1. Data Controller
| Contact name | Alastair Hetherington |
| Contact email | [email protected] |
| Application | Dental Notes Assistant |
| Applicable law | UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 |
Your dental practice is the data controller for all personal data processed through the Dental Notes Assistant. This privacy policy explains what data we collect, how we process it, who we share it with, and your rights.
2. What Data We Collect
The Dental Notes Assistant processes the following categories of personal data:
This application processes special category data (health data) under Article 9 of the UK GDPR. The legal basis for processing is set out in Section 4 below.
| Clinical transcripts | Voice-dictated or typed dental consultation notes which may contain patient identifiers (e.g. name, date of birth, NHS number, contact details) and clinical observations. Direct patient identifiers are automatically detected and replaced with placeholders prior to AI processing (pseudonymisation), reducing exposure of identifiable information. |
| Audio recordings | Temporary voice recordings captured during live dictation for speech-to-text conversion. Audio is processed transiently and deleted immediately after transcription. |
| Staff credentials | Usernames, bcrypt-hashed passwords, and optional multi-factor authentication (MFA) secrets used for secure clinician access. |
| Session data | Firebase Authentication tokens stored in browser localStorage, used to authenticate API requests. No session cookies are set by the application server. |
| Audit logs | Timestamps, usernames, IP addresses, and system activity logs retained for security monitoring, regulatory compliance, and incident investigation. |
3. How Your Data Is Processed
The Dental Notes Assistant uses the following processing pipeline to generate clinical notes, emails, and letters:
| Step | What happens | Data exposed |
|---|---|---|
| 1. Input | The clinician types or dictates a transcript into the application. When dictation finishes, the transcript is automatically saved to the application’s transcript database so it can be reviewed in the History page, and is deleted after 48 hours. | Full transcript, including any patient identifiers it contains (held in the clinician’s browser session and in the 48-hour transcript database). |
| 2. Transcription | If voice dictation is used, audio is streamed securely to Speechmatics’ EU endpoint (eu2.rt.speechmatics.com) for real-time speech-to-text conversion with speaker diarization. Audio files uploaded for batch transcription are processed at Speechmatics’ EU endpoint (eu1.asr.api.speechmatics.com) under the same no-retention terms. Model improvement is opted out. Audio is processed transiently in-memory and automatically deleted within seconds. | Temporary audio stream (not stored). |
| 3. Pseudonymisation (PII Protection) | The transcript is sent to Google Cloud DLP (europe-west1, Belgium), where direct patient identifiers are automatically detected and replaced with pseudonymous placeholders (e.g. [PERSON_NAME_1], [DATE_1]). | Full transcript → pseudonymised transcript. |
| 4. AI processing | The pseudonymised transcript is sent to Google Vertex AI (Gemini 2.5 Flash) in europe-west1 (Belgium) to generate structured clinical notes, emails, or letters. The pseudonymisation step is designed to minimise the identifiable patient data received by the AI model. | Pseudonymised text only. |
| 5. Re-identification and Output | The AI-generated output is returned to the secure application server, where placeholders are re-mapped to original values and the final result is displayed to the clinician within their browser session and saved alongside the transcript for 48 hours. | Re-identified clinical text (browser session and the 48-hour transcript database). |
The system supports clinicians but does not make autonomous clinical decisions; all outputs are reviewed and approved by a qualified clinician before use. The clinician remains fully responsible for all clinical decisions and patient records.
4. Legal Basis for Processing
| Ordinary personal data | Legitimate interests (Article 6(1)(f)) — efficient, secure, and accurate clinical documentation in the course of providing dental care, balanced against the rights and freedoms of patients. |
| Health data (special category) | Provision of health care (Article 9(2)(h)) read with the Data Protection Act 2018, Schedule 1, Part 1, Paragraph 2(2)(f) — processing necessary for the management and delivery of health care services by a health professional subject to confidentiality obligations. |
| Patient consent | Although the primary legal basis is not consent, patients are informed about AI-assisted clinical documentation via the practice privacy notice and, where applicable, explicit patient consent may be obtained as an additional transparency and ethical safeguard. Clinical care is not solely dependent on automated processing. |
5. Third-Party Data Processors
We use the following third-party processors to support the operation of the Dental Notes Assistant. All processing of patient data — transcription, pseudonymisation, and AI note generation — takes place within the EU/UK adequacy area (United Kingdom and/or European Economic Area). A small number of processors that handle clinician account and billing data only, and never patient data, are located outside that area; these are identified in the table below and are covered by Standard Contractual Clauses. Transfer Impact Assessments (TIAs) have been completed where required, and Data Processing Agreements (DPAs) are in place with each processor.
