The GDPR-Compliant Video Conferencing API for Telehealth

Yes. Video consultations involve special-category data under GDPR Article 9, so Digital Samba operates as your processor under an Article 28 data processing agreement, keeps all session and application data inside the EU/EEA, and gives you control over recording, retention and deletion. You remain the controller and set the lawful basis for each use. 

All application and session data is stored inside the EU/EEA – production in the Netherlands and across the EU, with backups in Germany, on infrastructure owned and operated by European companies. No session or application data is stored outside the EU/EEA. On-premises deployment offers the strongest single-country residency guarantees. 

Digital Samba's standard EU service is built for GDPR and EU data residency and is not operated under a HIPAA Business Associate Agreement (BAA). Customers with HIPAA obligations have two options: US-based infrastructure hosted with a HIPAA-eligible provider, or an on-premises deployment, which gives you full control of the environment and lets you execute a BAA with your own infrastructure provider. For EU and UK telehealth, GDPR and EU data residency are usually the relevant requirement – contact us to discuss HIPAA deployment options. 

Yes. Digital Samba is fully white-label. You embed the video room in your own platform, patient portal or EHR front end via an iframe and the JavaScript SDK, under your own brand and domain, and connect it to scheduling, billing and records through the API and webhooks. 

Yes, optionally. With end-to-end encryption (AES-256-GCM), only the session participants can decrypt audio, video, screen share, chat and whiteboard content. Note that end-to-end encryption and server-side features such as cloud recording and transcription are mutually exclusive by design, so you enable it for the sessions that need maximum confidentiality.

Digital Samba's AI captions, transcripts and summaries are optional and under your control. From 2 August 2026 the EU AI Act requires you to inform participants when AI is in use; because the features are switchable per room, you can turn them on only where you have a lawful basis and have met your transparency obligations. 

Those are powerful video APIs where you typically build the interface, recording and compliance yourself, often on US-headquartered infrastructure. Digital Samba is a managed, EU-hosted embedded API: you get a prebuilt, white-label room and GDPR-by-design compliance in days, with all data kept in the EU/EEA.