GDPR Compliance

Our Commitment to Data Protection

Velastria is run by Kirklee Comms Ltd. We take our obligations under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 seriously, and Velastria is built to help clinics meet their own obligations, including what the CQC, HIS and the GMC expect of clinical records.

This page explains how we apply the GDPR principles and how we protect the personal data and patient health information processed through our platform. It describes what is in place today.

1. GDPR Principles

We apply the seven GDPR principles as follows:

1.1 Lawfulness, Fairness, and Transparency

• We process data only on lawful bases (consent, contract, legal obligation, legitimate interests)
• We provide clear, plain-language privacy notices
• We publish to every clinic, inside Velastria, the list of every company that processes its data, what each one receives and the country each one is in (the Systems & Sub-processors Schedule)

1.2 Purpose Limitation

• Data is collected for specified, explicit, and legitimate purposes
• We do not process data for purposes incompatible with the original purpose
• The purposes for which we process a clinic's data are set out in our Data Processing Agreement with that clinic

1.3 Data Minimisation

• The record of who opened a patient's file stores a reference to the patient, not a second copy of their name or date of birth
• Photographs shared with another clinician by a secure link have their location and camera data removed first
• Test databases are built from an empty template and contain no patient data

1.4 Accuracy

• Clinics can update and correct their records at any time
• Changes to key records, including patients, appointments, quotes, consents and operation notes, are recorded with the values before and after the change

1.5 Storage Limitation

• For patient records, your clinic decides how long records are kept. We delete a clinic's records only on its written instruction
• We never delete a clinical record automatically. Without an instruction, a departing clinic's records are kept in a sealed, encrypted archive
• Once records are deleted, they are removed from our backups within 35 days
• For the data we control ourselves, see our Data Retention Policy

1.6 Integrity and Confidentiality (Security)

• Appropriate technical and organisational measures protect data (section 4)
• Encryption in transit (TLS) and at rest
• Automated tests and a dependency vulnerability scan run on every change to the software
• Roles, permissions, two-factor authentication and a record of who opened each patient's file

1.7 Accountability

• We publish the documents a clinic needs for its own Data Protection Impact Assessment: the Systems & Sub-processors Schedule, a Transfer Risk Assessment and a Security Statement
• Personnel with data access are bound by data-protection and confidentiality obligations
• Our customer documents are versioned and dated, and earlier versions remain available

2. Data Controller vs Data Processor

2.1 When We Are the Data Controller

Velastria acts as the data controller for:

• Marketing and sales data (contact forms, enquiries)
• Account holder information (clinic details, billing information)
• Website usage data and analytics

As controller, we determine the purposes and means of processing and are responsible for GDPR compliance.

2.2 When We Are the Data Processor

Velastria acts as a data processor for:

• Patient health records entered by clinics
• Patient communications managed through the platform
• Clinical data, photos, and documentation

As processor, you (the clinic) are the data controller and determine the purposes and means of processing patient data. We process data only on your documented instructions.

2.3 Data Processing Agreement (DPA)

All customers receive a Data Processing Agreement that details:

• Subject matter and duration of processing
• Nature and purpose of processing
• Types of personal data and categories of data subjects
• Obligations and rights of the controller (you)
• Security measures, and our promise to tell you of a personal data breach within 24 hours of becoming aware of it
• Sub-processors, and how you are told about changes and can object to them
• Data export, return, retention and deletion

3. Data Subject Rights

For patient data, your clinic is the controller and answers patients' requests. Velastria gives the clinic the tools to do so, and does not answer a patient's request itself except on the clinic's instruction. For the data we control ourselves, contact us as set out in section 11.

3.1 Right of Access (Article 15)

• A clinic owner or administrator can export a patient's complete record for a subject access request: a PDF of the whole record, with the patient's documents, photographs, recordings and the history of who opened their record
• Every export and every download of it is recorded
• Under UK GDPR the response is due within one month, and the first copy is free

3.2 Right to Rectification (Article 16)

• Individuals can request correction of inaccurate data
• Clinics can update patient records directly through the platform

3.3 Right to Erasure / "Right to be Forgotten" (Article 17)

• Individuals can request deletion of their data
• For patient records, the clinic decides, taking into account the rules on keeping medical records, and we delete on its written instruction

3.4 Right to Restrict Processing (Article 18)

• Individuals can request limitation of processing
• For patient records, we act on the clinic's instruction

3.5 Right to Data Portability (Article 20)

• Individuals can receive their data in a machine-readable format
• A patient's export can include a machine-readable (JSON) file alongside the PDF when the request is a portability request
• A clinic can download its whole dataset in a machine-readable form, and it can be passed to another system

3.6 Right to Object (Article 21)

• Individuals can object to processing based on legitimate interests
• Individuals can opt out of marketing communications at any time
• We cease processing unless compelling legitimate grounds exist

3.7 Rights Related to Automated Decision-Making (Article 22)

• We do not make solely automated decisions with legal or significant effects
• AI features produce drafts and suggestions; clinical decisions remain with clinicians. An AI-drafted clinical note is checked by the clinician and saved as their own note, and an AI-drafted letter must be approved before it can be printed or sent

4. Technical and Organisational Measures

4.1 Encryption

• In Transit: Connections from your browser are encrypted with TLS 1.2 or TLS 1.3, and stay encrypted from our AWS load balancer to the application server
• At Rest: The database and its backups are encrypted with AWS Key Management Service; file storage is encrypted at rest by AWS
• Backups: The database can be restored to any point in the last 30 days, and daily snapshots are taken in addition, all in AWS London. Every night a further copy of the database and of file storage is made to a storage device owned by Kirklee Comms Ltd in the United Kingdom

4.2 Access Controls

• Roles and permissions: each person is given a role, such as surgeon, nurse, receptionist or finance, and each role carries specific permissions to view, create, edit, delete or export each kind of record. Clinics can create and adjust their own roles
• Own patients only: the clinic owner can choose, person by person, that someone sees only the patients of their own care team
• Location access: each person is given access to the locations they work at, which controls whose diaries they see
• Emergency access (break-glass): a clinician who needs a record they cannot normally see must give a reason and a written justification. Access expires after 24 hours, every use is logged, and the clinic's owners and practice managers are emailed
• A record of who opened what: every opening of a patient's record, and every download of their documents and photographs, is recorded, and the clinic can see who opened a patient's record and when
• Separation between clinics: each clinic's data is held in its own database schema, and clinic staff can sign in to a clinic's system only if they have been given access to that clinic
• Signing someone out: an administrator can end every session a person has open at the clinic

4.3 Authentication and Password Security

• Passwords must be at least 12 characters, and are checked against lists of common passwords, against the person's own details, and against being numbers only
• Passwords are stored hashed with PBKDF2-SHA256 and a unique salt, never in readable form
• Two-factor authentication, by authenticator app or emailed code, is available, and each clinic's owner can require it for all staff
• A person is signed out after 60 minutes without activity, with a two-minute warning first
• After 5 failed attempts, sign-in for that username from that internet address is locked for 1 hour

4.4 Network Security

• Traffic reaches Velastria through an AWS load balancer protected by AWS WAF (web application firewall) and AWS Shield Standard, which provide traffic filtering and DDoS protection
• Cloudflare provides DNS only: it answers the look-up for Velastria's web addresses, and no traffic to the application passes through it
• The database is not reachable from the internet, and administrative access to our servers is possible only over our own private network
• A signed-in account that behaves like an automated copying tool is signed out and the clinic's owners are emailed, and alarms alert us to server and database problems
• Operating-system security updates are installed automatically

4.5 Application Security

• Built on the Django framework, using its protections against SQL injection, cross-site scripting and cross-site request forgery
• Automated tests run on every change, and our release process checks that the tests have passed for that exact version before it is deployed
• A dependency vulnerability scan runs on every change, and dependency updates are proposed automatically every week

4.6 Audit Logging

• Sign-ins, failed sign-ins, record openings, downloads, permission changes and changes to key records are recorded, with who, when, and from which internet address
• Audit records are kept for as long as the clinic's account exists, and nothing in the application edits or deletes them

5. Data Breach Procedures

5.1 Detection and Containment

• Alarms on our servers and database, alerts on unusual account behaviour, and reports from clinics and staff
• When an incident is found, our first step is to stop it and limit its effect

5.2 Notification

In the event of a personal data breach:

• Patient data (you are the controller): we notify your clinic without undue delay, and in any event within 24 hours of becoming aware, with the information you need for your own report to the ICO, which is due within 72 hours of your becoming aware (Article 33)
• Data we control: we report to the ICO within 72 hours of becoming aware where the law requires it (Article 33), and tell the people affected where there is a high risk to them (Article 34)

