Read only access to your PMS. No patient names or contact details stored. A GDPR Data Processing Agreement in place before any data flows. Nothing fancy. Just the basics, done properly.
We never write back to your practice management system. Not a note, not an appointment, not a status. If something goes wrong here, your PMS is unchanged.
We store your PMS's patient reference numbers and age bands, never names, email addresses, phone numbers or dates of birth. When you open a recall list, names and contact details are fetched from your PMS for that screen and never written to our database. Marketing enquiry identifiers are hashed with a salt before they are stored.
Application and database hosted by Railway in the United States under the UK Addendum to the EU Standard Contractual Clauses. HMDG Limited is registered with the ICO (ZB365505). The Data Processing Agreement is accepted before any data flows.
A practice management system is full of sensitive material. We only need a small part of it to give you a useful dashboard.
Just enough to compute the metrics. Nothing for HMDG's own marketing, nothing sent to your patients, nothing shared outside your dashboard and the suppliers listed in the DPA.
There is a hard line between an operational metrics product and a clinical tool. We are on the operational side.
PostgreSQL database and application servers hosted by Railway in its US East region. Volumes and backups encrypted at rest by the provider. TLS everywhere in transit. API keys and tokens encrypted again at the application layer.
Magic link login. No passwords stored. A signed, HttpOnly session cookie that expires after 7 days.
Clinic owners invite and remove their own team members from Settings. HMDG account managers and engineers can open a client's dashboard to support them, and every staff visit is recorded.
No clinic data is ingested until the DPA is in place. HMDG is the data processor. You remain the controller.
Sign-ins and HMDG staff visits to your dashboard are recorded with the user and timestamp and kept for at least 12 months. Application and database logs are kept by the hosting provider.
Daily, weekly and monthly backups taken by the hosting provider and kept for 6, 27 and 89 days. Backups hold the same data as the database, so they carry no patient names or contact details from your PMS, but they do include any free text your team typed into the Advisor.
PMS API keys and OAuth tokens are encrypted at rest with AES-256-GCM; the encryption key lives in the hosting provider's secret store, never in source. Rotated on departures or incidents.
Dependency vulnerability alerts and secret scanning run on every change. Our hosting, AI and email providers each hold SOC 2 Type II reports.
Every change reviewed and tested before deploy. Production releases gated on CI, including security checks.
Production errors alert the engineering team directly. Affected clinic owners are told within 24 hours of HMDG becoming aware of a breach, as the DPA requires, ahead of the 72-hour regulatory deadline.
Get in touch. We will answer specifically, with documentation if you need it.
Email hello@hmdg.co.uk