Who we are
AlloScribe is a clinical dictation and reporting service for clinicians in the United Kingdom.
This notice explains how we process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. It applies to our website, the web application at app.alloscribe.com, our desktop and mobile apps, our browser extension and our on-premise EMR agent.
For any question about this notice or your personal data, contact us at privacy@alloscribe.com. You can reach our [Data Protection Officer or privacy lead: name or role] at the same address.
Our two roles
Data protection law treats us differently depending on whose data we are handling and why.
- We are the controller for account, billing and usage data about the clinicians and staff who use AlloScribe, and for data about people who visit our website or contact us. We decide how and why that data is used, and this notice explains it.
- We are a processor for patient information and other personal data contained in dictations, transcripts and reports (which we call "clinical content"). For that data, the clinician's organisation is the controller, or the clinician is, if they practise independently. We process clinical content only on their documented instructions, under our Data Processing Agreement.
If you are a patient, please read Information for patients below.
What we collect and where it comes from
Account data
When you create an account or are added to an organisation, we collect:
- your name, email address and, if you choose to give it, your phone number;
- your professional role and specialty, and your organisation;
- your password, which we store only in hashed form;
- details of the devices and sessions signed in to your account;
- templates you create, your letterhead details (such as logo, practice details and registration number for the signature block) and your settings;
- billing records and credit usage; and
- messages you send us and records of support requests.
Most of this comes from you. Some comes from your organisation, for example when an administrator invites you or assigns you a seat. Payment confirmations come from Stripe. If you use an optional sign-in service, we receive basic details from that provider.
Usage data
We record how the service is used, such as feature use, errors and credit consumption, so that we can run, secure and improve it. We use this in aggregate and it does not include clinical content.
Clinical content
When you record a dictation, the audio, and the transcript and report produced from it, may contain information about patients, including health data. We process this as a processor, as described under Clinical content.
Website visitors
Our marketing website does not use analytics or advertising cookies. Fonts on the website are loaded from Google Fonts, which means your IP address is sent to Google when the fonts load. See our Cookie and storage notice.
How we use it and our lawful bases
This table covers the data for which we are the controller.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and running your account, verifying your email, signing you in and providing the service | Account data, device and session data | Contract (Article 6(1)(b)) |
| Managing organisations, members, seats and shared credits | Account data, credit usage | Contract (Article 6(1)(b)); for members added by an organisation, our and the organisation's legitimate interests (Article 6(1)(f)) |
| Selling credits, taking payment and keeping accounting records | Billing records, credit usage | Contract (Article 6(1)(b)); legal obligation for tax and accounting records (Article 6(1)(c)) |
| Sending service emails, such as verification, security alerts, receipts and account deletion confirmations | Name, email address | Contract (Article 6(1)(b)) |
| Keeping the service and accounts secure, detecting misuse and investigating incidents | Device and session data, security logs, usage data | Legitimate interests (Article 6(1)(f)): protecting our users, patients and service |
| Improving the service | Aggregate, non-clinical usage data | Legitimate interests (Article 6(1)(f)): making the product work better |
| Answering enquiries and providing support | Contact details, messages | Legitimate interests (Article 6(1)(f)); contract where you are a customer |
| Marketing emails | Name, email address | [confirm whether marketing emails are sent; if so, consent or the soft opt-in under PECR, with an unsubscribe link] |
| Complying with the law, responding to regulators and handling legal claims | Any relevant data | Legal obligation (Article 6(1)(c)); legitimate interests (Article 6(1)(f)) |
Where we rely on legitimate interests, we have balanced our interests against your rights. You can object to this processing (see Your rights).
For clinical content, the lawful basis is the controller's. For health and care providers this is typically Article 6(1)(e) or 6(1)(f), together with Article 9(2)(h) (the provision of health or social care) and Schedule 1, paragraph 2 of the Data Protection Act 2018. We do not decide these purposes ourselves.
Clinical content: how dictations are handled
We have designed AlloScribe so that clinical content spends as little time as possible on systems other than your own device.
