Practice Better acts as a data processor for practitioners who serve clients in the United Kingdom and European Union. This article answers common questions about Practice Better's role under GDPR, the GDPR Data Processor Agreement (EU/UK), international data transfers, and your responsibilities as a data controller.
In this article:
- Understanding GDPR and Practice Better's Role
- UK GDPR Compliance
- Data Storage and Security
- International Data Transfers
- Data Breach Notification
- Your Clients' Data Rights
- Your Responsibilities as a Practitioner
- Keeping Up With Changes
Understanding GDPR and Practice Better's Role
The General Data Protection Regulation (GDPR) is a comprehensive data protection law that strengthens the protection of personal data in light of rapid technological developments and complex international data flows. Both the UK GDPR and EU GDPR require organizations to implement appropriate safeguards when collecting, storing, and processing personal data.
Q: What is Practice Better's role under GDPR?
A: Practice Better acts as a data processor on your behalf, while you (the practitioner) remain the data controller. You determine why and how your clients' personal data is processed, and Practice Better processes that data according to your instructions. This controller-processor relationship is governed by the GDPR Data Processor Agreement (EU/UK), which you can sign in your account settings.
Q: Does Practice Better comply with both UK GDPR and EU GDPR?
A: Yes. Practice Better's compliance framework is designed to align with both UK GDPR and EU GDPR requirements. The provisions of the EU GDPR have been incorporated into UK law as the UK GDPR, and the core data protection principles, rights, and obligations are the same under both regulations.
📍 Note: Following Brexit, organizations operating in the UK are subject to UK GDPR and the Data Protection Act 2018. If you serve clients in both the UK and EU, the regulations are closely aligned, but they're enforced by separate authorities.
UK GDPR Compliance
Q: I'm a UK practitioner. Does Practice Better specifically comply with UK GDPR requirements?
A: Practice Better processes health data on the practitioner's documented instructions. The controller-processor relationship is governed by the GDPR Data Processor Agreement (EU/UK).
Q: Does the GDPR Data Processor Agreement (EU/UK) cover UK GDPR?
A: Yes. The GDPR Data Processor Agreement (EU/UK) includes a UK GDPR Addendum. It covers the EU GDPR, the UK GDPR, and the UK Data Protection Act 2018. To find it, go to Settings (gear icon) > View All > Regulatory Compliance.
Learn more about Signing Regulatory Compliance Agreements →
Q: Why does the agreement include a UK GDPR Addendum?
A: Following Brexit, the United Kingdom operates under its own data protection framework: UK GDPR and the Data Protection Act 2018. While the UK GDPR closely mirrors the EU GDPR, UK practitioners require UK-specific contractual commitments from their data processors. The addendum formalizes those commitments within the agreement.
Q: I signed the agreement before the UK GDPR Addendum was added. Do I need to do anything?
A: Yes. Review and sign the current version of the GDPR Data Processor Agreement (EU/UK) at Settings (gear icon) > View All > Regulatory Compliance, so your agreement reflects current practices.
Q: What happened to my previously signed agreement?
A: When the updated agreement was published, the previous version was archived and is no longer accessible in-app. If you need a copy of the version you signed before, email help@practicebetter.io from the email address on your Practice Better account.
Q: If I have clients in both the UK and EU, do I need separate consent mechanisms?
A: No, you generally don't. The UK GDPR and EU GDPR share the same core principles regarding consent, data protection, and processing. You can use a single consent mechanism that meets the stricter requirements of both. We recommend checking with your own legal advisor to make sure your privacy notice meets the requirements for your practice.
Learn more about Understanding GDPR Obligations for Your Practice →
Data Storage and Security
Q: Where is my client data stored?
A: Practice Better stores your data in the United States, on data centers operated by Amazon Web Services (AWS). This includes primary storage and backups. Box.com, also based in the United States, powers document previews.
Learn more about Practice Better Data Residency →
Q: Does Practice Better own and operate its own servers?
A: No. Practice Better uses cloud infrastructure from third-party providers, including AWS and Box Inc., for data storage and processing. These providers sign BAAs and have SOC 2 Type II audits.
Q: What security measures does Practice Better use to protect client data?
A: Practice Better uses technical and organizational measures to protect special category health data. These include TLS encryption in transit, AES-256 encryption at rest, role-based access controls, audit logging, and staff confidentiality agreements and data protection training.
Learn more about Understanding Security and Privacy in Practice Better →
Q: Who are Practice Better's sub-processors?
A: Practice Better maintains GDPR Data Processing Agreements with all sub-processors that store or process client data. Sub-processors are contractually bound to the same data protection obligations as Practice Better and are held accountable under our Data Processing Agreement. Our complete list, including cloud infrastructure, communication, analytics, and payment processing providers, is published in the Practice Better Trust Center.
International Data Transfers
Q: How does Practice Better handle international data transfers?
A: Practice Better maintains appropriate safeguards for international data transfers under both UK and EU GDPR. Transfers are governed by our Data Processing Agreement, with technical safeguards that include encryption in transit and at rest, access controls, and contractual protections with all sub-processors. Our DPA also commits us to transfer assessments where legally required.
Q: What should I tell my clients about where their data is stored?
A: You can tell your clients that their data is stored in the United States on data centers operated by Amazon Web Services (AWS), and that international transfers are subject to appropriate safeguards under GDPR. For recommended privacy notice content, see Understanding GDPR Obligations for Your Practice.
Learn more about Understanding GDPR Obligations for Your Practice →
📍 Note: GDPR applies to your practice if the practice is established in the EU or UK, for all of your clients, wherever they are. If your practice is outside the EU or UK, GDPR applies when you offer services to people within the EU or UK.
Data Breach Notification
Q: What happens if Practice Better experiences a data breach?
