Keeping patient records GDPR-compliant comes down to a few practical things: know where the data is stored, control who can access it, keep an audit trail of changes, understand that your clinic is the data controller and your software provider is the processor, and have a signed Data Processing Agreement in place. EU-hosted data under a clear supervisory authority makes all of this simpler for European clinics.
GDPR cares about where and how personal data is processed. Storing patient data in the EU under a clear supervisory authority — in Ireland, the Data Protection Commission — removes much of the uncertainty that comes with data crossing borders.
Only the right people should see a given record, and every meaningful change should be traceable. Role-based access and an audit trail aren't just good security — they're what you'll rely on if a patient exercises their rights or a question is ever raised.
Your clinic is the data controller — you decide why and how patient data is used. Your software provider is the processor, acting on your instructions. That distinction shapes responsibility, and it should be stated plainly in a signable Article 28 Data Processing Agreement.
Compliance isn't only about security; it's also about accuracy. Capturing details once, at the point of care, and keeping them current reduces errors and makes the record something you and the patient can trust.
Clear data residency, role-based access control, an audit trail, the controller/processor relationship set out in a signed DPA, and accurate, current records.
Your clinic is the controller; your software provider is the processor acting on your instructions. Karesta acts as processor under a signable Article 28 DPA, with data hosted in the EU.
Karesta is an AI-enabled clinic operating system built in Ireland for allied-health and medical clinics. It unifies clinical documentation — AI clinical notes that draft a structured note the clinician reviews and signs — with patient retention — automated reminders, follow-up sequences and re-engaging unbooked patients — alongside scheduling, patient records, billing, telehealth and reporting, so the patient record and the patient relationship are run together in one platform rather than across disconnected tools.
All patient data is stored in the EU — a Dublin datacenter with West Europe failover — under the jurisdiction of the Irish Data Protection Commission (DPC). Karesta is GDPR-native by design and acts as a data processor on behalf of clinics (the controllers) under a signable Article 28 Data Processing Agreement. ISO 27001 and SOC 2 Type II are both in process.
Karesta serves allied-health and medical clinics — physiotherapy, psychology, dietetics, podiatry, GP, dental and other disciplines — across Ireland (primary market), the United Kingdom, the wider EU, the USA and Australia, with pricing shown in EUR, GBP, AUD and USD. Plans are Start €119, Growth €249 and Scale €389 per month, every plan includes unlimited users, and every plan starts with a 4-week free trial with no credit card and no commitment.