Overview
AlloScribe is designed to hold as little clinical information as possible, for as short a time as possible. Recordings, drafts and finished reports live on your device. Audio leaves your device only to be transcribed and structured, and it is deleted from our systems once that processing ends.
This page explains what happens to a dictation, what we store, where it is stored and how it is protected. For the legal detail, see our privacy notice and data processing terms.
For patient information in your dictations, your organisation (or you, if you practise independently) is the controller and AlloScribe is the processor. For account and billing data, AlloScribe is the controller.
How a dictation flows
- On your device. While you record, the audio is saved to your device's storage every second. If the page reloads, the tab closes or the app crashes, the recording is offered back to you when you return.
- Upload over TLS. When you choose how to write it up, the audio is uploaded in segments over an encrypted connection (TLS 1.2 or higher).
- Transcription. A speech-to-text provider turns the audio into a transcript, using vocabulary for your specialty.
- Structuring. A large language model organises the transcript into your template or a clean structure, in British English with metric units. Values and measurements are checked against the transcript, and words that could not be heard clearly are marked [unclear].
- Result back. The transcript and the report are returned to your device. The processing service keeps the result for up to 24 hours, only so that a dropped connection can recover it, and then it expires.
- Deletion. The audio is deleted from our systems once processing ends, whether it succeeded or failed. Uploads that are abandoned part way through are swept within a few hours.
Our speech and language providers process audio and text under their own data processing terms. OpenAI may keep API inputs and outputs for up to 30 days to detect abuse unless zero data retention applies to our account: [confirm zero data retention status with OpenAI and Deepgram]. Neither provider may use them to train its models.
Live captions work separately. While you speak, audio is streamed in real time to a caption provider and the words are shown on your screen. Captions are for display only and are not stored.
What we store and where
| Data | Where it is held | How long |
|---|---|---|
| Account data: name, email, phone (optional), professional role and specialty, organisation, settings and templates you create | AlloScribe servers, hosted by [hosting provider and region] | While your account is active. After you delete your account there is a 30-day grace period, then personal data is permanently anonymised. |
| Device and session information | AlloScribe servers | While your account is active, as above. |
| Billing records and credit usage | AlloScribe servers. Card payments are handled by Stripe. | 6 years for tax records (HMRC), kept in anonymised form after account deletion where the law requires it. |
| Audio from a dictation | The transcription service, during processing only | Deleted when processing ends. Abandoned uploads are swept within a few hours. |
| Processing copy of the transcript and report | The processing service | Up to 24 hours, for recovery after a dropped connection, then it expires. |
| Finished reports, drafts, history and recordings | Your device | Until you delete them. They are not stored on AlloScribe's servers. |
| Live captions | Not stored | Shown on screen only. |
| Reports sent to your EMR | Pass through our relay as sealed ciphertext that we cannot read | [relay message retention period] |
| Security logs | AlloScribe servers | [log retention period] |
What stays on your device
The app keeps your recordings, drafts, report history, versions and settings in your browser's storage (IndexedDB and localStorage) or in the desktop or mobile app's storage. This is what lets a recording survive a reload and keeps your reports off our servers.
- On a shared computer, each user's local data is kept separate.
- Your history does not follow you to another device. Export or copy a report if you need it elsewhere.
- Clearing your browser's site data for AlloScribe removes what is stored on that device.
- Protect the device itself: use a screen lock, keep it updated, and follow your organisation's policy on device encryption.
The app also uses strictly necessary cookies to keep you signed in (an access token, a refresh token and a CSRF token). Details are in our cookie notice.
Encryption
- In transit. All traffic between the app and our services uses TLS 1.2 or higher.
- EMR delivery. Reports are sealed on your device with public-key encryption before they leave it. See the next section.
- Passwords. Stored only as hashes, never in plain text.
- At rest on our servers. [encryption at rest: provider and method]
EMR delivery
Organisations can deliver finished reports to their RIS or EMR through an on-premise agent, a Windows desktop application installed by the organisation on its own network. The agent supports HL7 v2 (MDM^T02, and ORU^R01 with accession linkage) and FHIR R4 (DocumentReference, Composition and DiagnosticReport).
