For private clinics and healthcare practices

Built to the ICO standard.

Custodiance runs your practice's web and email estate as a managed service: your data stored in UK and EU regions, built to the standard your ICO duties require, and run by a named senior engineer you deal with directly. A patient enquiry that names a condition is special-category data the moment it lands; the way we run your infrastructure treats it that way.

We work for private clinics, and we do not handle NHS patient data. Work for NHS-connected clinics waits until we hold a Data Security and Protection Toolkit submission as a supplier at Standards Met and Cyber Essentials certification; we hold neither today.

Request a scoping call The methodology

The risk

What the ICO and NHS DSPT require of your website, and where agency builds silently fail

A typical independent clinic site (podiatry, dentistry, physiotherapy, mental health, fertility, cosmetic, or veterinary care) was built a few years ago on whichever SaaS stack carried a template: a US host, a US enquiry form, Google Analytics, a US newsletter tool. The site works and bookings come in. It also quietly fails the obligations the practice, not the agency, is accountable for. Four are worth naming precisely.

UK GDPR and the ICO regime

The practice is the data controller, and the ICO enforces UK GDPR under the Data Protection Act 2018. That means Article 30 records of processing, Article 28 data-processing agreements with every sub-processor, and, under Articles 44 to 49, a lawful transfer mechanism with Standard Contractual Clauses and a written Transfer Risk Assessment for any personal data flowing outside the UK and EU. The agency that wired the enquiry form to a US host almost certainly wrote none of these.

Special-category health data

A patient enquiry that names a condition is special-category data under UK GDPR Article 9 the moment it lands. The Caldicott Principles add the NHS-adjacent layer: justify every use of identifiable patient information, and keep access on a strict need-to-know basis. An enquiry form on US-resident infrastructure exposes that data to lawful third-party access, under the US CLOUD Act, that the practice never named and cannot defend.

The NHS Data Security and Protection Toolkit

Any clinic in the NHS supply chain (taking GP referrals, supplying an occupational-health service, or processing data that originated in NHS systems) inherits Data Security and Protection Toolkit (DSPT) obligations through its contracts. The assessor spot-checks the public website: the named Information Governance lead, the incident-reporting route, the privacy notice, the supported stack, and the sub-processor list are all verified in a browser before any conversation with the practice.

Where patient data is hosted

Most clinic sites route enquiry forms, the CRM, analytics, and patient mailings through US-resident SaaS: HubSpot, Mailchimp, Google Analytics, a US inbox. The CJEU's Schrems II ruling made bulk transfer of personal data to US infrastructure legally precarious, and US-resident services remain subject to the CLOUD Act regardless of where the data physically sits. The practice cannot answer where the data lives or who can reach it.

None of these obligations explicitly requires a website hosted in the UK or the EU. Each, however, eventually asks the same question: where does the patient data live, who has access, and can the practice prove it? On a typical agency-built site the honest answer is "we do not really know."

How Custodiance answers it

An estate held to your regulator's standard

The work that puts a clinic's site right is not a one-off remediation. It is the work the estate carries continuously, mapped to the ICO duties a practice is accountable for.

A managed estate, not a finished project

Your web and email infrastructure is run as an estate we hold continuously (audited, monitored, and changed on your behalf), not handed over once and left to decay. Patient enquiry intake, the CRM, analytics, patient mailings, and the compliance-facing pages are kept correct as the regime and your practice evolve, rather than rebuilt against a deadline.

UK and EU data residency by design

Hosting is pinned to Vercel's London region in each project's configuration. Patient enquiry forms post to the estate's own endpoint, collect the minimum, and are relayed by Scaleway in France to your practice's own mailbox, in your Microsoft 365 or Google Workspace tenant or at Proton in Switzerland, a country the UK and EU recognise as adequate. A CRM, a booking system or a patient-newsletter platform is opened in your practice's name, chosen for UK or EU residency, and named in your sub-processor schedule. Where you want analytics, they run on our own Plausible Community Edition server in France, without cookies. The US-incorporated providers that stay in the path, Vercel for hosting, GitHub for the source code and Cloudflare for DNS, are named in the published sub-processor list as exceptions. When a patient, an insurer, an ICB, or a DSPT assessor asks where the data lives and who can reach it, the answer is written down, and it maps to your Article 30 records.

Sub-processor list · Data processing agreement

Built to a published methodology

The standard each estate is built to is written down and applied consistently, so the way your practice is built is the way the next one is: auditable, repeatable, and defensible rather than improvised per project. The posture is set out in the Custodiance framework.

A named senior engineer

One senior technical partner runs your estate: a name and a direct line, not a ticket queue. That engineer understands your ICO duties, does the work between requests, and is the person you speak to when something needs to be put right.

The clinics guides

The detail, set out in full

Six briefings work through the specifics a clinic actually faces, from the DSPT scope decision to online booking, with the regulatory text quoted and sourced. General guidance, not legal advice: each briefing names its primary sources and says where to verify.

Why your UK clinic's website probably breaks GDPR

The Four Clinic Failure Modes: patient enquiry forms on US infrastructure, tracking pixels with no lawful basis, a CRM exporting patient identifiers to US tooling, and email marketing mailing patients from US servers, set against UK GDPR Article 9 special-category health data, the Caldicott Principles, and the CLOUD Act.

Read the briefing →

Health data on your clinic website: special-category rules in plain English

The two-part lawful-basis test, why consent is usually the wrong basis for care and the right one for a newsletter, and what a public web form should quietly stop collecting. UK GDPR Article 9 without the jargon.

Read the briefing →

Does your private clinic need the NHS DSPT?

The decision guide: who must complete the Data Security and Protection Toolkit and who does not, how NHS contracts and NHSmail pull a private clinic into scope, what changed in Version 8, and the 30 June deadline.

Read the briefing →

DSPT compliance for UK clinics: the website-side checklist

The website is in scope for at least ten named DSPT assertions, from the privacy notice and the named IG lead, through the incident-reporting route and the breach SLA, to the supported stack and the sub-processor list. Each named, and the standard that satisfies it.

Read the briefing →

A CQC-ready clinic website: what to publish and what to keep private

Regulation 20A display of ratings and the duty of candour on the publish side; the UK GDPR and confidentiality limits on testimonials, before-and-after photos, and patient data on the keep-private side. Where the line sits.

Read the briefing →

Online booking for clinics without breaking data rules

Why a booking into a named service is special-category health data, why US-cloud booking tools are the weak point, and what booking with UK and EU data residency, minimised at the booking step and documented end to end, actually looks like.

Read the briefing →

Engage

How to run the estate

Growth

Quoted per practice After a scoping call, confirmed in writing

For an established practice that wants its web and email estate run properly, in UK and EU regions, by a named technical partner.

Managed web + email infrastructure
Built to your regulator's standard
UK and EU data residency, exceptions named
A named technical partner
Continuous monitoring + changes

Custody, not marketing.

Have a senior partner review your estate against the ICO standard

A scoping call is a measured conversation about your obligations, your current setup, and what it would take to run it properly. Each of the four arms above is reviewed against your live site and marked pass, partial, or fail, with the specific remediation for each. No obligation, and no pressure.

Request a scoping call See pricing