Privacy written for clinical teams, not for filler.
This policy explains what WhiteFieldHealth collects, what role we play in patient data processing, how information is protected, and what rights apply under UK GDPR.
Last updated
February 2026
Clinical data role
Processor for patient data
Primary regime
UK GDPR + Data Protection Act 2018
Privacy snapshot
Clear roles. Clear retention. Clear support.
Trust at a glance
The operating posture before the detailed policy.
The detailed sections below remain the policy source of truth. This opening layer is here to make the practical position easier to scan.
UK GDPR
Lawful-basis and data-subject rights workflows are built into platform operations.
HIPAA-aligned
For US healthcare customers, we support HIPAA-aligned safeguards and contractual controls.
NHS + UK data residency
Clinical data handling aligns with NHS records guidance and UK-hosted processing patterns.
Auditability
Access, updates, exports, and key security events are recorded for governance and review.
Controller and processor roles are separated clearly
WhiteFieldHealth is the controller for account data and the processor for patient and clinical content under the customer DPA.
Clinical data handling is purpose-limited
Patient recordings, transcripts, and notes are processed to deliver the service and to support healthcare documentation workflows only.
UK-hosted processing is the default posture
Patient data is processed and stored in UK-hosted environments unless a customer-specific arrangement explicitly changes that position.
No advertising trackers in the product path
We use essential cookies for service operation and avoid ad-tech or third-party tracking pixels on the public product experience.
Section 1
Introduction & Data controller
WhiteFieldHealth Ltd (“WhiteFieldHealth”, “we”, “us”) is a company registered in England and Wales and the provider of the WhiteFieldHealth AI medical scribe platform (the “Service”).
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, WhiteFieldHealth Ltd is the data controller for account data. For patient and clinical data, your organisation is the data controller and WhiteFieldHealth acts as a data processor under a Data Processing Agreement (DPA).
We are registered with the Information Commissioner’s Office (ICO) under registration number ZB123456. Our privacy team can be contacted at [email protected].
Section 2
Data we collect
We collect and process the following categories of personal data:
- Account data — name, email address, role, specialty, and organisation affiliation provided during registration.
- Audio recordings — consultation recordings uploaded by clinicians for transcription.
- Transcripts — AI-generated text produced from audio recordings.
- Clinical notes — AI-generated and clinician-edited medical documentation.
- Usage data — feature usage, session duration, timestamps, and interaction patterns with the Service.
- Technical data — IP address, browser type, device type, and operating system collected automatically.
- Audit trail data — records of actions taken within the platform, including data access and modifications.
Section 3
Special category data
Clinical notes, transcripts, and audio recordings may contain health data, which is classified as special category data under Article 9 of the UK GDPR. This data is processed under Article 9(2)(h) — processing necessary for preventive or occupational medicine, medical diagnosis, the provision of health or social care, or the management of health or social care systems and services.
A Data Processing Agreement is in place with each customer organisation governing the processing of patient data. Your organisation, as data controller, is responsible for ensuring a lawful basis exists for recording and processing patient consultations.
For US healthcare use cases, WhiteFieldHealth supports HIPAA-aligned safeguards and can provide a Business Associate Agreement (BAA) where required by contract and deployment scope.
Section 4
Lawful bases for processing
We rely on the following lawful bases under Article 6 of the UK GDPR:
| Processing activity | Lawful basis |
|---|---|
| Service provision (transcription, note generation) | Contract — Art. 6(1)(b) |
| Account management | Contract — Art. 6(1)(b) |
| Security monitoring and audit logging | Legitimate interest — Art. 6(1)(f) |
| Service improvement (anonymised analytics) | Not personal data (fully anonymised) |
| Marketing communications | Consent — Art. 6(1)(a) |
Section 5
How we use your data
We use personal data for the following purposes:
- Providing the AI transcription and clinical note generation service.
- Authenticating users and managing account access within your organisation.
- Maintaining audit logs for compliance, security, and clinical governance.
- Improving service reliability and performance through anonymised analytics.
- Communicating service updates, security alerts, and, where consented, marketing.
- Responding to support requests and data subject access requests.
Section 7
International data transfers
All patient data and clinical content is processed and stored within data centres located in the United Kingdom. We do not transfer personal data outside the UK unless required by a specific customer arrangement, in which case we rely on UK adequacy decisions or Standard Contractual Clauses (SCCs) as approved by the ICO under Article 46 of the UK GDPR.
Section 8
Retention
We retain data only as long as necessary for clinical, legal, and operational purposes. Key retention periods include:
- Clinical notes and transcripts: 8 years from last entry (25 years for paediatric or mental health records), aligned with the NHS Records Management Code of Practice 2021.
- Audio recordings: 30 days after transcription completion (configurable per organisation).
- Audit logs: 7 years, in accordance with NHS DSPT requirements.
- Account data: duration of the contract plus 1 year.
For fuller retention detail, see our Compliance page.
Section 9
Your rights
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access (Art. 15) — request a copy of the personal data we hold about you.
- Right to rectification (Art. 16) — request correction of inaccurate data.
- Right to erasure (Art. 17) — request deletion where there is no compelling reason for continued processing.
- Right to restrict processing (Art. 18) — request that we limit how we use your data.
- Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format.
- Right to object (Art. 21) — object to processing based on legitimate interest.
- Rights related to automated decision-making (Art. 22) — request human review of decisions made solely by automated processing.
To exercise any of these rights, contact our support team at [email protected]. We will respond within 30 calendar days.
Section 11
Security measures
We implement layered technical and organisational measures to protect personal data and clinical content across account, API, and infrastructure boundaries.
Administrative
Least-privilege access, documented incident response, and role-based approvals.
Technical
AES-256 at rest, TLS 1.3 in transit, secure session controls, and hardened API boundaries.
Clinical governance
Patient-data handling aligned with healthcare workflow controls and retention policy.
Breach response
Escalation and notification procedures aligned to applicable GDPR and UK obligations.
Controls include AES-256 encryption at rest, TLS 1.3 encryption in transit, role-based access controls, multi-factor authentication support, regular penetration testing, and immutable audit logging.
For fuller detail on our security posture, see our Security & Compliance page.
Section 12
Children’s data
The Service is not directed at children. However, clinical notes may relate to paediatric patients. Such data is processed under the healthcare lawful basis (Article 9(2)(h)) and is subject to extended retention periods in line with NHS records management guidance: 25 years from date of birth or 8 years after death if the child dies before age 18.
Section 13
Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to account holders and posted on this page at least 30 days before taking effect. The “Last updated” date at the top of this page indicates the most recent revision.
Section 14
Contact and complaints
If you have questions about this policy or wish to exercise your data protection rights, contact our support team:
Email: [email protected]
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been infringed:
Need a specific answer?
Ask the privacy question directly.
Contact us for privacy requests, onboarding due-diligence questions, or supporting compliance documentation.