Summary
Ask four things in writing. Where the recording and the transcript are stored and for how long, whether your consultations are used to train models and whether that can be switched off, who inside the vendor can read a patient record and how that is logged, and what happens to your data on the day you leave. A vendor that will not answer these on paper has answered them.
A recorded consultation is special category health data under UK GDPR, and the practice remains the controller of it. The vendor is a processor, which means the obligations do not transfer with the audio. Whatever the contract says, the regulator's conversation is with the clinic.
That makes procurement a short list of written answers rather than a demo. The questions below are the ones that change what a clinic is signing, and most of them are answered in a sentence by a vendor who has thought about them and in a paragraph by one who has not.
Nothing here is legal advice. It is the set of questions we would want answered about any product holding our own patients' consultations, including ours.
See it in your clinicAsk us these and we will answer in writing before a demo rather than after it.
Request a demo| Ask | A good answer looks like | Walk away if |
|---|---|---|
| Where is the audio stored | A named region, with the sub-processors listed | They cannot name the region |
| How long is it kept | A stated retention period you can shorten | Retained indefinitely by default |
| Is it used to train models | No, or yes with a switch you control | Yes, with no way to opt out |
| Who inside can read a record | A named role, access logged and auditable | Support can read anything, unlogged |
| Is there a DPA and a DPIA | Both offered without being asked | A DPA only on request |
| What happens if we leave | Export in a usable format, deletion certified | Export as PDF only, or a fee |
| Who is liable for a wrong note | The clinician signs, and they say so plainly | The contract implies the tool is responsible |
Storage and retention
Ask where the audio lives, where the transcript lives, and whether those are the same place. They frequently are not. Then ask for the sub-processor list, because the answer to where your data is held is really the answer to whose infrastructure it passes through on the way.
Retention is the question most vendors answer loosely. A default of keeping the recording forever is common and it is rarely necessary, since the clinical record is the note rather than the audio. Ask what the shortest retention period on offer is, whether you can set it, and whether deleting a patient in your system deletes the audio behind it.
Our guide to UK GDPR for ambient scribes works through the lawful basis and the DPIA in full.
Training on your consultations
This is the question with the widest range of honest answers, and the one where the wording matters most. Ask whether consultations are used to train or fine tune models, whether that includes de-identified data, and whether it includes human review of recordings for quality.
All three can be reasonable and all three need to be disclosed. A vendor that improves its models on de-identified transcripts with an opt out is in a different position from one whose staff listen to identifiable audio without saying so.
Ask for the answer as a contract clause rather than a page on the website, because a website changes without telling you. Then ask what happens to the setting if you are acquired, or if they are.
Who can read a patient record
Every system has a support path, and the question is what that path can see. Ask which roles can read a patient record, whether access requires a ticket, whether the clinic is notified, and whether every read is logged in a way you can audit later.
The answer worth having is a named role, logged access, and a log you can request. The answer worth walking away from is that support can open anything and nothing is recorded, which is surprisingly common and rarely volunteered.
Ask the same of the AI provider behind the product. A scribe built on somebody else's model inherits that company's access posture along with its capability.
Consent and the patient
GMC guidance treats a recording of a patient as part of their care, so the patient should understand the consultation is being recorded and be able to decline easily. Ask the vendor how declining works in their product, and what happens to a consultation where consent is withdrawn halfway through.
A product with no answer to the second question has not been built by people who have sat in a clinic. The recording has to stop, the partial audio has to go, and the clinician needs to know it has gone without leaving the room.
Our guides to patient consent for scribes and GMC guidance cover the duties in detail.
Regulatory status
Ask plainly whether the product is a registered medical device, and if the answer is no, ask why the vendor believes it is not one. A transcription tool that summarises is usually outside the definition; one that suggests a diagnosis or a dose is usually inside it.
The right answer is a clear position the vendor will put in writing, not a claim of certification that turns out to describe a different product in the range. Ask for the UKCA or CE certificate number if one is claimed, and check what it covers.
Our note on MHRA medical device status sets out where the line sits.
Leaving
The exit terms are the easiest thing to negotiate before signing and the most expensive afterwards. Ask what format your notes and letters come out in, whether the export includes the structured fields or only a rendered document, and what it costs.
Then ask for deletion in writing. A certificate of deletion covering the audio, the transcripts and the backups, with a date, is a reasonable thing to require and an unreasonable thing to refuse.
Ask what the price is in year two. A rate that is only guaranteed for the first term is a rate that will be renegotiated at the moment walking away has become expensive.
Our own answers
We answer these in writing before a demo rather than after one. Consultations are not used to train models, retention is set by the clinic, access to a patient record is a named role and every read is logged, and the export is the structured record rather than a rendered file.
We are not a registered medical device and we do not claim to be. The note is a draft, the clinician is the author, and nothing reaches a patient without a person approving it.
A clinic that asks us these questions and does not like an answer should say so. The answers are the product as much as the software is.
Put these questions to us on a call, and we will send the answers in writing afterwards.
Request a demoFrequently asked questions
What should I ask an AI scribe vendor about data retention?
Ask where the audio and the transcript are each stored, for how long, whether you can shorten the period, and whether deleting a patient in your system deletes the audio behind them. Ask for the sub-processor list too, because where your data is held is really the question of whose infrastructure it passes through.
Can an AI scribe train on my patients' recordings?
Some do. Ask whether consultations are used to train or fine tune models, whether that includes de-identified data, and whether staff listen to recordings for quality review. All three can be reasonable and all three must be disclosed. Get the answer as a contract clause rather than a website page, because a website changes without telling you.
What access controls should a scribe vendor have?
A named role rather than general staff access, access tied to a ticket, the clinic notified, and every read logged in a form you can audit. Ask the same of the AI provider behind the product, because a scribe built on somebody else's model inherits that company's access posture.
Who is the data controller for a recorded consultation?
The practice. A recorded consultation is special category health data under UK GDPR and the clinic remains the controller, with the vendor acting as processor. The obligations do not transfer with the audio, which is why the questions above are the clinic's to ask.
Should an AI scribe be a registered medical device?
It depends what it does. A tool that transcribes and summarises is usually outside the definition. One that suggests a diagnosis or a dose is usually inside it. Ask the vendor for its position in writing, and if certification is claimed, ask for the number and check which product in the range it covers.
What exit terms should I agree before signing?
The export format, whether it includes structured fields or only rendered documents, what it costs, and a certificate of deletion covering audio, transcripts and backups with a date. Also ask what the price becomes in year two, because a rate guaranteed only for the first term will be renegotiated when walking away has become expensive.
What happens if a patient withdraws consent mid consultation?
The recording should stop, the partial audio should be deleted, and the clinician should be able to see that it has gone without leaving the room. A vendor with no answer to this has not built the product with people who have sat in a clinic.
Sources
Ask us the same questions
Fifteen minutes on your workflows. If it is a fit we reply within 24 hours.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits