EU hosting
Client data in Reach + Within is hosted in the EU (Netherlands) for UK and South African customers, and encrypted in transit with TLS.
Security, POPIA and UK GDPR
Client data, protected by design
Client data hosted in the EU, locked down by role and logged end to end, with consent built into recording.
Built inside a working rehab running across two registered facilities, where it holds up to special audit reviews by the relevant authorities.
Standard in every plan
Role-based access
Per-user logins. PA and accounts users can't open clinical notes.
Audit trail nobody can edit
A record of who viewed or changed what, and when. In Within every export, download, record view, edit, sign-in and role or permission change is logged, and Reach logs every export and download, record views and role changes. Entries are chained so tampering shows, and nobody can edit or delete them.
Personal logins
Every user has their own login. Two-step sign-in with an authenticator app, and Microsoft sign-in, are available now, including on a trial account.
Secure family report links
Families and referrers see approved reports only, behind a separate access code, with lockout after failed attempts.
Recording consent
The client's recording choice is kept on their file, and recording and voice-to-text follow it.
Revocable calendar feeds
Private calendar feeds show client initials only, and can be revoked at any time.
Consent first. The clinician always signs.
- The client's consent to recording is recorded on their file.
- Transcription is done by a named sub-processor, listed in our sub-processor list.
- Assist drafts; the clinician reviews, edits and signs. Assist does not diagnose.
POPIA (South Africa)
- You are the responsible party; we act as your operator.
- Information officer contact on request.
- Cross-border transfer to the EU, which has adequate data protection laws.
- Support for data subject requests.
UK GDPR
- You are the controller; we are your processor.
- Data processing agreement on request.
- Sub-processor list on request.
- Breach notification, retention and export when you leave.
What we do and do not claim
Reach + Within is built to help you meet your obligations under POPIA and UK GDPR. Compliance also depends on how your practice uses it: your policies, consent and access decisions stay with you. We do not claim certifications we do not hold. If your organisation needs a specific assurance, ask us and we will answer in writing.
Documents
For our data processing agreement template and sub-processor list, email info@reachwithin.app.
Join the waitlist.
Reach + Within is in private development. Join the waitlist and we will email you when it opens.