- While you record, the audio is saved to your device (in browser storage or the app's storage) every second, so that a recording survives a page reload, closed tab or crash.
- Audio is uploaded over an encrypted connection (TLS) in segments and transcribed by a speech-to-text provider. It is held only while it is being processed and is deleted once processing ends, whether processing succeeds or fails. Uploads that are abandoned part-way are swept within a few hours.
- The transcript and the generated report are produced by a large language model and returned to your device. The processing service keeps the result only briefly, for up to 24 hours, so that it can be recovered if your connection drops. It then expires.
- Finished reports, drafts and history are stored on your device, not on our servers. On shared devices this data is kept separately for each signed-in user.
- Exports (PDF, Word or copied text) are created on your device and go wherever you choose to save or send them.
Our speech and language providers process audio and text under their own data processing terms. OpenAI may keep API inputs and outputs for up to 30 days to detect abuse unless zero data retention applies to our account: [confirm zero data retention status with OpenAI and Deepgram]. Neither provider may use them to train its models.
Because finished reports are kept on your device, we cannot retrieve them for you if your device is lost or its storage is cleared. Please export and file reports in your organisation's record system.
Live captions
If live captions are switched on, the audio is streamed in real time to our caption provider, and the words appear on your screen as you speak. Captions are for display only. They are not stored by us, and the report itself is produced separately from the full recording.
EMR delivery
If your organisation uses our on-premise EMR agent, an approved report is sealed on your device using public-key encryption, addressed to your organisation's agent, before it leaves the device. Our relay only routes the sealed message. We do not hold the key and cannot read the report. Your organisation's agent opens it and delivers it to your EMR or RIS.
No AI training, no sale of data
We do not use recordings, transcripts or reports to train artificial intelligence models. We do not sell personal data.
Who we share it with
We use the following providers (subprocessors) to deliver the service. Each acts on our instructions under a written contract that requires it to protect the data.
| Provider | Purpose | Location |
|---|---|---|
| OpenAI, L.L.C. | Speech-to-text and report structuring (language model) | United States |
| Deepgram, Inc. | Live captions (real-time speech-to-text) | United States |
| Stripe Payments UK / Stripe, Inc. | Payments | UK / United States |
| Google (Firebase) | Push notifications | United States / EU |
| [Hosting provider] | Application servers and databases | [Region] |
| [Email provider] | Account and service emails | [Region] |
Stripe may also act as an independent controller for some payment data, for example to prevent fraud and meet its own legal obligations. Its privacy notice is available on its website.
We may also share personal data:
- with your organisation, where it administers your account (for example, member lists, seats and credit usage);
- with professional advisers, such as lawyers, accountants and insurers, under a duty of confidence;
- with the police, regulators, courts or other public bodies where the law requires it or where it is needed to protect someone's vital interests; and
- with a buyer or successor if our business is sold or reorganised, in which case this notice will continue to apply to your data.
International transfers
Some of our providers are in the United States. When personal data is transferred outside the UK, we protect it by one of the following:
- the UK Extension to the EU-US Data Privacy Framework, where the provider is certified under it;
- otherwise, the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.
Transfers to the European Economic Area rely on UK adequacy regulations. You can ask us for more information about the safeguards for a particular provider at privacy@alloscribe.com. Enterprise customers can also ask about our providers' data retention settings.
How long we keep it
| Data | How long we keep it |
|---|---|
| Account data (profile, templates, settings, device and session records) | While your account is active. If you delete your account, there is a 30-day grace period during which you can cancel. After that, your personal data is permanently anonymised and your templates and activity are deleted. |
| Billing and tax records | 6 years, as required by HMRC. After account deletion, the minimum records required by law are kept in anonymised form. |
| Audio recordings on our systems | Only while being processed. Deleted once processing ends, whether it succeeds or fails. Abandoned uploads are swept within a few hours. |
| Transcripts and reports on our processing service | Up to 24 hours, so that a dropped connection can recover the result. Then they expire. |
| Recordings, drafts, reports and history on your device | Under your control. They stay on the device until you delete them, sign out and clear data, or clear the browser or app storage. |
| Live captions | Not stored. |
| Sealed EMR messages on our relay | Encrypted end to end; we cannot read them. [relay retention period for delivered and undelivered messages] |
| Security logs | [log retention period] |
| Support and enquiry correspondence | [support correspondence retention period] |
We may keep data for longer where we need it to establish, exercise or defend a legal claim, or where the law requires it.
