DrDoctor

DrDoctor is a cloud-based SaaS platform hosted primarily on Microsoft Azure. Production workloads run in Azure UK South, with resilience and other services configured in additional regions where applicable. DrDoctor has no on-premises production components. Patient data held in the DrDoctor production environment and its backups is hosted in the UK. Some sub-processors may process data outside the UK; where this occurs, the relevant transfer safeguards and processing locations are documented in the applicable Data Processing Agreement and sub-processor information.

We maintain a current sub-processor register covering the services provided, processing locations and relevant transfer safeguards. The applicable Data Processing Agreement and sub-processor information are the authoritative sources. Sub-processors are subject to appropriate contractual data protection obligations and are kept under review. The current information is available to trusts through the agreed customer-assurance process.

As a processor, we retain data in line with the Trust’s instructions and applicable retention schedule. At contract end, or earlier on the controller’s instruction where appropriate, we securely return, delete or anonymise data in accordance with the contract and agreed off-boarding process. The applicable time limit is set out in the contract or DPA.

The platform is operated by DrDoctor on Microsoft Azure, with core production hosting in the UK and no on-premises production components. Third parties involved in delivering the service are identified through the applicable sub-processor and contractual assurance process.

DrDoctor Tasks is registered with the MHRA as a Class I medical device (registration reference 2026052201494644). The regulatory status of other products is assessed separately according to their intended purpose; we do not represent other products as registered medical devices unless expressly stated. Registration is not the same as MHRA approval or certification.