Data protection
The agreement, your DPIA, how long records are kept, and the access log.
Who's responsible for what
Your clinic is the controller of its patients' data; Hally processes it for you. The data processing agreement, which you accept when you sign up, sets out how. Read or download it in Settings → Account → Data protection.
Your DPIA
A DPIA (data protection impact assessment) is your clinic's own document. Settings → Account has one already filled in with how the software works and protects data; complete the parts for your clinic and keep it with your records.
How long records are kept
Settings → Account → How long records are kept sets your retention periods. Each day, records past their period are listed for you to review. Nothing is deleted until you confirm.
The access log
Every time someone views or changes a patient's record it's logged, and the log can't be edited. Download it from Settings → Account.
Encryption
Clinical notes, forms and messages are encrypted with your clinic's own key, and your data is kept apart from every other clinic's by the database itself.