1. About this agreement
1.1 This Data Processing Agreement (the "DPA") sets out the terms on which AlloScribe processes personal data on behalf of its customers. It forms part of our Terms of Service (the "Terms") and applies automatically whenever a customer uses AlloScribe to process personal data for which it is the controller.
1.2 Organisations that need a signed copy for their records or procurement process can request one (see section 16). A signed copy contains the same commitments, and may be supplemented by an order form.
1.3 In this DPA, "controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the UK GDPR. "Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended (including by the Data (Use and Access) Act 2025).
2. Parties and roles
2.1 The parties are:
- the Customer: the healthcare organisation, practice or independent clinician that has accepted the Terms, acting as controller; and
- AlloScribe, acting as processor.
2.2 This DPA covers personal data in clinical content: the audio, transcripts and reports that the Customer's users create with AlloScribe ("Customer Personal Data").
2.3 AlloScribe is a controller, not a processor, for the account, billing and usage data of the Customer's users. That data is covered by our Privacy notice, not this DPA.
3. Details of the processing
3.1 The processing is described in the table below.
| Item | Details |
|---|---|
| Subject matter | Providing the AlloScribe clinical dictation and reporting service to the Customer. |
| Duration | For as long as the Customer uses the service under the Terms, and afterwards only until Customer Personal Data is deleted under section 12. Individual items are held only briefly, as set out in section 3.2. |
| Nature | Receiving audio over encrypted connections; speech-to-text transcription; structuring the transcript into a draft report or note with a large language model; returning the result to the user's device; real-time transcription for live captions; routing reports sealed with public-key encryption to the Customer's EMR agent. |
| Purpose | To produce draft reports and notes from what the Customer's clinicians dictate, for those clinicians to review, edit and approve, and to deliver approved reports to the Customer's systems. |
3.2 AlloScribe holds Customer Personal Data on its systems only for as long as needed:
- audio is held on our systems only while it is processed and is deleted from them once processing ends, whether it succeeds or fails. Abandoned uploads are swept within a few hours;
- transcripts and reports are kept by the processing service for up to 24 hours so that a dropped connection can recover them, and then expire;
- live caption audio is streamed in real time and not stored; and
- reports sent through the EMR relay are sealed on the user's device to the Customer's agent, and AlloScribe cannot read them.
3.3 Finished reports, drafts and history are stored on the user's device, under the Customer's control, and not on AlloScribe's servers.
4. Data subjects and categories of data
4.1 The data subjects and categories of personal data are set out below.
| Data subjects | Categories of personal data |
|---|---|
| Patients | Any information the clinician dictates, which may include identifiers (such as name, date of birth, hospital or NHS number) and special category data concerning health, including clinical history, examination and imaging findings, and plans. Where the clinician records a video consultation with system sound, the patient's voice. |
| Customer staff (clinicians and authorised users) | Voice recordings of dictation, and any names, roles or registration numbers included in reports. |
| Other individuals mentioned in dictations | Such as relatives, carers or other clinicians: whatever information the clinician dictates about them. |
4.2 The Customer decides what its users dictate. Users should include only the information needed for the report.
5. Documented instructions
5.1 AlloScribe will process Customer Personal Data only on the Customer's documented instructions, including with regard to international transfers, unless required to do otherwise by UK law. In that case AlloScribe will tell the Customer of the legal requirement before processing, unless the law prohibits this on important grounds of public interest.
5.2 The Terms, this DPA and the Customer's use and configuration of the service are the Customer's complete instructions. Further instructions must be in writing and consistent with the Terms.
5.3 AlloScribe will tell the Customer promptly if, in its opinion, an instruction infringes Data Protection Law.
5.4 AlloScribe will not use Customer Personal Data for its own purposes, will not use it to train artificial intelligence models, and will not sell it.
6. Confidentiality
6.1 AlloScribe will ensure that everyone it authorises to process Customer Personal Data is bound by a duty of confidentiality, whether contractual or statutory, and has access only to the extent needed for their role.
7. Security
7.1 AlloScribe will implement appropriate technical and organisational measures to protect Customer Personal Data, as required by Article 32 of the UK GDPR, taking into account the nature of the data and the risks to data subjects. These include:
- encryption in transit using TLS 1.2 or higher;
- minimising retention, so that audio is deleted once processed and results expire within 24 hours;
- end-to-end sealing of EMR deliveries with public-key encryption (X25519 sealed box), so that the relay handles only ciphertext;
- hashed passwords, short-lived access tokens with refresh rotation and httpOnly cookies on the web;
- per-user separation of local data on shared devices;
- type and size checks on uploads;
- restricted production access and an audit trail of administrative actions; and
- documentation interfaces disabled in production.
7.2 Our Security page describes these measures in more detail. AlloScribe may update its measures, provided that the overall level of protection is not reduced.