Security
We protect personal data with measures appropriate to its sensitivity, including encryption in transit (TLS 1.2 or higher), hashed passwords, short-lived access tokens with refresh rotation, httpOnly cookies on the web, separation of local data between users on shared devices, checks on the type and size of uploads, restricted production access and an audit trail of administrative actions. Read more on our Security page.
If a personal data breach affects data for which we are the controller, we will notify the ICO within 72 hours where required, and tell affected individuals where the law requires it. If it affects clinical content, we will notify the controller without undue delay so that it can meet its own obligations.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and receive a copy;
- rectification of data that is inaccurate or incomplete;
- erasure of your data in certain circumstances. You can delete your account yourself from your profile;
- restriction of processing in certain circumstances, for example while we check the accuracy of data;
- object to processing based on legitimate interests, and to direct marketing at any time;
- data portability: to receive data you gave us, in a structured, machine-readable format, where processing is based on contract or consent and carried out by automated means;
- withdraw consent at any time, where we rely on consent. This does not affect processing already carried out; and
- not be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. We do not make any such decisions.
Some rights have exceptions. If we cannot meet a request in full, we will explain why.
How to exercise your rights
Email privacy@alloscribe.com and tell us which right you want to exercise. We may need to confirm your identity before we act, usually by asking you to reply from the email address on your account.
We will respond without undue delay and within one month of receiving your request. If a request is complex, or you have made several, we may extend this by up to two further months and will tell you why within the first month. We do not charge a fee unless a request is manifestly unfounded or excessive.
Many changes can be made directly in the app: you can edit your profile, sign out devices, export reports and delete your account.
Recordings, drafts and reports held on your device are under your control, and we do not hold copies of them on our servers. If you ask us for clinical content, we will explain this and help where we can. Requests about patient information in clinical content are handled by the controller (your organisation, or you if you practise independently). If we receive such a request directly, we will pass it to the controller and help them respond.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at privacy@alloscribe.com. We will acknowledge your complaint within 30 days and respond without undue delay. Our Complaints procedure explains the process.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or by phone on 0303 123 1113. The ICO will usually expect you to have raised the complaint with us first.
Information for patients
Your clinician may use AlloScribe to dictate a report or note about your care, for example after a scan or a consultation. AlloScribe turns their dictation into a draft, which they check, correct and approve before it becomes part of your record.
For this information, your clinician's organisation (such as your hospital, clinic or practice, or the clinician if they work independently) is the controller. It decides how your information is used and is responsible for telling you about it, for example in its own privacy notice. AlloScribe processes the information only on its behalf, under contract, and only to produce the draft.
If you have questions about your records, or want to exercise your rights (for example to see your records), please contact the organisation that provided your care first. It is best placed to help, because the finished report is held in its systems, not ours. If you contact us, we will pass your request to the organisation and help it respond.
If your clinician uses AlloScribe during a video consultation with system sound switched on, your voice may form part of the recording. That recording is processed in the same way as any other dictation, as described above. Your clinician's organisation sets the local policy on telling patients about recording.
Children
AlloScribe is a professional service for healthcare professionals and authorised staff, and is not intended for anyone under 18. We do not knowingly create accounts for children. If you believe a child has given us personal data, contact privacy@alloscribe.com and we will delete it.
Clinical content may include information about patients who are children. That information is processed on behalf of the controller in the same way as all other clinical content.
Changes to this notice
We will update this notice when our processing changes, for example if we add a subprocessor. The date at the top of the page shows when it was last updated. If we make a material change, we will tell account holders by email or in the app before it takes effect.