Key points
- Your account data is about you, and your patients' notes are data you control, which the vendor processes on your instruction.
- Under UK GDPR, requests to correct or erase personal data must be answered without undue delay and within one month.12
- At the end of the service, the vendor must delete or return all patient data at the clinician's choice, and delete existing copies unless law requires storage.3
- In the US, a covered entity must act on a patient's request to amend their record within 60 days, with one 30-day extension.4
- On wai, notes and records can be exported, and signed notes and letters go into any system you keep.56
Summary
Your patient notes can be exported at any time, errors corrected within the legal time limit, and all patient data returned or deleted when the service ends. Export into the record you keep first, because medical records usually have to be retained, then instruct the vendor to delete its copies.
Settle your data rights on day one and your record moves with you, and you leave any vendor on a date you choose. The law already gives you both, and the steps below write them into your contract.
See it in your clinicThirty minutes on your own patients and doctors.
Request a demoSee a signed note and letter exported from wai, and the event log that records it, in fifteen minutes with a clinician who uses it daily.
| Request | Who asks | Who acts | Time limit | First practical step |
|---|---|---|---|---|
| Correct the clinician's own account data | Clinician | Vendor | One month under UK GDPR | Name the field and the correct value in writing |
| Correct a patient's note, UK | Patient | Clinician, with the vendor on instruction | One month under UK GDPR | Add the correction and tell anyone who received the original |
| Amend a patient's record, US | Patient | Covered entity | 60 days, one 30-day extension | Grant, or deny in writing with the right to disagree |
| Erase a patient's record | Patient | Clinician | One month to respond | Check retention duties first, as health records are usually exempt |
| Export all notes and letters | Clinician | Vendor | Agree it in the contract | Run a test export before going live |
| Return or delete all patient data on exit | Clinician as controller | Vendor as processor | As set in the processor contract | Export first, then request written confirmation of deletion |
Your account data and your patients' notes
Your account, templates and usage history are data about you, with the same rights any individual has.
Your patients' notes and letters are data you control. A self-employed clinician is usually the controller, and the AI vendor is a processor acting on your instructions.8 Inside a clinic, the clinic is usually the controller and you act through it.
You ask the vendor to correct your own profile. A patient asks you to correct their note, and you instruct the vendor to change it.
Correcting a record
Article 16 of UK GDPR gives individuals the right to have inaccurate personal data rectified and incomplete data completed, sometimes by a supplementary statement.1 A request can be made verbally or in writing and must be answered without undue delay and within one month.1
The ICO expects a process for telling recipients when shared data is corrected.1 A corrected note may need a corrected letter, sent to whoever received the first one.
In the US, a covered entity must act on a patient's amendment request within 60 days, may extend once by up to 30 days with written reasons, and may deny where the record is accurate and complete.4 A patient whose request is denied can file a statement of disagreement, which is linked to the record.4 Add the correction with its date and keep the original entry.
Erasure, and where it stops
The UK GDPR right to erasure must be answered within one month, and it does not apply where processing is needed to meet a legal obligation or for legal claims.2
For health data it also does not apply where processing is necessary for diagnosis or the provision of care by a professional bound by secrecy.2 The ICO's own example is a healthcare provider that can refuse to erase a former patient's records because its liability insurance requires them to be kept.2
You can always delete your account and require the vendor to delete everything it holds, once every signed record is in the system you keep for the retention period.
What the vendor owes at the end
Article 28 of UK GDPR requires the processor, at the controller's choice, to delete or return all personal data after the service ends and to delete existing copies unless law requires storage.3 The processor must also provide the information needed to show compliance and allow for audits.3
Before the first consultation is recorded, get the export format, the retention period after cancellation and a written confirmation of deletion, backups included, into the contract. Moving vendors is covered in how to switch AI scribe without losing records.
Exporting and leaving on wai
On wai, notes and records can be exported, and plans are billed monthly and cancelled in settings, effective at the end of the period.5 Signed notes and letters export into any system, so the record you sign sits wherever you keep records.6
The clinic can export an event log of every message, draft, approval and signature, and subprocessors are named with thirty days notice before any change.7 wai hosts each clinic's records in its own country, under that country's rules. We set this up with your clinic.
Where to start
This week, export one signed note and one letter, open them in the system where you keep records, and check nothing is missing.
Then write a one-page data plan naming the controller, what each vendor processes, the export format, the retention period and the exit deletion terms. Keep it with the contract, review it once a year, and your record stays yours whatever software you use.
Ask us to export a test note and letter in the demo. We show the file, where it goes and how deletion works.
Frequently asked questions
Who owns the patient notes made with an AI scribe?
Can a patient make a clinician delete their notes?
Usually not in full. Under UK GDPR, erasure does not apply where health data is processed for diagnosis or care by a professional bound by secrecy, or where records must be kept for legal reasons.2 Requests must still be answered within one month.
How quickly must a correction be made?
What happens to the data when a clinician cancels?
The processor must return or delete it at the controller's choice and delete existing copies unless law requires storage.3 Agree the timing and a written confirmation in the contract.
Can notes from wai go into another system?
Does a correction overwrite the original note?
Add the correction with its date and keep the original entry, so the record shows what changed.
Sources
- 1Information Commissioner's OfficeRight to rectificationRead 14 October 2026Read source
- 2Information Commissioner's OfficeRight to erasureRead 14 October 2026Read source
- 3legislation.gov.uk, 2016UK GDPR Article 28, ProcessorRead 14 October 2026Read source
- 4Legal Information Institute, Cornell Law School45 CFR 164.526, Amendment of protected health informationRead 14 October 2026Read source
- 5wai, 2026AI medical scribe for independent cliniciansRead 14 October 2026Read source
- 6wai, 2026IntegrationsRead 14 October 2026Read source
- 7wai, 2026Security at waiRead 14 October 2026Read source
- 8Information Commissioner's OfficeWhat are controllers and processorsRead 14 October 2026Read source
Your record, yours wherever you take it.
Fifteen minutes on video with a clinician who uses wai daily, including a live export. We reply within one working day.
Partner with us
See it on your own patients, then build it with us
Thirty minutes on your own patients, doctors and rules, in your market. We reply within one working day, and the clinics that partner with us early shape what we build next.
See what wai does between the visits