8. Subprocessors
8.1 The Customer gives general written authorisation for AlloScribe to engage subprocessors. The current subprocessors are:
| Provider | Purpose | Location |
|---|---|---|
| OpenAI, L.L.C. | Speech-to-text and report structuring (language model) | United States |
| Deepgram, Inc. | Live captions (real-time speech-to-text) | United States |
| Stripe Payments UK / Stripe, Inc. | Payments | UK / United States |
| Google (Firebase) | Push notifications | United States / EU |
| [Hosting provider] | Application servers and databases | [Region] |
| [Email provider] | Account and service emails | [Region] |
8.2 Stripe, Firebase and the email provider process account and billing data rather than clinical content. They are listed here so that the Customer has a complete view of AlloScribe's providers.
8.3 AlloScribe will give the Customer at least 30 days' prior notice of any intended addition or replacement of a subprocessor, by email to the Customer's account owner and by updating this page. The Customer may object on reasonable data protection grounds within that period. If the parties cannot resolve the objection in good faith, the Customer may terminate the affected part of the service and receive a refund of any unused Credits it bought.
8.4 AlloScribe will impose on each subprocessor, by written contract, data protection obligations that provide at least the same level of protection as this DPA, and remains liable to the Customer for each subprocessor's performance of those obligations.
9. Assistance
9.1 Taking into account the nature of the processing, AlloScribe will assist the Customer by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects exercising their rights. If AlloScribe receives such a request directly, it will pass it to the Customer without undue delay and will not respond itself except to confirm that it has been passed on.
9.2 Because finished reports are stored on users' devices and not on AlloScribe's servers, most requests can be met by the Customer from its own records and devices.
9.3 AlloScribe will provide reasonable assistance with the Customer's obligations under Articles 32 to 36 of the UK GDPR, including data protection impact assessments and prior consultation with the ICO. For NHS organisations, we will support information governance and clinical safety teams with the supplier information needed for a DPIA and a DCB0160 clinical risk assessment. Contact sales@alloscribe.com for our documentation.
10. Personal data breaches
10.1 AlloScribe will notify the Customer of a personal data breach affecting Customer Personal Data without undue delay, and in any case within 48 hours of becoming aware of it.
10.2 The notification will, as far as the information is available, describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed to address it. Information not available at first may be provided in phases.
10.3 AlloScribe will take reasonable steps to contain and investigate the breach, and will cooperate with the Customer so that it can meet its own obligations, including notifying the ICO within 72 hours where required and informing data subjects.
11. International transfers
11.1 Some subprocessors process data in the United States. AlloScribe will transfer Customer Personal Data outside the UK only where an appropriate safeguard is in place:
- the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified; or
- otherwise, the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.
11.2 On request, AlloScribe will provide information about the safeguard used for each subprocessor and, for enterprise customers, about the data retention settings that apply at each provider.
12. Deletion and return
12.1 At the end of the service, AlloScribe will delete Customer Personal Data held on its systems, unless UK law requires it to be kept. Because audio is deleted once processed and results expire within 24 hours, little or no Customer Personal Data remains on AlloScribe's systems at any time.
12.2 Reports, drafts and history are held on users' devices, so the Customer keeps them without needing a return from AlloScribe. The Customer is responsible for exporting reports it needs to keep into its records before users remove the apps or clear their device storage.
12.3 On request, AlloScribe will confirm in writing that deletion has taken place.
13. Audits and information
13.1 AlloScribe will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR and this DPA, including answers to reasonable security questionnaires.
13.2 Where that information is not sufficient, AlloScribe will allow and contribute to audits, including inspections, by the Customer or an independent auditor it appoints who is bound by confidentiality. The Customer must give at least 30 days' written notice, audits are limited to once in any 12-month period (unless required by a regulator or following a personal data breach), and must be conducted during normal business hours in a way that does not disrupt the service or compromise the security of other customers' data. Each party bears its own costs.
14. Customer obligations
14.1 The Customer is responsible for:
- having a lawful basis, and a condition under Article 9, for the processing of Customer Personal Data;
- providing transparency information to patients and following local policy on informing patients and on recording consultations;
- carrying out any data protection impact assessment and clinical risk assessment it needs before deployment;
- making sure its instructions comply with Data Protection Law; and
- securing the devices its users use and the computer that runs its EMR agent.
15. Liability
15.1 Each party's liability arising out of or in connection with this DPA is subject to the exclusions and limitations of liability in section 18 of the Terms. Nothing in this DPA limits either party's liability to data subjects under Article 82 of the UK GDPR, or any liability that cannot be limited by law.
15.2 This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
16. Requesting a signed copy
16.1 To request a signed copy of this DPA, or to discuss organisation-specific terms, email legal@alloscribe.com. For NHS procurement and organisation accounts, you can also contact sales@alloscribe.com.
16.2 Please include your organisation's legal name, address and the name and role of the person who will sign.