Data protection
Data protection, in plain words.
Patient records, photos and signed consents are the most sensitive things a clinic keeps. Here is how Injectly handles them, without the legal language. The full legal documents are linked at the end.
01 · Where data lives
Where is our data stored?
Clinic and patient data is stored on servers in the European Union, in Ireland. We work with a short list of service providers, each for one clear job:
- Supabase
- Database, file storage and sign-in. All patient records, photos and consents are stored here, in the EU (Ireland).
- Vercel
- Runs the Injectly application in your browser.
- Resend
- Sends emails such as reminders, consent requests and aftercare, so it receives the recipient’s email address and the email itself.
- Sentry (EU)
- Reports technical errors so we can fix them. Patient details are removed before anything is sent.
- Stripe
- Handles your Injectly subscription payments. It never receives patient data.
- Google / Microsoft
- Only if you connect your calendar: Injectly reads busy and free times. No patient data is sent to your calendar provider.
02 · Responsibilities
Who is responsible for what?
Under GDPR your clinic is the controller of patient data: you decide why and how it is used. Injectly is the processor: we store and process it only to provide the service you use, on your instructions.
Every clinic is covered by a data processing agreement (DPA) that sets this out, together with the list of sub-processors above. If the agreement ends, your data is returned or deleted as described in the DPA.
03 · Who can see what
Who in our clinic can see patient data?
Each person on your team has a role. The role decides what they can open, and the rules are enforced by the database itself, not only hidden on screen.
| Data | Clinic admin | Practitioner | Staff |
|---|---|---|---|
| Calendar and appointments | ✓Yes | ✓Yes | ✓Yes |
| Patient details and allergies | ✓Yes | ✓Yes | ✓Yes |
| Clinical history and treatment records | ✓Yes | ✓Yes | —No |
| Treatment photos | ✓Yes | ✓Yes | —No |
| Inventory, marketing and communication | ✓Yes | ✓Yes | ✓Yes |
| Team members and billing | ✓Yes | —No | —No |
Each clinic’s data is separated in the database, so people only ever see the clinic they belong to. Team members join through a personal invitation that works only for the email address it was sent to.
04 · Photos
How are treatment photos protected?
- Photos are kept in private storage, never on a public web address.
- When someone with access opens a photo, it is shown through a temporary link that expires after one hour.
- Only roles with access to treatment photos can view them (not the Staff role).
- A photo can only be approved for social media or campaigns when the patient has given image-use consent for that visit. The database checks this, so it can’t be skipped by mistake.
05 · Consents
What happens to a signed consent?
- The record keeps exactly what the patient agreed to: the document version, the full text they saw, each checkbox answer, and when and from which device they signed.
- A signed or declined consent can’t be edited or deleted afterwards, by anyone.
- Every step is recorded: sent, opened, signed, declined, expired or withdrawn.
- An appointment with a signed consent can be cancelled, but not deleted, so the record stays complete.
- The patient receives a copy of the consent they signed.
06 · Patient links
Why don’t patients need an account?
Patients never get a login or a password that could be guessed or reused. Instead they receive secure links by email for the step they need: booking changes, the intake form, a consent to sign or their treatment summary.
- Consent and intake links contain a long random code, and Injectly stores only a scrambled (hashed) version of it.
- Consent and intake links expire after 7 days. Sending a new consent link switches the old one off.
- Emails contain links, not clinical notes, so a forwarded email doesn’t expose a medical record.
07 · Patient rights
What if a patient changes their mind?
- Patients can withdraw image-use or marketing consent themselves, through the link in their email, without calling the clinic.
- Your clinic is notified by email, and the withdrawal is recorded with its date and channel.
- Your team can also record a withdrawal given in person or by phone, on the patient’s profile.
- Other requests, such as access to or deletion of a record, are made to your clinic as the controller. We help you respond to them, as set out in the DPA.
08 · Security
How is the service itself protected?
- All connections are encrypted (HTTPS only), with strict browser security headers on the application.
- Public pages patients use, such as booking and consent, are protected against automated abuse with rate limits.
- The database is backed up automatically every day.
- Signing out ends the session on the server, not just in the browser.
Questions about your data?
Ask us before you start, or request our data processing agreement for review. hello@injectly.io