Trust & Compliance
Security & data protection
nosht.io/security
Nosht is a clinical documentation tool for UK dental professionals. We take the security of your account data and the integrity of our service seriously. This page explains in plain terms how we protect your data, where it is stored, and the compliance measures we have in place.
Patient data: what Nosht handles and what it does not
Nosht's core clinical-note templates contain no fields for patient names, NHS numbers, dates of birth, addresses, or other patient identifiers — notes hold only clinical descriptors (e.g. "Composite restoration UR6, Class II MO") that you copy and paste into your Practice Management Software (Dentally, SOE, R4, or equivalent). One optional template, the Referral Letter, does provide fields for the patient details a clinician needs to address a referral (name and date of birth, and — if you choose to complete them — NHS number, address, and contact details) so the receiving clinician can register the patient. If you use it, those details are processed under your instruction as Data Controller and handled in line with our Privacy Policy and Data Processing Agreement. Nosht is not a patient record system.
One limited exception: the Send Leaflet feature transmits a patient's email address or mobile number to our delivery provider (Resend for email, Twilio for SMS) solely to send the leaflet you request. Nosht does not keep the address or number itself: it keeps a keyed, one-way code of it for 30 days, to stop repeat sends to the same patient, and then deletes it. A delivery log (leaflet sent, date, method) is retained in your account for your practice records. This delivery log does not itself include patient names.
Another limited exception: the Referral Tracker (referral reminders) stores the patient's initials (two characters), the specialty, referral type, referral and reminder dates, status and an optional short free-text note. Initials combined with clinical detail can be personal data, so please do not enter patient names, dates of birth or NHS numbers, and keep notes brief. This data is processed under your instruction as Data Controller, is kept only while your account is open, and is deleted with your account.
Another optional route: in the mobile app's Finance Hub you can attach a photo of a receipt or of your day list as evidence. These photos are stored in your account. A day list can show patient names, so please cover or crop patient details before you add one.
Because Nosht is a note-drafting tool rather than a connected clinical record system — it does not link to NHS Spine or maintain a structured patient record — we currently treat the NHS Data Security and Protection Toolkit (DSPT) as outside its scope, an assessment we keep under review. We are assessing whether DCB0129 clinical risk management applies to Nosht's AI-assisted drafting and documentation prompts; Nosht does not currently hold a DCB0129 clinical safety case. Where you choose to enter patient details into the optional Referral Letter template, you do so as Data Controller and that data is handled in line with our Privacy Policy. Leaflet delivery contact data is likewise processed under your instruction as Processor; you remain the Data Controller of your patients' contact details. See our Data Processing Agreement for full details.
Where your data is stored
Nosht uses industry-leading cloud infrastructure providers. All subscriber data (account details, preferences, note drafts) is stored in a Supabase-hosted PostgreSQL database.
Database & authentication
Supabase (hosted on AWS)
- SOC 2 Type II certified infrastructure
- Data encrypted at rest using AES-256
- All connections encrypted in transit via TLS 1.2+
- Row-Level Security (RLS) enforced — each user can only access their own data
- Passwords hashed using bcrypt — never stored in plain text
- Infrastructure hosted in AWS eu-west-2 (London, UK)
Payment processing
Stripe
- PCI DSS Level 1 compliant — the highest level of payment security certification
- Nosht never sees, handles, or stores your card number, CVV, or bank details
- We receive only a tokenised reference from Stripe
- All payment pages served directly by Stripe over HTTPS
Web hosting & CDN
Netlify
- All pages served over HTTPS with automatic TLS certificates
- Global CDN with DDoS protection
- No server-side rendering — the application runs entirely in your browser
- Serverless functions (used for Stripe webhooks, the optional AI documentation features, and patient-leaflet delivery) run in isolated environments
Access controls
User-level isolation
Every database query is filtered by your authenticated user ID via Supabase Row-Level Security (RLS) policies. One user cannot access another user's data, even if they manipulate API requests.
Authentication
Nosht supports email/password login, an emailed sign-in link, Sign in with Google and Sign in with Apple. Sessions are issued by Supabase Auth, and the refresh token that keeps you signed in is rotated each time it is used. A session stays signed in on a device until you sign out; there is not yet an automatic inactivity timeout, so sign out on shared computers. Passwords are hashed with bcrypt before storage.
Production access
Access to production infrastructure is restricted to authorised personnel only. The database, hosting and Stripe dashboards are protected by multi-factor authentication, and services connect with scoped API keys. Nosht's in-app admin tools are limited to a small number of named administrator accounts. The admin console is rate-limited; multi-factor authentication for it is being rolled out.
Your browser
Nosht cannot control which browser extensions can read the pages you open. Use a browser profile without shopping or coupon extensions for clinical work, or set each extension's site access to "On click".
No shared tenancy risk
Nosht Solo is a single-user product with no cross-account data visibility. When Nosht Practice launches, practice owners and managers will be able to see clinicians' audit results within their practice, and referrals and significant events recorded for the practice will be visible to its members. Clinicians' notes and drafts will not be shared with the practice, and no data will be visible across practices. See our DPA for details.
Encryption
| Layer | Standard | Details |
|---|---|---|
| In transit | TLS 1.2+ | All data between your browser and our servers is encrypted. HTTPS is enforced on all endpoints with no fallback to HTTP. |
| At rest | AES-256 | All database storage is encrypted at rest using AES-256 via Supabase/AWS managed encryption keys. |
| Passwords | bcrypt | User passwords are one-way hashed using bcrypt. We cannot read, recover, or reverse your password. |
| Payments | PCI DSS L1 | Card data is handled exclusively by Stripe and never touches Nosht servers. |
Breach notification
In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will:
- Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33.
- Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by UK GDPR Article 34.