| Processor | Purpose | Location | Data received | Safeguards |
|---|---|---|---|---|
| Google Cloud DLP | Detection and pseudonymisation of personal identifiers | europe-west1 (Belgium, EU) | Transcript text (temporarily processed to detect and replace identifiers before AI processing) | EU processing, no retention, encryption in transit (TLS), Google Cloud DPA |
| Google Vertex AI | AI-assisted clinical note formatting | europe-west1 (Belgium, EU) | Pseudonymised transcript only (no directly identifiable patient data) | EU processing, no model training on customer data, encryption in transit, Google Cloud DPA |
| Speechmatics | Real-time and batch speech-to-text transcription with speaker diarization | EU (eu2.rt.speechmatics.com for live dictation; eu1.asr.api.speechmatics.com for uploaded audio files) | Temporary audio stream (processed in-memory and deleted within seconds) | EU regional endpoints for both live and uploaded audio, model improvement opted out, no audio retention, encryption in transit (TLS), Speechmatics DPA |
| Google Cloud Storage | Persistent storage of application settings, uploaded practice documents, and audit logs | europe-west1 (Belgium, EU) | User settings, staff accounts, practice assets (logos, signatures, leaflets, price lists, clinical reference images), and audit logs. No patient clinical records or transcripts are stored here. | AES-256 encryption at rest, EU residency, bucket mounted privately to the application with no public access, Google Cloud DPA |
| Google Cloud Run | Application hosting and secure request processing | europe-west1 (Belgium, EU) | Encrypted application traffic only (no persistent patient data storage) | Serverless architecture, no persistent state, TLS/HTTPS enforced, Google Cloud DPA |
| Firebase Authentication | User identity verification and session management | europe-west1 (Belgium, EU) | User email address and authentication credentials (no patient clinical data) | Encryption in transit (TLS), multi-factor authentication support, Google Cloud DPA |
| Firebase Firestore | Secure database storage of user settings, engagement records, and billing data, and short-term storage of clinical transcripts and generated notes in a separate dedicated database | europe-west1 (Belgium, EU) | User account data and application settings. Additionally, in a separate dedicated database: clinical transcripts (including the original dictated text, before pseudonymisation) and the notes generated from them, together with the clinician's username and account identifier. These are saved automatically as each note is produced and are deleted 48 hours after saving. | AES-256 encryption at rest, EU residency, role-based access controls, automatic 48-hour deletion of transcripts, Google Cloud DPA |
| Loops.so | Transactional and engagement email delivery to registered clinicians | United States (standard contractual clauses in place) | Clinician email address, engagement tier, and subscription status only (no patient clinical data) | Encryption in transit (TLS) and at rest (AES-256), opt-out honoured, Loops DPA with Standard Contractual Clauses (SCCs) for international transfers, governed by Irish law |
| Stripe | Subscription billing, payment processing, and management of the customer billing portal | Republic of Ireland and United States (Stripe Payments Europe, Ltd.) | Clinician email address, internal account identifier, and subscription and payment records (no patient clinical data) | PCI DSS Level 1 certified, card details entered directly with Stripe and never received or stored by this application, encryption in transit (TLS) and at rest, Stripe DPA with Standard Contractual Clauses (SCCs) for international transfers |
No patient data is used to train any AI model. Google Vertex AI's data processing terms explicitly prohibit the use of customer data for model training.
6. Personal Identifiers Detected and Pseudonymised
Google Cloud DLP is configured to detect and pseudonymise the following identifier types before any data is processed by the AI model.
Detected identifiers are replaced with structured placeholders to reduce exposure of directly identifiable information while preserving clinical context where required.
| Identifier type | Example placeholder |
|---|---|
| Person name | [PERSON_NAME_1] |
| Phone number | [PHONE_NUMBER_1] |
| Email address | [EMAIL_ADDRESS_1] |
| Date of birth | [DATE_OF_BIRTH_1] |
| Date | [DATE_1] |
| Street address | [STREET_ADDRESS_1] |
| Location | [LOCATION_1] |
| NHS number | [UK_NHS_NUMBER_1] |
| National Insurance number | [UK_NI_NUMBER_1] |
| Age | [AGE_1] |
| Generic ID | [GENERIC_ID_1] |
Pseudonymisation reduces the likelihood of direct identification but does not constitute full anonymisation under UK GDPR. The system therefore continues to treat processed data as personal data and applies appropriate technical and organisational safeguards.
7. Data Retention
| Audio recordings | Deleted within seconds of transcription by Speechmatics. No audio is stored by the application. |
| Transcripts in browser | Exist only within the clinician’s secure browser session and are cleared on page refresh, tab close, or after 1 hour of inactivity. |
| Saved transcripts | Each transcript is saved automatically — once when dictation finishes and again when notes are generated from it — so the clinician can review it in the History page. Saved copies include the original dictated text prior to pseudonymisation, along with the notes generated from it. Retained for a maximum of 48 hours from saving, then automatically deleted. Clinicians may delete a saved transcript sooner from the History page. |
| AI-generated notes | Exist only within the browser session and are not persistently stored by the application. |
| Authentication tokens | Firebase Auth tokens stored in browser localStorage. ID tokens expire after 1 hour (auto-refreshed). Session persists until logout or browser storage is cleared. |
| Audit logs | Retained for 2 years for regulatory compliance, security monitoring, and incident investigation, then automatically purged. |
| Staff credentials | Stored until the associated user account is deleted by an administrator. |
The application processes and retains only the minimum personal data necessary for clinical documentation. Core processing occurs in-memory where possible, and all retained data is subject to strict automated deletion schedules aligned with its purpose.
