Security & trust
Healthcare data. Treated like it.
Clinable was designed for clinics from the first line of the schema — not adapted to healthcare after the fact. Here is exactly how your patients' data is handled.
Your clinic is the controller. Clinable is the processor.
Under UK GDPR the clinic normally decides why patient data is processed and Clinable acts on its documented instructions. Before real-patient onboarding, the parties confirm their roles, sign the Data Processing Agreement, approve the DPIA and review the current subprocessor register.
Tenant isolation, enforced by the database itself.
Every patient-facing record carries the clinic's ID. Database row-level security and server-side tenant checks are designed to prevent one clinic's staff reading another clinic's data, with isolation tests forming part of release assurance.
An audit log that can't be edited.
Important calls, messages, bookings, escalations and operational changes are written to an append-only audit trail. Audit data remains access-controlled, minimised and subject to an approved retention schedule.
Safety rules the AI can't be talked out of.
The assistant discloses it's an AI in its first sentence, on every call. Anything that sounds like a medical emergency triggers a hard-coded rule — hang up and call 999 — that no caller and no clever phrasing can override. The AI never diagnoses, never gives medical advice, and escalates uncertainty to your team.
Patient messages can't reprogram the system.
Everything a patient says is treated as data, never as instructions. Every action the AI wants to take passes through a policy engine that checks it against your clinic's rules before anything executes — and records the decision either way.
No card details. Ever.
Deposits are taken through secure payment links sent by SMS. The payment provider handles the card; Clinable stores only the metadata — amount, status, when it was paid.
The onboarding assurance pack is being completed before real-patient use. It includes the privacy notice, DPA, DPIA, subprocessor register, retention schedule, clinical-safety evidence and incident-response responsibilities.