: we use the data only to run Sovica for you, under a data processing agreement, and we list every subprocessor we use. For how we handle data on this website, see the privacy policy.

UK clinics’ data is stored and processed in the AWS London region (eu-west-2) and does not leave the UK for hosting.

Every record belongs to one clinic. The database itself enforces this with row-level security, so a query for one clinic cannot return another clinic’s rows, even if application code makes a mistake.

Data is encrypted in transit with TLS and at rest with keys managed in AWS KMS. Files and photos are encrypted in storage.

• Role permissions: each role sees only what it needs; clinical notes, finances and settings are separate permissions.
• Staff accounts support two-factor authentication and passkeys.
• Sessions are tied to one person, and sensitive actions ask you to confirm.

Every change to business data is written to an append-only audit log: who changed what, and when. It cannot be edited or deleted, so you can show it to an inspector or an insurer.

Export patients, appointments, notes, forms and financial data at any time. If you leave, we delete your data on request.

Found something? Email security@sovica.ai with “Security” in the subject. We reply within two working days.