- Provide clear details of what happened, what data was affected, and what steps we are taking to mitigate the breach.
- Maintain a breach register documenting all incidents, their effects, and the remedial action taken.
Regulatory compliance
UK GDPR & Data Protection Act 2018
ICO registeredNosht is a data controller for your account data and a data processor for the clinical notes, drafts and leaflet-delivery data you create, which can include patient data. Both roles are set out in our Privacy Policy and Data Processing Agreement. ICO registered (ZC186303) · Data stored in London, UK · DPA available. Full GDPR rights are supported including access, rectification, erasure, portability, and objection.
PECR (Privacy and Electronic Communications Regulations)
CompliantStrictly necessary cookies and local storage (authentication session tokens, UI preferences, and a cookie consent acknowledgement flag) are used without consent, as PECR permits. Optional product analytics (Microsoft Clarity and PostHog) are strictly opt-in: they are off by default and load only after you consent via our cookie banner, and you can withdraw consent at any time. We do not use advertising cookies or cross-site advertising networks. See our Cookie Policy for the full breakdown.
NHS DSPT (Data Security and Protection Toolkit)
Not applicableNosht is a note-drafting tool, not a connected clinical record system, and does not link to NHS systems, Spine, or any NHS data infrastructure. Its core templates hold only clinical descriptors; the optional Referral Letter template lets a clinician enter patient details to address a referral, processed under the clinician's instruction. On this basis we currently treat DSPT as not applicable to Nosht's architecture — an assessment we keep under review.
DCB0129 (Clinical Risk Management)
Under assessmentWe are assessing whether DCB0129 applies to Nosht's AI-assisted drafting and documentation prompts. Nosht does not currently hold a DCB0129 clinical safety case.
PCI DSS
Handled by StripeAll payment card processing is handled by Stripe, which is PCI DSS Level 1 compliant. Nosht never sees or stores card data.
Nosht Limited is registered in England & Wales (Company No. 17061341) and registered with the Information Commissioner's Office (ICO registration: ZC186303). Nosht does not currently hold Cyber Essentials certification; Supabase and Stripe, who process data on Nosht's behalf, hold their own independent certifications (see Sub-Processors below). Database infrastructure runs on AWS eu-west-2 (London, UK) with AES-256 encryption at rest and TLS 1.2+ in transit.
Sub-processors
The following third-party service providers process data on our behalf. Each is bound by a Data Processing Agreement incorporating appropriate international transfer safeguards.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Supabase, Inc. | Database, authentication | Account data, preferences, note drafts and completed clinical notes with their edit history (incl. any referral-letter details you enter), leaflet delivery logs, audit results, referral reminders (patient initials, optional short notes), finance records | AWS eu-west-2 (London, UK) |
| Stripe, Inc. | Payment processing | Payment tokens, subscription status (no card numbers) | US/EU |
| Netlify, Inc. | Web hosting, CDN, serverless functions | IP addresses, request logs (standard CDN operation); API request payloads in transit through serverless functions, including clinical note text and Send Leaflet contact details (not stored) | US (global CDN) |
| Resend, Inc. | Transactional email delivery (account emails, patient leaflets, links to notes you choose to email to yourself, and a stored note a Nosht administrator emails to your own address) | Recipient email address, email content. A note you email to yourself is sent as a link, not as note text: we keep a copy of the note for up to 24 hours, and only you can open it, after signing in. A note an administrator emails to you contains the note text, which can include any patient details you entered (e.g. a Referral Letter). UK IDTA/SCCs | US |
| Twilio, Inc. | SMS delivery (patient leaflets) | Recipient mobile number, SMS message body (no patient names or clinical record data) | US |
| Anthropic, PBC | Optional AI documentation features (Claude API) — shorthand pre-fill, mobile quick note (typed), and the advisory Bulletproof completeness check | Typed shorthand (pre-fill and mobile quick note) or the composed clinical note text you have written (completeness check); text only, designed to exclude patient identifiers (an automated check blocks text that appears to contain them but cannot catch everything, so clinicians are told not to type patient names or other identifiers). Under our data-processing arrangement with Anthropic, inputs and outputs are not used to train Anthropic's models; under Anthropic's standard commercial API terms they may be retained for a limited period (up to 30 days) for trust, safety and abuse-monitoring purposes and are then deleted, except where Anthropic is required to retain them for longer to meet legal or safety obligations. | US |
| PostHog, Inc. | Product & funnel analytics (optional — loads only after you opt in via the cookie banner) | Pseudonymous usage events and feature interactions; no patient data or clinical note content | EU (PostHog EU Cloud, Germany) |
| Microsoft Corporation (Clarity) | Session analytics & heatmaps (optional — loads only after you opt in via the cookie banner) | Masked interaction events and session replay (text inputs are masked); no patient data or clinical note content | US |
| Functional Software, Inc. (Sentry) | Error and performance monitoring | Diagnostic error reports and technical context; session replay and user identifiers are consent-gated (off unless you opt in) | EU (Sentry EU region, Germany) |
| Apple Inc. | Sign in with Apple, and App Store in-app purchases in the iOS app | Name and email address (or an Apple private-relay address) for sign-in; Apple ID transaction identifiers and subscription status for purchases; no patient data or clinical note content | US |
Security questions?
If you have questions about our security practices, data handling, or compliance posture, please get in touch. We are happy to provide additional detail.
hello@nosht.ioChanges to this document
These changes take effect on 17 November 2026.
- The email delivery row explains that a note you email to yourself is sent as a link, with a copy kept for 24 hours.
- Sign-in methods and session rules are described.
- The sub-processor table is updated.
- Clinical safety (DCB0129) is shown as under assessment, and the multi-factor authentication statement is narrowed to what we offer.
- Controller and processor roles are explained.