A: If we become aware of a breach affecting your data, we'll notify you by email without undue delay, within the timeframe in your agreement with us. We'll share what we know at the time and update you as we learn more, including:
- The nature of the breach, including the categories of data affected.
- The name and contact details of the data protection officer or other contact point.
- The likely consequences of the breach.
- The measures taken or proposed to address the breach and reduce its possible adverse effects.
Q: What are my responsibilities if Practice Better notifies me of a breach?
A: You must report a data breach to your Data Protection Authority without undue delay and, where feasible, within 72 hours of becoming aware of it. If it's likely to result in a high risk, you must also tell affected clients.
Your Clients' Data Rights
Q: Can I export all my client data if I need to switch platforms or if a client requests their data?
A: Yes. Under GDPR Article 20 (Right to Data Portability), you and your clients have the right to receive personal data in a structured, commonly used, and machine-readable format. You can export an individual client's record at any time. To export all of your client data at once, email help@practicebetter.io from the email address on your Practice Better account.
When your clients request their data from you, you're responsible for providing it to them in an accessible format. Practice Better's export features help you fulfill these requests.
Learn more about Exporting Client Records From Practice Better →
Q: How long does Practice Better retain client data after I delete a client record?
A: When you delete a client record, it's removed from your portal right away. You can restore it for 60 days after deleting it.
Backup copies may remain for a limited time: daily backup snapshots are purged within 30 days, and monthly backup snapshots are purged within 12 months. This backup retention is necessary for disaster recovery. Data in backups is put "beyond use," meaning Practice Better won't access or process it for any purpose during this period. This approach aligns with guidance from the UK Information Commissioner's Office (ICO).
Learn more about Deactivating, Deleting, and Restoring a Client Record →
Q: If a client withdraws consent, am I required to delete their data immediately?
A: The right to erasure isn't absolute. Even when a client withdraws consent, you may be required or permitted to keep their data if you have another legal basis for processing, such as:
- Compliance with legal or regulatory obligations, such as tax records or healthcare recordkeeping requirements.
- Establishment, exercise, or defense of legal claims.
- Public interest or health purposes as defined in UK or EU law.
You must delete the data "without undue delay" (typically within one month) unless one of these exemptions applies. When an exemption applies, tell the client why you're keeping their data and for how long.
Learn more about Allowing Clients to Delete Their Accounts →
⚠️ Important: Check with your legal advisor about your specific retention obligations based on your profession and jurisdiction. Some healthcare professionals have mandatory minimum retention periods that override the right to erasure.
Your Responsibilities as a Practitioner
As a data controller, you have specific responsibilities under GDPR. Practice Better provides the tools and infrastructure to help you meet these obligations, but you're responsible for how you collect, use, and manage your clients' personal data.
Obtaining Consent
You must collect affirmative consent from clients before their data is collected. You can collect consent at the point of booking with a consent form or with Terms & Conditions on your Bookings Page. We recommend this even if you're not targeting UK or EU clients.
If you give clients access to the Client Portal, we recommend sending a waiver or consent form before granting access.
Learn more about Understanding GDPR Obligations for Your Practice →
Privacy Notices
Your privacy notice should clearly explain how you collect, use, and protect client data, including that you use Practice Better as a data processor. For recommended content and sample language, see Understanding GDPR Obligations for Your Practice.
Explore Practice Better's library of Form Templates you can use and adapt for your privacy policy.
Withdrawing Consent and Client Rights
Give your clients clear instructions on how to withdraw consent and have their data removed from Practice Better. You can offer a way to do this by email, by phone, or through Secure Messaging in Practice Better. You can remove a client's data at any time by deleting their client record.
- Learn more about Deactivating, Deleting, and Restoring a Client Record →
- Learn more about Allowing Clients to Delete Their Accounts →
📍 Note: When a client withdraws consent, let them know their data may remain in backups for a limited time: daily backup snapshots are purged within 30 days, and monthly backup snapshots are purged within 12 months.
Marketing and Communications
Practice Better may occasionally send you emails with promotions and announcements of new features and updates. These emails are only sent to you, the practitioner, and are never sent to your clients. You can unsubscribe or update your email choices with the Unsubscribe and Manage Preferences links at the bottom of these emails.
Practice Better sends transactional email, text (SMS), and push notifications on your behalf. Examples include new protocols and forms to complete, invoices and receipts, and reminders for upcoming sessions. Practice Better doesn't send your clients any communication about promotions or special offers for products and services associated with Practice Better or otherwise.
If you plan to use client contact information to promote or sell products and services, say so clearly with a disclaimer and opt-in choice on your Bookings Pages or waivers, both of which you can deliver through Practice Better.
Keeping Up With Changes
Q: How will I know if Practice Better's data processing practices change?
A: Practice Better keeps current information about sub-processors and data processing locations in the Practice Better Trust Center. Any material changes to data processing practices or locations that would affect GDPR compliance will be communicated to practitioners.
Review the Trust Center regularly for updates. Practice Better's Data Processing Agreement also includes provisions requiring notification of changes to sub-processors.
Q: Where can I find Practice Better's Data Processing Agreement?
A: The GDPR Data Processor Agreement (EU/UK) is available on all plans, including the free Sprout plan. To find it, go to Settings (gear icon) > View All > Regulatory Compliance. The agreement covers the processing of special category health data and international data transfers.
Learn more about Signing Regulatory Compliance Agreements →
If you have more questions about GDPR compliance or data protection, our support team is here to help at help@practicebetter.io.
📍 Please note: Practice Better is providing this information only as a courtesy, and this doesn't constitute legal advice. We recommend checking with your own legal advisor to make sure your data protection practices meet all applicable requirements for your jurisdiction and profession.