5.3 Documentation

• We give the affected clinic the facts of the breach, its likely effects and the action taken, so that it can keep its own record of the breach

6. International Data Transfers

6.1 Data Location

• Primary data storage: AWS UK (London / eu-west-2), encrypted at rest
• Backups: in AWS London, with a nightly copy on a storage device owned by Kirklee Comms Ltd in the United Kingdom
• Some AI features are processed outside the UK, in the United States, and some AI models run on AWS in the UK and the European Union. The Systems & Sub-processors Schedule lists each one

6.2 Transfer Safeguards

When data transfers outside the UK are necessary, we use:

• The UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, which forms part of our Data Processing Agreement
• UK adequacy regulations, for transfers to the European Economic Area
• A Transfer Risk Assessment for the United States, published to every clinic

6.3 Sub-Processors

The full list of our sub-processors, what each one receives and the country each one is in, is the Systems & Sub-processors Schedule. Every clinic can read it inside Velastria, and it forms part of our Data Processing Agreement. The main ones are:

• AWS: Cloud hosting in London; AI models through AWS Bedrock in the UK and the European Union
• Anthropic: AI features (United States). Anthropic processes data as our processor under its Data Processing Addendum, which includes the UK International Data Transfer Addendum
• OpenAI: AI call answering, live transcription, and stand-by transcription (United States)
• Twilio: Telephone calls and text messages (United States)
• Stripe: Payment processing

Cloudflare provides DNS only and receives no clinic or patient records.

7. Healthcare-Specific Compliance

7.1 CQC Compliance (England)

• Supports CQC Fundamental Standards
• Audit trails for regulatory inspections
• Document management for policies and procedures
• Staff training records and CPD tracking

7.2 HIS Compliance (Scotland)

• Aligns with Healthcare Improvement Scotland standards
• Quality improvement metrics and reporting
• Patient safety incident tracking

7.3 GMC Good Medical Practice

• Supports GMC record-keeping requirements
• Consent management and documentation
• Professional revalidation support

7.4 Caldicott Principles

• Justify the purpose of using confidential information
• Use confidential information only when necessary
• Use the minimum necessary confidential information
• Access on a strict need-to-know basis
• Everyone with access understands their responsibilities
• Comply with the law
• The duty to share information for individual care is as important as the duty to protect confidentiality

8. Personnel and Confidentiality

Velastria is founder-operated. Taimur Shoaib, who builds and runs it, completes mandatory clinical data-safety training. Everyone with access to clinic data is bound by confidentiality obligations, and the same requirements will apply to every future hire before access is granted.

9. Data Protection Impact Assessments (DPIAs)

As controller, your clinic carries out the Data Protection Impact Assessment for its own use of Velastria. We support it with the information a DPIA needs, including:

• The Systems & Sub-processors Schedule: who processes your data, what each one receives and where
• The Transfer Risk Assessment for the United States
• The Security Statement, describing the security measures in place
• Suggested wording for your own privacy notice, including how AI and processing outside the UK are involved

10. Accountability and Governance

10.1 Data Protection Lead

• Name: Taimur Shoaib
• Email: t.shoaib@doctors.org.uk
• Responsibilities: Oversee data protection, decide on data protection matters, liaise with the ICO

10.2 Registration

• Kirklee Comms Ltd, which trades as Velastria, is registered with the Information Commissioner's Office (ICO)

11. Your Rights and Contact

11.1 Exercising Your Rights

If you are a patient of a clinic that uses Velastria, please contact that clinic, which holds your records and answers your requests. To exercise your rights over data we control ourselves, contact us at t.shoaib@doctors.org.uk. We will respond within one month.

11.2 Complaints

If you believe we have not handled your data appropriately, you can:

1. Contact our Data Protection Lead at t.shoaib@doctors.org.uk
2. Lodge a complaint with the UK Information Commissioner's Office (ICO)

12. Updates to This Page

We update this GDPR Compliance page when our processing changes. Last updated: 15 October 2026.

13. Additional Resources

• Trust & Security - Where your data lives and how it's protected
• Privacy Policy - How we collect and use personal data
• Terms of Service - Legal agreement for using Velastria
• Data Processing Agreement (DPA) - Available upon subscription
• Systems & Sub-processors Schedule, Transfer Risk Assessment and Security Statement - Available to every clinic inside Velastria, and on request