GDPR and DPDP
How 2care meets GDPR for your UK or EU practice and DPDP for your Indian practice, and which agreement and hosting you get.
3 min read
Key terms
- GDPR. The data protection law that covers patient data in the UK and the EU.
- DPDP. India's Digital Personal Data Protection Act.
- DPA. A data processing agreement: the contract that sets out how 2care processes data on your practice's behalf.
- Grievance officer. The named contact for data protection concerns under DPDP.
This page is general information, not legal advice. For US practices, see HIPAA and the BAA.
At a glance
| Region | Law | Agreement | Where data is held |
|---|---|---|---|
| United States | HIPAA | Business associate agreement (BAA) | The US |
| UK and EU | GDPR | Data processing agreement (DPA) | The EU or the UK |
| India | DPDP | Data processing agreement | India |
GDPR in the UK and EU
Under GDPR your practice decides why and how patient data is used. 2care processes it on your behalf to answer calls, book appointments and send messages. A DPA sets out that relationship and is signed before any patient data moves.
- Hosting. Data for UK and EU practices is held in the EU or the UK, in a deployment kept separate from the US and India.
- Staying in region. Each practice is set up in one region and its data stays there.
- Patient rights. Requests for access, erasure and portability are carried out on the data held in your practice's region.
- Safeguards. Encryption at rest and in transit and full audit logging apply in every region.
DPDP in India
DPDP sets out how personal data is handled, including by a company that processes data for another under contract. For your Indian practice, 2care provides the following.
- Data residency. Data for Indian deployments is held in India and stays there.
- A contract. 2care processes patient data under a DPA with your practice.
- A grievance officer. Patients and practices can raise data protection concerns with 2care's grievance officer, through the contact in our privacy policy.
- Patient rights. Requests for access, correction and erasure are handled on the data held in India.
The same in every region
| Commitment | Read more |
|---|---|
| Patient data is never used to train shared models | How patient data is used |
| AES-256 encryption at rest, TLS 1.2 or higher in transit | Encryption and audit logs |
| Every consequential action is recorded in an audit log | Encryption and audit logs |
| Your data is held in the region your practice operates in | Data residency |
Questions
Which region will we be set up in?
The region you operate in. Your practice is placed there during onboarding and given the sign-in for that region. If you operate somewhere other than the US, the UK, the EU or India, or under a different data protection law, tell us and we plan the setup with you. See data residency.
Is a DPA the same as a BAA?
They do a similar job under different laws. A BAA is the HIPAA agreement for US practices, and a DPA is the agreement GDPR and DPDP expect. 2care signs whichever your region requires.
How does a patient ask for their data to be deleted?
The patient contacts your practice, as the organisation responsible for their data. Your practice then asks 2care to carry it out. Our privacy policy sets out how requests reach us.
Related
Was this page helpful?