Your patients’ data, kept close.
Held in London. Two-step sign-in for everyone. Every view logged. And if you leave, you get all of it back.
Last updated 24 October 2026. Every promise here is in the data processing agreement each practice signs.
Who can see it
Each person sees what their job needs.
Everyone has their own account
Passwords of 12 characters or more, checked against lists of common ones.
A code from their phone
At every sign-in. Accounts lock after repeated wrong attempts.
Roles, not free access
Clinicians see their own round and area. Only the office sees sales totals.
Sessions end on their own
After 2 hours idle, 12 hours at most. The office can sign anyone out everywhere.
A lost phone, wiped
The day’s round is kept for working offline, and deleted on sign-out.
Every view logged
Who opened or changed which record, and when. No patient details in system logs.
If something goes wrong
You hear from us first, and fast.
24 h
If there is ever a personal data breach affecting your practice, we tell you within 24 hours of knowing, with what we know, and keep you updated.
Who handles the data
Six companies, and exactly what each one sees.
We give you 30 days’ written notice before adding or changing one, and you can object.
Supabase London
The database.
Fly.io London
Runs the Domi server.
Twilio EU and US
Sends texts, only if you switch texts on.
Resend Ireland
Sends staff invitations, resets and enquiry replies.
openrouteservice Germany
Works out driving times.
postcodes.io UK
Finds where a postcode is.
Supabase, Fly.io, Twilio and Resend are US companies. Data that leaves the UK is protected by the safeguards in each one’s data processing terms, such as the UK International Data Transfer Addendum.
If you leave
You leave with everything. We keep nothing.
- 0
Subscription ends
For any reason: your choice, or ours.
- 14
Full export
Your practice’s data, handed back within 14 days.
- 30
Deleted, in writing
Gone from Domi and its backups within 30 days, confirmed to you.
Before then, the office can export or erase any single patient’s record, and download reports, visits, sales and invoices as spreadsheets at any time.
Where we stand
New, small, and straight with you about it.
These two are in progress. They’ll show here once they’re in place. Until then, everything on this page is written into your agreement, and we’ll answer any security questionnaire you send.
Cyber Essentials
The UK government’s certification for basic cyber security.
Working towardsNHS Data Security and Protection Toolkit
The NHS’s own check that a supplier handles data properly.
Working towardsWant the paperwork first?
Ask for the data processing agreement before you decide. It’s the same one every practice signs. Found a security problem? Email yameen@ysbdesigns.uk, and please don’t test it on live patient data.