Summary
A recording of a consultation is health data, which UK GDPR treats as special category data and holds to a higher bar than an email address. That single fact drives every question worth asking a scribe vendor.
Six questions settle it. Your lawful basis, whether a data protection impact assessment is needed, the processor agreement, where the data lives, how long it is kept, and whether it trains a model.
None of this is exotic and all of it is answerable in plain sentences. A vendor that reaches for vague reassurance on any of the six is telling you something.
WA\ is built for UK GDPR from the start. Ask us the six questions on a call and hear plain answers.
Book a demoYour lawful basis
Processing health data needs a condition under Article 9 as well as a lawful basis under Article 6. For a clinician documenting care, the provision of healthcare condition usually applies, sitting alongside your duty of confidentiality.
The point is to have named it. A clinic that can state its Article 6 and Article 9 basis for using a scribe has done the thinking. One that cannot has not started.
A data protection impact assessment
Using new technology to process special category data at scale is close to the textbook trigger for a DPIA, and the ICO expects one where processing is likely to be high risk. For most clinics adopting an ambient scribe, completing a DPIA is the safe and correct step.
A good vendor helps you complete it and shares the information you need. A vendor that has never heard the term is a warning in itself.
The processor agreement, residency and retention
The vendor is your data processor, so you need an Article 28 processor agreement setting out what they may do with the data. Then three plain facts. Where the audio and transcript are processed, ideally the UK or EU. How long they are kept, which should be a defined limit, not forever. And who can access them, which should be role-based.
Write the answers down. They belong in your record of processing and in the DPIA.
Does it train a model on your patients
This is the question patients would ask if they knew to. The safe answer is that identifiable consultation data is not used to train models without an explicit, separate and lawful basis, and ideally not at all.
Get it in writing. A default that quietly feeds your consultations into model training is a default you want turned off before the first recording.
How WA\ answers the six
WA\ is built for UK GDPR rather than adapted to it. Processing and retention are set for UK and EU handling, access is role-based, the processor terms are ready, and identifiable data is not used to train models.
We will walk your DPO or practice manager through all six on a call, in plain sentences, which is the standard every vendor should be held to.
Frequently asked questions
Is a consultation recording personal data under UK GDPR?
Yes, and more than that. A recording of a consultation is health data, which UK GDPR classifies as special category data and protects more strictly than ordinary personal data. That is why using an ambient scribe needs a lawful basis under Article 6, a condition under Article 9, and usually a data protection impact assessment before you start.
Do I need a DPIA to use an AI scribe?
In most cases yes. Using new technology to process special category health data at scale is close to the ICO's textbook trigger for a data protection impact assessment. Completing a DPIA before adopting an ambient scribe is the safe and correct step, and a good vendor will give you the information you need to finish it rather than leaving you to guess.
Will an AI scribe use my patients' data to train its models?
It depends entirely on the vendor, which is why you ask before you buy and get the answer in writing. The safe position is that identifiable consultation data is not used to train models without an explicit and separate lawful basis, and ideally not at all. WA\ does not train models on identifiable patient data, and states its UK and EU processing and retention plainly.
Six questions, plain answers.
Thirty minutes with your DPO or practice manager and we will answer all six UK GDPR questions in the open.