Compliance, subprocessors & retention

Subprocessors (hosted instance)

We keep this list short on purpose. The hosted instance uses exactly these third parties:

• Amazon Web Services — SES

  Purpose

  Transactional email (verification codes, magic links, invitations)

  Data involved

  Recipient email address, message content and delivery metadata

  Region

  us-east-1 (United States)

• Anthropic API

  Purpose

  AI-assisted note drafting in Galen only — runs only when a user explicitly requests a draft

  Data involved

  The note text and images the user submits for drafting; not used to train models; drafts remain drafts until human review

  Region

  United States

• Hetzner Online

  Purpose

  Infrastructure hosting for the hosted Docuity instance

  Data involved

  All application data (encrypted at rest where specified in the security posture)

  Region

  European Union (Germany / Finland)

We will update this page before adding or replacing a subprocessor. Self-hosted deployments send no data to these providers unless the operator configures them.

Retention

• Docuity ID sessions

  Expire after at most 30 days; revocable immediately from the account page.

• Account deletion

  Soft-deleted immediately, purged permanently after 30 days.

• Osler (staff messaging)

  Per-workspace retention, default 365 days; a nightly job purges expired messages. Workspace admins can change the period.

• Clinical records (EHR, Rx, Galen)

  Retained while the owning clinic/practice/chart account is active; deleted with the tenant subject to any legal retention duties of the operator.

• Audit logs

  Retained for the life of the deployment (append-only by design).

• Email sending records

  Delivery metadata retained by AWS SES per its policy; we keep only send status.

• Public interaction checker

  Queries are processed in memory and not stored; only anonymous in-memory rate-limit counters exist, and they reset on deploy.

• Backups

  Daily database backups; the most recent 7 are kept, then rotated out.

Your rights (GDPR-aligned)

Docuity is built to honor the data-subject rights in the GDPR and similar laws, regardless of where you live:

• Access & portability — export your account data as JSON from the Docuity ID account page at any time.
• Rectification — edit your profile in Docuity ID; clinical records follow the medical-record correction rules of the clinic that owns them (addenda and “entered in error” flags rather than silent edits).
• Erasure — delete your account from the Docuity ID account page; data is purged after the 30-day soft-delete window described above.
• Consent history — the consents you have granted or revoked are listed, with timestamps, in your account.
• Objection / restriction / complaint — contact the operator (below); you may also complain to your local supervisory authority.

How to exercise them: use the built-in export and deletion tools first — they are self-service and immediate. For anything else, contact the Docuity operator identified on the About page; we answer within 30 days.

Roles: for clinical data (EHR patients, prescriptions, care records) the clinic, practice, or chart owner is the data controller and the Docuity operator processes on their instructions. For your Docuity ID account, the operator is the controller.

Data processing agreements

Organizations using the hosted instance can request a data processing agreement (DPA) from the Docuity operator; it covers the subprocessor list above, breach notification, and deletion on termination. If you self-host, you are the controller and operator — no DPA with us is needed, and this page's subprocessor list does not apply to your deployment.