Compliance
Including the parts that are not finished.
Where the data lives, who can read it, what is never collected, and an honest list of what is still outstanding before a real patient should be anywhere near this. It supports your consent discussion; it never replaces it.
Where it lives
London, and nowhere else by accident.
Region is a deployment decision that is easy to get wrong once and then impossible to see. Both halves are pinned.
Database
Neon Postgres, London — aws-eu-west-2.
Application
Vercel serverless functions, pinned to London — lhr1.
In transit and at rest
TLS in transit; encryption at rest, provider-managed.
Controller and processor
The practice is the controller. Candour is the processor, and the console generates the Article 30 record of processing for you to keep.
What is never read
Eight things Candour could take from your practice system and does not.
Not because they are hard to get. Because every field pulled across has to be justified, secured, retained and deleted — and not one of these would make a comprehension check better.
- Clinical notes
- Medical history
- Medications
- Allergies
- Radiographs
- Perio charts
- Correspondence
- Financial records
What is read: identity, the appointment, the planned treatment, the tooth, the diagnosis. That is the whole list, and it is enforced by the import rather than by a policy document.
The identifier rule
A patient is linked by your system’s own patient id, and never by name.
Names change, emails get shared between family members, and dates of birth get mistyped and then fixed. A comprehension record attached to the wrong patient is worse than no record: it is evidence of a conversation that never happened with the person it names.
The record
Append-only, and it says so in the database rather than in a policy.
Sessions, answers, signatures and withdrawals cannot be edited after the fact. The privilege to do it is revoked, and triggers refuse it — so the promise holds even against the application's own code.
Record chain
Verified on every load
- 8f3c1d…a02e7b#1,172 · Sealed 11 Mar
- follows 8f3c1d…a02e7bb71a90…4fd3c2#1,173 · Sealed 12 Mar
- follows b71a90…4fd3c22ce480…91b6da#1,174 · Sealed 12 Mar
Each record stores the hash of the one before it, so altering one breaks every link after it. Tamper-evident, which is not the same as tamper-proof: it shows that something moved, not that nothing ever could.
Sealed record
position 1,174
- Follows
- 8f3c1d…a02e7b
- This record
- b71a90…4fd3c2
- Version
- Dental implant v4 — approved 12 Mar by K. Osei
If you turn on the AI features
What leaves your practice, and what is written down about it.
What is sent
For content drafting: the clinician's own description of the procedure, and where your practice system supplied them, the tooth in words and the plain-English diagnosis. For the assistant: the same practice data the person asking can already see, and nothing they cannot.
What is logged
Every prompt and every completion, in an audit table inside your practice's own row-level security, on the same retention and deletion path as everything else.
What it may never do
Generated content is marked unverified and cannot reach a patient until a clinician approves it. The gate is a database trigger, not a checkbox in the interface.
Where this actually is
Four things done, five things not.
This is the list a practice manager would otherwise have to extract over three phone calls. It is published because the alternative is finding out later, and because a supplier who will not say what is unfinished before you sign is a supplier who will not say it afterwards either.
In the product
Row-level security, per practice
Enforced in the database with FORCE ROW LEVEL SECURITY and a least-privilege runtime role, not in application code. A query that forgets a practice filter returns nothing rather than someone else's patients.
In the product
Append-only audit log
Enforced by database triggers and revoked privileges. Sessions, answers, signatures and withdrawals cannot be edited or deleted after the fact, including by the application.
In the product
Retention and redaction
Fifteen years from completion for an adult by default, and until a minor's twenty-fifth birthday, configurable per organisation. A deletion request produces a redaction with a logged reason and keeps the audit shell — hard deletion is not possible, which the chain requires and a DPIA has to record.
In the product
Article 30 record of processing
Generated from the live configuration and downloadable by an owner or a practice manager, rather than a document written once and left to go stale.
Outstanding
Company registration
Candour is not yet incorporated. Until it is there is no legal person to sign a data processing agreement with, and every item below is downstream of this one.
Outstanding
ICO registration
Not yet registered as a data processor. Practices routinely ask for the registration number during procurement, and they should keep asking.
Outstanding
Data Protection Impact Assessment
Not yet written. It is required rather than advisable here: special-category health data, at scale, with automated processing on clinical context. It has to name the fields that reach a model, the provider, the region and the retention.
Outstanding
Data processing agreement
The console renders a practice-specific template. It is a template, not a legal instrument, until a solicitor has settled the wording.
Outstanding
Clinical sign-off of the content library
No explainer, risk statement or comprehension question has yet been reviewed by a registered clinician. The product will not show unverified content to a patient — the gate is enforced in the database — but a gate can only stop unreviewed content, it cannot judge whether reviewed content is right.
Independent assurance
Nothing here has been checked by anyone but us.
Everything above is our own account of our own product. That is worth something and it is not worth the same as an outside opinion, so the space for one is held open rather than filled with a badge.
Penetration test — reserved
An external security assessment, with the date and the scope.
Fills when a test has been commissioned and the report is in hand. A summary will say what was found, not only that a test happened — a test with no findings published is a test nobody can weigh.
Clinical review — reserved
Who reviewed the content library, their registration, and when.
Fills when a registered clinician has signed off the explainers, the risk statements and the question bank. Until then the product refuses to show any of it to a patient, and this page will not imply otherwise.
Doing supplier due diligence and need something that is not here? Ask. An unanswerable question will get told so.
Read the record for yourself.
The proof screen re-verifies the chain on every load, over illustrative data.