Data residency
Where your practice's patient data is held, how each region is kept separate, and what that means for your staff's sign-in.
3 min read
Key terms
- Data residency. Keeping data inside a set country or region.
- Region. One of 2care's separate deployments: the US, Europe (the EU or the UK) and India.
- Deployment. A complete, self-contained copy of the 2care platform with its own hosting, database and sign-in.
Where your data is held
| Your practice is in | Your data is held in | Set up for |
|---|---|---|
| The United States | The US | HIPAA, with a signed BAA |
| The UK or the EU | The EU or the UK | GDPR, with a DPA |
| India | India | DPDP, with in-country data residency |
How regions are kept apart
Each region is a separate, isolated deployment, and your practice's data never leaves it. There is no single shared system that sorts data by country, so a practice in one region is never stored alongside practices in another.
| What stays in your region | Examples |
|---|---|
| Patient records | Names, contact details and the appointments made through 2care |
| Calls and messages | Call recordings, transcripts, texts and chat conversations |
| Practice setup | Your agent's instructions, your rules and your staff accounts |
| Records of activity | The audit log of who did what, and when |
Your staff sign in at your region's own web address, so their accounts live in the same region as your patients' data.
Your practice's region
Your practice is set up in exactly one region during onboarding. Your staff are given that region's web address and sign in there. Your bookings, transcripts and audit logs are all held in that region.
The same protection in every region
- Encryption. Patient data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.
- Audit logging. Every consequential action is recorded, with who did it, what it affected and when.
- Access by practice. Every request is limited to the practice it belongs to, so your staff only ever see your patients.
- No model training. Patient data is never used to train shared models.
Engineering access
When 2care's team works on your practice's data, for example to apply an update, that work is carried out inside your region. Every action is recorded in the audit log.
Your EHR and payers
Some data moves between 2care and the systems you already use, such as your EHR and, with eligibility checks on, payers through a clearinghouse connection. That exchange is part of the service your practice asked for and is encrypted in transit. Where your EHR itself is hosted is set by your EHR vendor.
Questions
Can a multi-country group use one account?
Each practice is set up in the region it operates in. A group with practices in more than one region has one setup per region, which your onboarding specialist plans with you.
What if a staff member signs in at the wrong address?
Their account is held in your region only, so they will not find it elsewhere. Signing in at your region's address fixes it.
Where can we see this in writing?
The BAA or DPA you sign sets out how 2care handles your data. Our compliance page and privacy policy cover hosting by region.
Related
Was this page helpful?