Where patient data is stored
Patient records, appointment data and clinic configuration live in a Neon Postgres database hosted in AWS' eu-west-2 region (London). Each clinic is a logical tenant in a shared schema, with every query in the application scoped by tenant ID.
Encryption at rest is handled by Neon's underlying AWS storage. Encryption in transit is TLS for every connection, both between application and database and between browser and application. Database backups are managed by Neon under their standard policy and remain in the same region.
Tenant isolation is enforced at the application layer today, with every database query scoped by tenant ID. Database-level row-level security policies are on the roadmap as defence-in-depth; they are not active yet.
Where compute runs
Application code runs on Vercel. Production functions execute in lhr1 (Vercel's London region), co-located with the database. Static assets are served from Vercel's global edge, which includes points of presence worldwide, but the request handlers and API endpoints that process patient data run in the UK.
The practical implication: when a patient sends a message through the chat widget, the request is handled by a London function, which reads clinic configuration from the London database and writes back to it. Compute and data both stay in the UK. The one exception is the AI reply: the message text is sent to Anthropic's API on US infrastructure to generate the response, covered by the safeguards below. The data at rest sits in the UK.
Application compute now runs in the UK (London), alongside the database. The remaining transfer to US infrastructure is the AI inference call to Anthropic, covered by the Standard Contractual Clauses and the UK International Data Transfer Agreement that govern those data processing terms.
Voice and SMS
A clinic can take patient calls and text messages through MediConcierge on a UK phone number. Twilio provides the number and carries the call or message. Live calls then pass to a separate voice processor, which receives the audio, produces the transcript and speaks the reply. SMS stays on the Twilio messaging path.
Every call opens with a spoken consent step: the caller is told they are speaking to an automated assistant and can ask for a person at any time. On SMS, the first reply states that it is AI and how to opt out. Anything clinical or any emergency is directed to a human or to 999. The assistant never gives clinical advice.
The voice processor receives caller audio and conversation text outside MediConcierge's UK application boundary. Its current account can retain call audio and transcripts. Zero-retention mode and EU data residency are not enabled on that account today. MediConcierge stores the text transcript and AI interaction log in its London database, then purges them on the clinic's agreed schedule. We disclose the processor's identity and terms in the clinic's contractual sub-processor schedule before any patient line goes live.
Sub-processors
The third parties that may process patient data on our behalf, today:
Vercel Inc.
Hosting and request handling. Functions execute in lhr1 (London), so patient data is processed in the UK. Static assets at the global edge. Vercel is US-incorporated; its SCCs and UK IDTA terms apply.
Neon Inc.
Postgres database hosting on AWS eu-west-2 (London). Patient and clinic data at rest sits here.
Anthropic PBC
AI inference for the patient concierge. Standard API infrastructure runs in the US. MediConcierge stores each prompt and response in its UK audit log. The provider deletes API inputs and outputs from its systems within 30 days under its standard policy, subject to its stated exceptions. Transfers are covered by SCCs and the UK IDTA.
Twilio Inc.
UK phone numbers, call routing and SMS delivery. Twilio carries live calls to the voice processor. Call and message content is processed to deliver the service. A number can use Twilio's US or EU (Ireland) processing region; transfers are covered by SCCs and the UK IDTA.
Voice-processing provider
Speech recognition, turn-taking and voice generation for live calls. The service receives caller audio and conversation text. The current account uses US storage and can retain conversation data. Zero-retention mode is not enabled. We give each clinic the provider's identity and terms in its contractual sub-processor schedule.
Stripe Payments Europe Ltd. and Stripe, Inc.
Subscription billing for the clinic account. Card data and payment details are submitted directly to Stripe and never stored in MediConcierge. Stripe operates dual EU and US infrastructure under SCCs.
SMTP provider (configured by your clinic)
Outbound email for patient confirmations and clinic notifications uses the SMTP credentials your clinic provides during onboarding. The provider, region and processing terms are governed by the contract you have with that provider directly.
We will give clinics 30 days' notice before adding or replacing a sub-processor.
What we collect
Patient enquiry messages submitted through the chat widget. Contact details a patient provides during a booking conversation (name, email, phone). Appointment metadata (clinician, time, consultation type, notes the patient or clinic adds). Clinic configuration (services, opening hours, doctor schedules, team accounts).
What we do not collect
Clinical notes. Prescription data. Medical history beyond what a patient volunteers in an enquiry. Diagnoses. Imaging or laboratory results. The AI concierge is explicitly constrained against asking for or recording any of these; if a patient volunteers something clinical, the concierge logs it as enquiry text and routes the conversation to the clinic, but the system is not built to be a clinical record and should not be used as one.
We do not sell patient data. We do not share patient data with third parties for marketing purposes. We do not use patient data to train AI models.
Retention
Retention is configured per clinic. We work to a per-clinic agreement at onboarding to set retention periods that match your clinical and operational needs. Where you specify a shorter or longer period than the platform default, your configuration applies.
Backups follow Neon's standard backup policy and roll out of retention according to that schedule.
Patient rights
Patients have rights under UK GDPR to access their data, correct inaccurate data, request erasure, restrict processing and object to certain forms of processing.
The clinic is the data controller for its patients. Patients should direct requests to exercise these rights to the clinic in the first instance. The clinic uses MediConcierge admin tooling to action access, rectification and erasure requests against patient records held in the system. Clinics can request bulk export or deletion via support; first-class self-serve tooling for these is on the roadmap.
Logging
Application logs are retained for operational purposes (debugging, incident response, fraud and abuse detection). Logs may include anonymised request metadata and error traces. They do not contain patient enquiry message text by default.
A formal mutation audit log (every clinic-side change recorded with actor, timestamp and old/new values) is on the roadmap and not yet implemented as a first-class feature. Clinics with a regulatory need for one before it ships should flag this in onboarding so we can document compensating controls in your data processing agreement.
Incident response
In the event of a personal data breach, we will notify affected clinics without undue delay and in any case within 72 hours of becoming aware of the breach, in line with UK GDPR Article 33. The clinic, as data controller, is responsible for any onward notification to the ICO and to affected data subjects.
Notification will include the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken or proposed in response.
Cookies and analytics
The marketing site (mediconcierge.ai) uses minimal first-party cookies for session and consent state. Analytics is configured per environment; where enabled, it is Google Analytics with IP anonymisation. The clinic's embedded chat widget on a clinic website does not set tracking cookies on the patient's browser.
Talking to us
For data protection questions, sub-processor disclosures, the data processing agreement or anything else on this page that needs more detail for your specific clinic context: info@mediconcierge.ai. If your enquiry is regulatory or under time pressure, mention it in the subject line and we will reply within one working day.
