GDPR and patient data — ruling out software for the wrong reasons?

gdpr and patient data handling is a real consideration when you're evaluating software for a clinical setting. we've had to rule out a few platforms just because we couldn't get a straight answer about where the data is stored or how it's processed. are there booking tools that are genuinely clear about their data practices, or is this something you have to dig for every time?