Your information should be protected wherever care happens.

UK data-protection standards are Tibacare's baseline. A person's location is not a reason to provide less protection for their personal information.

Requirements connected with the relevant country, person, organisation and service must also be considered. UK standards do not replace applicable local law.

Tibacare is operated by Data Agile Ltd. Data Agile is generally a controller for its own platform purposes, such as accounts, service coordination, security, billing, network administration, clinician verification and Tibacare governance.

Where Data Agile hosts clinical information for a healthcare organisation or an independently practising clinician, it generally acts as a processor for that clinical content and follows the responsible controller's documented instructions.

A healthcare organisation using Clinical Workspace remains responsible for the purposes of its patient and case records. Data Agile hosts and technically manages that information within the agreed service boundary.

Authorised Data Agile personnel may process or access clinical records only where necessary to provide, protect or support the agreed service. That technical responsibility does not give every Tibacare team member access or make Data Agile the clinical decision-maker.

An independent clinician remains responsible for their professional judgement, the clinical content they create and the professional obligations that apply to them.

Being part of Tibacare does not give a clinician access to every patient's information. Clinical Workspace information does not automatically become visible to the Tibacare Specialist Network.

When a specialist is authorised into a case, they receive only the relevant information through the approved clinical or collaboration workflow. The responsible clinical controller decides who should have access and for what clinical purpose; Data Agile enforces that decision technically.

The approved production architecture places core databases, files, backups, logs, authentication and supporting service infrastructure in UK hosting regions, including Azure UK regions where applicable.

UK hosting describes where the core service is hosted. It does not mean authorised people can never access information from another country.

This public website is hosted separately, in Microsoft's West Europe region. Our Privacy Policy explains how the website handles personal information.

International access may occur only where it is necessary for the approved service and the applicable privacy, security, clinical-governance and data-transfer path has been reviewed.

A new country or cross-border clinical-data flow does not go live simply because the technology can support it. Local data-residency or transfer requirements must be addressed before launch.

Clinical information is not sold or used for advertising. Hosting or transmitting it does not authorise unrelated analytics, AI or model training, unrelated product research, or another independent commercial purpose.

Any materially new purpose requires its own role, lawful-basis, sensitive-data, transparency, security, retention, clinical-governance and country review before use.

Tibacare applies role-based access, technical audit controls and defined country and transfer gates. Significant new clinical-data features and material processing changes require a privacy impact screening, followed by a full assessment where the screening shows one is required or appropriate.

These controls are designed to make responsibility and permitted use explicit before access is enabled, rather than relying on broad access after launch.