Security & Trust Centre

Data protection

Patient and enquiry data is handled securely and in line with UK GDPR requirements.

• ReplyOS acts as a data processor. Your practice remains in full control.
• Secure infrastructure with encrypted data transmission
• Role-based access and audit tracking
• No data is ever sold or used outside your control

Encryption & transport

All data in transit is encrypted using industry-standard TLS (HTTPS). Data at rest is protected by our cloud hosting provider's disk encryption (typically AES-256). ReplyOS does not claim separate application-level encryption of every database field. We continue to strengthen controls as the platform matures.

Infrastructure security

ReplyOS is hosted on secure cloud infrastructure with:

• Redundant backups and disaster recovery
• DDoS protection
• Monitoring and intrusion detection
• Regular security review and targeted testing

Access control

We implement strict access controls including:

• Role-based access control (RBAC)
• Comprehensive audit logging
• Session management and timeout policies

Compliance standards

ReplyOS is designed to support practices operating under:

• UK GDPR and the Data Protection Act 2018
• CQC information governance expectations
• Industry best practices for healthcare-adjacent communication data

ICO registration ZC192287 is held by Reply Intelligence Group Ltd. We do not display unofficial “GDPR certified” badges. There is no UK GDPR certification scheme. Formal certifications (e.g. Cyber Essentials) may be pursued as the platform scales.

International transfers, where they occur, are governed by the UK IDTA or the UK Addendum to the EU SCCs, as set out in our DPA.

Subprocessors

We use trusted providers to deliver hosting, messaging, billing, and AI-assisted features. All are bound by appropriate data protection terms as described in our DPA.

Customer-connected integrations (for example CRM or PMS tools you enable) are controlled by your practice and governed by your agreements with those providers.

Data retention & deletion

We retain data only as long as needed to provide the service, meet legal obligations, and support secure deletion after contract end. Specific retention may depend on your configuration and agreement. Contact us for practice-specific questions.

Data breach response

In the unlikely event of a personal data breach affecting our processing, we will:

• Notify affected customers within 72 hours of becoming aware of a breach affecting their data
• Provide incident detail to support your regulatory obligations
• Assist with ICO notification where applicable and agreed
• Implement remediation and preventive measures

Your responsibility

ReplyOS supports, but does not replace, your compliance processes. Your practice remains responsible for:

• Obtaining valid consent and lawful basis where required
• Managing data subject access requests for patient data
• Internal information governance and staff training
• Configuring integrations and channel permissions appropriately

Questions

For security questionnaires, DPA copies, or compliance discussions: hello@replyos.co.uk