Each report is sealed on the clinician's device with public-key encryption (an X25519 sealed box) addressed to the organisation's agent. The AlloScribe relay only routes the ciphertext. It does not hold the key and cannot read the report. Only the agent can open it.
Organisations can also launch AlloScribe from the EMR with SMART on FHIR.
Access control and accounts
- Sign-in is by email and password, with email verification.
- Sessions use JWT access tokens with refresh token rotation. On the web, tokens are kept in httpOnly cookies that page scripts cannot read.
- You can see the devices signed in to your account and sign them out from your profile.
- Uploads are checked for type and size.
- Access to production systems is restricted, and administrative actions are audited.
- Developer documentation endpoints are disabled in production.
- You can delete your account from your profile. After a 30-day grace period your personal data is permanently anonymised.
Infrastructure
AlloScribe's application servers and databases are hosted by [hosting provider] in [hosting region]. Account and service emails are sent through [email provider].
Transcription, structuring and live captions are provided by the subprocessors listed below, some of which process data in the United States.
Subprocessors
These are the providers that process personal data on our behalf.
| Provider | Purpose | Location |
|---|---|---|
| OpenAI, L.L.C. | Speech-to-text and report structuring (language model) | United States |
| Deepgram, Inc. | Live captions (real-time speech-to-text) | United States |
| Stripe Payments UK / Stripe, Inc. | Payments | UK / United States |
| Google (Firebase) | Push notifications | United States / EU |
| [Hosting provider] | Application servers and databases | [Region] |
| [Email provider] | Account and service emails | [Region] |
Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified. Otherwise they use the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment. Enterprise customers can ask us about the data retention settings that apply at each provider.
AI and training
We do not use your recordings or reports to train AI models, and we do not sell personal data. Our AI providers process dictations under data processing terms, only to produce your transcript and report.
AlloScribe is built not to add anything you did not say. It will not add findings, impressions or plans that were not dictated, and a recording with no usable speech is reported as such rather than turned into a note. Read more on our clinical safety page.
Incident response
If we become aware of a personal data breach, we notify the affected controllers without undue delay so they can meet their own obligations. For data we control, we notify the Information Commissioner's Office within 72 hours where the law requires it.
To report a suspected incident, email security@alloscribe.com.
Responsible disclosure
If you believe you have found a security vulnerability in AlloScribe, please email security@alloscribe.com. Include:
- a description of the issue and where it is (the URL, app or component);
- the steps to reproduce it;
- the impact you think it has;
- how we can contact you.
We will acknowledge your report within 2 working days, keep you informed while we investigate, and let you know when it is fixed. Please give us reasonable time to fix the issue before you disclose it publicly.
Safe harbour
We will not take legal action against you for security research carried out in good faith under this policy. That means you:
- only test against your own account or accounts you have permission to use;
- do not access, change or delete other people's data, and stop as soon as you encounter any;
- never include real patient information in testing or in your report;
- avoid degrading the service for other users;
- tell us promptly and keep the details confidential until the issue is fixed.
Out of scope
- Denial of service and load testing.
- Social engineering, phishing and physical attacks against our staff or premises.
- Spam, or flooding our contact addresses.
- Reports from automated scanners without a demonstrated, exploitable impact.
- Missing security headers or best-practice settings with no practical impact.
- Vulnerabilities in third-party services we use, which should be reported to that provider.
- Issues that need a compromised device or browser to exploit.
Certifications and NHS documents
We do not list security certifications on this page. If your organisation needs supplier evidence, for example for a DPIA, a DCB0160 clinical risk assessment, DTAC or the Data Security and Protection Toolkit, email sales@alloscribe.com and we will tell you what is available and share it.
We also provide a UK GDPR data processing agreement. See our data processing terms, and the clinical safety page for our intended purpose and safeguards.