GDPR checklist for longevity clinic software (2026)
Use this checklist when you compare software for a longevity clinic that treats patients in the EU. It is a buyer's checklist, not legal advice. The right-hand column shows what Neogenic states on its GDPR page.
Send the left-hand column to every vendor on your list and ask for written answers. Vague answers on roles, transfers or AI training are the ones to follow up.
The checklist
| Ask the vendor | What Neogenic states |
|---|---|
| Who is controller and who is processor? | The clinic is the controller. Scality Ltd is the processor under Article 28 and acts only on documented instructions. For the hand-over of a report that the clinic releases to the patient portal, the clinic and Scality Ltd are joint controllers |
| Is there a Data Processing Agreement? | Clinics accept the DPA when they create their clinic account |
| Where is data stored? | Databases and files in Stockholm, application servers in Frankfurt |
| Is there a subprocessor list and notice period? | Yes. At least 14 days' notice to add or replace a subprocessor, with a right to object |
| Are there transfers outside the EU? | A few supporting services, such as email delivery, use providers outside the EU. Standard Contractual Clauses apply |
| Where does AI run, and is it used for training? | Runs on Amazon Bedrock in the EU when switched on. Bedrock writes no prompt or response to lasting storage, apart from one narrow exception described on our subprocessor list, and keeps only a short-lived cache to answer faster. The model's maker never receives them, and they are never used to train models |
| Is AI labelled as AI? | Neo is always shown as AI |
| Is data encrypted? | In transit and at rest |
| How is access controlled? | Role-based access with two-step sign-in for every staff member. Each clinic's data is kept separate |
| Can vendor staff see records? | Not by default. Opening a clinic and revealing an assistant conversation in the admin console are logged |
| What about backups? | Daily backups, each kept up to 8 days |
| How fast is breach notice? | Without undue delay and within 48 hours of becoming aware |
| How are patient rights handled? | Clinics find and correct data in Neogenic. Export or full erasure of one person's data is done by Neogenic on the clinic's request. Requests sent to Neogenic are passed to the clinic |
Items for the clinic itself
- Decide the legal basis for processing health data.
- Check whether your use of AI and health data needs a data protection impact assessment.
- Train staff on access and consent.
- Set retention periods for records.
- Tell patients where their data is stored and who processes it.
Your vendor should give you what you need for your own impact assessment. For Neogenic, that is the GDPR page, the Data Processing Agreement and the subprocessor list.
How other vendors answer
Healthie's security page says it is GDPR-compliant.[1] Pabau says it is designed for the GDPR in the UK and EU.[2] Reya.ai claims GDPR compliance.[3] Semble lists the GDPR on its trust centre.[4] LongevAI says it complies with the GDPR and the Dutch UAVG.[5] OptiMantra and Cerbo do not mention the GDPR on the pages we read. Ask each vendor for its DPA, subprocessor list and hosting regions.
For data location only, see EU-hosted longevity clinic software. For what the platform does with that data, see Neogenic's longevity clinic software.
Frequently asked questions
Is GDPR compliance a feature of software?
No. Software can support compliance, but the clinic stays responsible for how it uses data.
Where can we read the Neogenic DPA?
Neogenic publishes its Data Processing Agreement and its subprocessor list on its website, linked from the GDPR page.
Does Neo use our data to train models?
No. Prompts and Neo's responses are never used to train models, and the model's maker never receives them.
Which documents should a vendor send us?
A Data Processing Agreement, a current subprocessor list, the hosting regions for data and for AI, and its breach notice terms.
Is this checklist legal advice?
No. It is a buyer's checklist. Ask your own data protection adviser about your clinic's obligations.
Sefy Tofan is the founder of Neogenic and wrote this guide. Read more about Neogenic.
Facts about other vendors were checked on their own websites on 23 October 2026.
