General Data Protection Regulation
We support GDPR readiness with access controls, audit records and campaign consent preferences, while your team determines lawful processing and its procedures.
Set by European Parliament and Council of the European Union
Subject type: law. The General Data Protection Regulation is a European Union regulation on personal data. Whether it applies depends on your organisation and the people whose data it handles. This page describes product controls. It is not legal advice or a legal assessment.
What is built
- Roles and permissions support controlled access to the selected records.
- Two-factor sign-in adds an available control to the sign-in workflow.
- Read and write activity is recorded in the described audit evidence.
- Engage campaigns respect recorded consent preferences within the supported workflow.
Roles and contracts
Processing roles, such as controller and processor, depend on the deployment and are set out in the contract. This page states no roles and publishes no data processing agreement. Ask our team for the contractual material that applies and have your own counsel review it. The privacy notice on this website covers how the website handles enquiries. It does not describe how a customer deployment processes patient data.
What your reviewer sees
Your privacy review can inspect access arrangements, audit records and campaign consent settings in the selected products. These records support accountability discussions. They do not establish the lawful basis for every use of data or prove fulfilment of all privacy obligations. Contracts and organisational procedures need review alongside the application.
Separating clinical processing from campaigns
A consent preference used by Engage is not a blanket authorisation for every use of a patient’s information. Your organisation determines the processing arrangements and the responsibilities of the parties. Demonstrate how recorded preferences affect a representative campaign audience, then identify the evidence you need outside the application. Campaigns and retention is an Engage add-on, so a Care subscription alone does not imply it.
What is not established here
Privacy rights handling, deletion, retention automation, processor terms and international transfer arrangements are not established by the features on this page. Encryption and security testing evidence also need confirmation. No GDPR certificate, automatic legal determination or assurance of organisational compliance is claimed.
Official source
Regulation (EU) 2016/679. The legal text is published by the European Union. Obtain qualified review for any legal statement about your own processing.
What we claim, precisely
The system holds the evidence; the facility's accountable person attests. Nothing here asserts that a facility is compliant.
Common questions
-
No. It describes relevant product controls and records, not a legal conclusion. Your organisation must assess processing, contracts, rights handling and the other requirements applicable to its activity.
-
No. Campaign preferences concern the supported communication workflow. They do not establish the basis for clinical processing or every other use of information, which your organisation must assess separately.
-
Automatic erasure and retention workflows are not confirmed here. Agree supported procedures, responsibilities and record-handling requirements before relying on the platform to fulfil a privacy request.
-
A hosting location alone does not establish the arrangements for international transfers. Review access, external services and contractual responsibilities for the deployment rather than assuming the location resolves every privacy question.
-
That depends on the deployment and is set out in the contract. This page states no roles. Agree them with your counsel and with our team before processing patient data.
Not answered here? Contact the team
NXH Flow