8. Security Measures
The following technical and organisational measures protect your data:
| Encryption in transit | All data transmitted over TLS/HTTPS with HSTS enforced (Strict-Transport-Security header, 1-year max-age) |
| Encryption at rest | Google Cloud Storage applies AES-256 encryption to all stored data, including application settings, uploaded practice documents, and audit logs. User account, engagement, and billing records held in Google Cloud Firestore, and the clinical transcripts held for up to 48 hours in a separate dedicated Firestore database, are likewise encrypted at rest with AES-256. Both are located in europe-west1 (Belgium, EU). |
| Authentication | Passwords are managed and secured by Firebase Authentication (Google). Optional multi-factor authentication (TOTP) is available to all users. |
| Session security | Authentication is handled by Firebase Auth. Signed ID tokens (RS256 JWTs) are verified server-side on every request. Tokens expire after 1 hour and are automatically refreshed by the Firebase SDK. |
| Rate limiting | Maximum 5 failed login attempts within 15 minutes, followed by a 15-minute account lockout. Failed attempts logged. |
| Security headers | Strict Content Security Policy (CSP), X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy (strict-origin-when-cross-origin), Permissions-Policy, HSTS, X-XSS-Protection. |
| Access control | Role-based access control (admin/user) with least-privilege enforcement. Administrative functions restricted to authorised users. |
| Automatic data clearing | Browser session data cleared after 1 hour of inactivity. Saved transcripts automatically deleted after 48 hours. Sessions expire after 24 hours. |
| EU data residency | All processing occurs within the EU/UK adequacy area (primarily europe-west1, Belgium). No patient data is transferred outside the EU/UK without appropriate safeguards. |
9. Cookies
This application does not set any HTTP cookies. Authentication is managed entirely by Firebase Authentication, which stores session tokens in browser localStorage rather than cookies. This storage is strictly necessary for the operation of the service and does not require user consent under the Privacy and Electronic Communications Regulations (PECR).
| Storage mechanism | Browser localStorage (not a cookie) |
| Purpose | Store Firebase Auth tokens to authenticate the logged-in clinician across page navigations |
| Type | Strictly necessary (essential) |
| Duration | Persists until logout or browser storage is cleared. ID tokens expire after 1 hour and are automatically refreshed. |
No analytics, tracking, advertising, or marketing cookies are used. No cookies of any kind are set by the application server.
10. Your Rights Under UK GDPR
Under the UK GDPR (Articles 15–22), you have the following rights in relation to your personal data:
- Right of access (Article 15) — Request a copy of the personal data we hold about you.
- Right to rectification (Article 16) — Request correction of inaccurate or incomplete data.
- Right to erasure (Article 17) — Request deletion of your personal data where there is no lawful reason for continued processing.
- Right to restrict processing (Article 18) — Request that we limit how we use your data in certain circumstances.
- Right to data portability (Article 20) — Receive your data in a structured, commonly used, machine-readable format where applicable.
- Right to object (Article 21) — Object to processing carried out on the basis of legitimate interests where applicable.
- Rights related to automated decision-making (Article 22) — The Dental Notes Assistant does not make automated clinical decisions. All AI-generated content is reviewed and approved by a qualified clinician before use.
To exercise any of these rights, please contact the practice using the details below. We aim to respond to all data subject requests within one calendar month as required by the UK GDPR. Where necessary, identity verification may be required before fulfilling certain requests to protect personal data.
Patient Consent (Transparency Safeguard)
The primary legal basis for processing clinical data is the provision of health care under UK GDPR Article 9(2)(h).
Where applicable, explicit patient consent may be obtained as an additional transparency safeguard for the use of AI-assisted note-generation. Patients may request that manual note-taking is used instead.
11. Complaints
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
Live chat: ico.org.uk/livechat
We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact the practice in the first instance using the details provided above.
In the unlikely event of a personal data breach, the practice will follow its incident response procedures and, where required, notify the Information Commissioner’s Office (ICO) and affected individuals in accordance with UK GDPR.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our processing activities, technology, legal obligations, or regulatory guidance.
Where changes are significant, we will take reasonable steps to inform patients, which may include notification at their next appointment, updates on our website, or direct communication where appropriate.
The current version number and effective date are shown at the top of this policy. Previous versions may be made available on request.
13. Contact Us
Email: [email protected]
For any data protection enquiries, including requests to exercise your data protection rights (such as access, rectification, erasure, restriction, or objection), please contact us using the email address above and include the subject line “Data Protection Request.”
We aim to respond to all legitimate requests within one calendar month in accordance with the UK General Data Protection Regulation (UK GDPR). Where permitted by law, we may request proof of identity before processing certain requests to protect personal data.
If you have concerns about how your data is handled, please contact us first so we can investigate and resolve the matter.