Where your patient data actually lives

"UK servers" is one of those phrases that sounds like an answer and isn't. Every practice platform says something like it. Almost none will tell you which company holds what, in which country, or where the exceptions are, and there are always exceptions.

Here is ours, in full, including the parts that are not in the UK.

The clinical record: United Kingdom

Your patients, their notes, their appointment history, their exercise programmes, their uploaded documents and your account itself all live in a database hosted by Supabase in the eu-west-2 region (London). Uploaded files sit in the same region.

The application code that reads and writes that data runs on Vercel, pinned to the lhr1 region (London).

So the round trip for a normal working day (you open a patient, you write a note, you lock it) happens entirely within the UK.

Voicemail: United Kingdom

Call handling is the part most likely to be somewhere surprising, because AI transcription providers are overwhelmingly American.

Ours is not. Voicemail audio is transcribed by Azure AI Speech in the UK South region, and the short summary you read in the calls inbox is produced by Azure OpenAI, also UK South, using a Regional deployment rather than a Global one. That distinction is the whole ballgame: a Global deployment can route your inference to whichever data centre has capacity, anywhere in the world. Regional does not. We pay for the less convenient option on purpose.

It is worth being precise about what that AI touches: voicemail only. It never sees clinical notes, appointments, exercise plans, billing data or patient messages. And none of it is used to train models.

The parts that are not in the UK

This is the section other companies leave out.

Service	What it handles	Where
Resend	Sending email: appointment confirmations, reminders, magic links, password resets	EU / US
Telnyx	Your practice phone number and call recording	UK number, EU/US carriage
Meta	WhatsApp, Instagram and Messenger messages, if you connect them	Meta's infrastructure, configured for UK/EU where Meta offers it
Stripe	Subscription billing and patient card payments	UK / EU

Each of these is covered by a UK transfer safeguard, typically the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. That is the legal mechanism the UK GDPR requires for moving personal data to a country without an adequacy decision, and it is why our Data Processing Agreement has a section about it rather than pretending the question does not arise.

There is also the exercise content provider, whose media your patients' browsers fetch directly. Worth knowing precisely what leaves for that one: exercise ID numbers and our API key. No patient data. Ever. They do not know who your patients are, because they are never told.

Why not claim "your data never leaves the UK"?

Because it would be false, and we used to say it.

That sentence sat on our security page until July 2026. It was written when the product was smaller and it stopped being true as we added email, telephony and messaging, each of which necessarily involves a company that operates internationally. We found it during an audit of our own claims against our own legal documents, and we changed it rather than hoping nobody read both.

I mention this partly because it is the honest thing and partly because it is a useful test to apply to anyone else. If a supplier tells you your data never leaves the UK, ask them who sends their email. If the answer is a mainstream provider (and it almost always is), then either the claim is wrong or they have not thought about it.

How to check any of this yourself

You do not have to take my word for it, and you should not.

Our sub-processor list is published in full in the Privacy Notice, with what each company does, what data they see and where they operate. Not on request. Not under NDA. On the website.

We commit to 30 days' written notice before adding or changing any sub-processor, which is in the Data Processing Agreement. That is your window to object rather than discover.

The regions are named specifically (eu-west-2, lhr1, UK South) rather than described as "the UK". Specific names are checkable; "UK-based infrastructure" is not.

What this means when a patient asks

Occasionally a patient asks where their information is kept, and increasingly an insurer or an employer asks a version of it during onboarding. The useful answer is short:

Your clinical record is held in London by my practice management provider. If you message the practice on WhatsApp, that message goes through Meta like any other WhatsApp message. Everything else is covered by the provider's published sub-processor list, which I can send you.

That is true, it is specific, and it does not require you to defend a claim somebody else made in a marketing headline.

The bit we cannot prove to you

Two claims in this article are things we are told rather than things we can demonstrate: encryption in transit and at rest is a property of the platforms we build on, and backup practice likewise. We state them because our contracts with those providers state them, but I would rather flag that distinction than let it sit inside a list of things we have verified ourselves.

Everything else above (the regions, the sub-processors, what the AI touches, what leaves for exercise content) is a decision in our own configuration and is checkable in our own documents.