Security & data protection

How Clovaar protects patient data. We describe what we actually do, and we're clear about what we don't.

Our approach

Clovaar is a UK product built for UK aesthetic clinics. Patient data is treated as special-category health data under the UK GDPR, and we design around that from the start: encryption, per-clinic isolation, access control and an audit trail. This page describes the measures in place today; it isn't legal advice, and your clinic remains the data controller for its own patients.

Where your data is hosted

  • Hosted in the United Kingdom (London region) on DigitalOcean's managed platform.
  • A managed PostgreSQL database with automated, encrypted backups and point-in-time recovery.
  • Served over encrypted connections (HTTPS / TLS) only.

How data is protected

  • Encryption in transit: all traffic is encrypted with TLS.
  • Encryption at rest: sensitive patient identifiers are encrypted at the field level (AES-256) before they are stored, in addition to the database's own at-rest encryption.
  • Per-clinic isolation: data is separated at the database level (row-level security), so one clinic cannot see another clinic's records.
  • Access control: staff sign in to their own accounts, with role-based permissions controlling who can do what.
  • Audit trail: changes to patient records are recorded, with who made the change and when.

Consent records

Digital consent is captured as a signed, timestamped record that can't be altered after the fact: who consented, to what, and when. Your consent history stays searchable and defensible.

Roles & responsibilities

  • Your clinic is the data controller; Clovaar acts as a data processor handling data on your instructions.
  • You stay responsible for managing your staff's access, training your team, and obtaining valid patient consent.
  • A data processing agreement (DPA) is available to set this out formally.

What we don't claim

We'd rather be straight than oversell. Clovaar is a UK GDPR-focused product: we do not currently claim US HIPAA compliance, SOC 2, or ISO 27001 certification, and we won't display badges we haven't earned. As we formalise further certifications, we'll say so here.

Reporting a concern

Found a security issue, or have a data-protection question? Email [email protected] and we'll respond promptly.