Technical details

Access to PracticePal is via a 256 bit Secure Socket Layer (SSL) certificate, and fully password protected at all times. All passwords are encrypted and salted. Through normal use, no data is downloaded to a client machine or leaves the firewalled server (unless the client chooses to download their own copy of the database backup). All our software is password protected and is hosted on RackSpace servers within the EU. Our dedicated servers reside in RackSpaces’ world-class data centres, with hardware RAID 10 storage, ECC memory, and fully redundant networking and power all the way to the host. The hardware is fully redundant, hot swappable and behind dedicated hardware and software firewalls. All data is automatically backed up, and then that backup is also backed up to a different physical location (within the EU) hosted by a separate data hosting company. RackSpace guarantee that the services will be available at least 99.9% of the time in any given monthly billing period, and we have actually achieved 100% to date.

Data retention

We take security extremely seriously and any information we hold about our customers, and in turn their clients is stored on password protected software. It can only be accessed by staff that have been trained and that require access, i.e. support, technical development and administrative staff. Each staff member has their own login credentials. We do not share this information with any third party and we do not keep information on past customers or about people who ask us to delete the data we hold about them.

GDPR

On 25th May 2018 the new EU GDPR regulations officially become enforceable. The regulations will be put in place regardless of  Brexit negotiations, and we are aware of the huge effect this will have on PracticePal as a product, as a product provider, and on our customers.

We started investigating the new regulations in September 2017, and have been actively working with our staff and a number of advisors to gain a full understanding of the implications, and create a number of action plans for what we will be doing to ensure we are compliant with GDPR, pre May 25th. We also hope to offer as much support as possible to our customer base in providing their own GDPR compliance.

Please note that we will advise our user where possible, and provide tools, where possible, to enable GDPR compliance to our users, our role as the data processors is standalone, meaning the data controllers (software users) will need to manage their own internal investigations in line with GDPR, as to ensure their compliance.

Our internal policy document on how we’ve adapted for GDPR is available to all existing customers, on request, or can be found via the internal help system.