Whose data it is, where it lives, and how it leaves.
The commitments a clinic's legal and procurement team needs in writing: ownership, residency, retention, deletion, subprocessors and the data processing agreement.
Core commitments
Data ownership
Patient records belong to the clinic. Asttona stores and processes them on the clinic's instruction and claims no ownership of clinical content at any point, including after the contract ends.
Data residency
The hosting region is agreed at onboarding — Gulf, United Kingdom, European Union or United States — so clinics with local residency rules can keep patient data in their jurisdiction. The chosen region is recorded in the data processing agreement.
Access controls
Access is granted by role, scoped per location, logged on every record open, and revoked immediately when a team member leaves. Asttona staff do not browse clinic data; support access is permissioned, time-limited and audited.
Tenant isolation
Each clinic's data is isolated at the database layer, with every query scoped to the owning clinic so records cannot cross between tenants.
Data retention
Retention is configured per clinic to match the clinical record rule in its jurisdiction. Enquiry and marketing data is kept only as long as the conversation and legal obligations require.
Data deletion
Clinics can delete records in-platform, subject to the retention rules they operate under. On contract termination, clinic data is exported first and then permanently deleted from live systems within 30 days and from backups within the backup rotation window, with written confirmation on request.
Data export and portability
Patient records, appointment history, documents and images can be exported by the clinic at any time in structured, machine-readable formats. No exit fee, no hostage data.
Breach notification
Confirmed breaches affecting clinic data are notified to the clinic without undue delay and within the timeframe its regulator sets, with the facts, scope and remediation steps.
Subprocessors
Asttona uses a short list of vetted service providers to deliver the platform. Each is bound by a written agreement with confidentiality and data protection obligations no weaker than ours, and clinics are notified before a new subprocessor handling patient data is added.
Cloud hosting and database
Application hosting, database and encrypted file storage in the clinic's agreed region.
Messaging delivery
Delivery of SMS, WhatsApp and email reminders, confirmations and aftercare messages to patients.
Transactional email
System email such as account, password and notification messages.
Payments processing
Where a clinic enables payments or deposits; card data is handled by the payment provider, not stored by Asttona.
Error and performance monitoring
Technical diagnostics and uptime monitoring, configured to avoid clinical content.
The current named subprocessor list, with each provider's role and hosting region, is provided on request at [email protected].
Data processing agreement (DPA)
Every clinic can sign a DPA setting out the subject matter and duration of processing, the categories of patient data, the clinic's instructions, confidentiality, security measures, subprocessor rules, assistance with patient rights requests, breach notification, and deletion or return of data at the end of the contract. Standard contractual clauses are included where data crosses borders, and a HIPAA Business Associate Agreement is available for US covered entities.
