Hi Scribe Privacy Policy
eConsult Health Limited | Version 1.0 | March 2026
eConsult Health Limited (“eConsult”, “we”, “us”, “our”) is committed to protecting the privacy of individuals whose data is processed when Hi Scribe is used. This privacy notice explains how personal data – including health data – is handled during the use of Hi Scribe, an AI-assisted consultation note-taking tool.
Hi Scribe is used by clinicians during patient consultations to transcribe the conversation and produce a draft clinical summary. This notice is relevant to patients whose consultations are recorded using Hi Scribe.
This notice does not cover: data processed by your GP practice through other systems, or data processed by eConsult in connection with the wider eConsult platform. Separate privacy notices apply to those services.
This notice is provided in a layered format. Use the section links below to navigate to the area most relevant to you.
Contents
1. Who is responsible for your data
2. What data Hi Scribe processes
3. How Hi Scribe collects your data
4. How and why your data is used
5. Who your data is shared with
6. International transfers
7. Data security
8. Data retention
9. Your rights
10. How to contact us and make a complaint
1. Who is responsible for your data
Your GP practice is the Data Controller
The GP practice using Hi Scribe is the Data Controller for your personal data. They decide whether to use Hi Scribe and are responsible for ensuring it is used lawfully. Questions about how your practice uses your data should be directed to your practice in the first instance.
eConsult’s role
eConsult Health Limited is the Data Processor. We operate Hi Scribe on behalf of your GP practice and process your data only on their instructions. We do not use your data for our own purposes.
Full legal name: eConsult Health Limited
Registered address: 13th Floor, Millbank Tower, 21-24 Millbank, London SW1P 4QP
Company number: 07628675 (registered in England and Wales)
Privacy contact: privacy@econsult.health
eConsult is part of the Huma Group (Huma Therapeutics Limited). We hold UKAS-accredited ISO 27001 certification and meet NHS Data Security and Protection (DSP) Toolkit standards.
Data Protection Officer: privacy@econsult.health
You have the right to make a complaint to the Information Commissioner’s Office (ICO) at any time (www.ico.org.uk). We would, however, appreciate the opportunity to address your concerns first – please contact us at privacy@econsult.health
2. What data Hi Scribe processes
When Hi Scribe is used during your consultation, the following personal data is processed:
- Audio of your consultation (voice only; no video)
- A live transcript of the conversation between you and your clinician
- An anonymised version of that transcript (produced before any AI summarisation takes place)
- A draft clinical summary generated from the anonymised transcript
- Basic identifying details to link the summary to your record: NHS number or EMIS ID, first initial and surname, and date of birth
Consultation audio and transcripts will typically contain health information – for example, symptoms, diagnoses, medications, and treatment plans. This is classified as special category data under UK data protection law and is afforded a higher level of protection.
No financial data, biometric data, or data unrelated to your direct care is deliberately collected.
3. How Hi Scribe collects your data
Data is collected in the following ways:
Direct capture: Your clinician activates Hi Scribe at the start of the consultation. The tool captures the audio of the conversation in real-time via your clinician’s device.
Clinical system integration: Where your clinician uses EMIS Web or SystmOne, Hi Scribe retrieves your basic details (NHS/EMIS number, name, date of birth) from the currently open patient record via the eConsult Toolbar. This is used only to allow the clinician to save the approved summary to the correct record.
Informed consent: Before Hi Scribe is activated, your clinician is required to inform you that the tool will be used. If you do not wish to proceed, you can opt out and the tool will not be used. Your care will not be affected.
4. How and why your data is used
We will only use your personal data when the law allows us to. The table below sets out the purposes for which Hi Scribe processes data, the type of data involved, and the lawful basis.
| Purpose / Activity | Type of data | Lawful basis |
| Real-time transcription of the consultation to support clinical note-taking | Audio, transcript | Article 6(1)(e) – public task (delivery of NHS care)Article 9(2)(h) – health and social care purposes |
| Anonymisation of the transcript prior to AI summarisation | Transcript | Article 6(1)(e)Article 9(2)(h) |
| Generation of a draft clinical summary for clinician review | Anonymised transcript | Article 6(1)(e)Article 9(2)(h) |
| Linking the approved summary to the correct patient record in the EHR | NHS/EMIS ID, name, date of birth, approved summary | Article 6(1)(e)Article 9(2)(h) |
| Optional feedback submission (clinician-initiated only – includes transcript and summary if the clinician chooses to share it) | Transcript, summary | Article 6(1)(f) – legitimate interests (improving service quality and safety) |
| Session metadata logging for security and operational monitoring | Timestamps, session identifiers | Article 6(1)(f) – legitimate interests (security and system integrity) |
Hi Scribe does not make automated decisions about your care. The clinician must review, edit, and approve the draft summary before it is saved to your record. No content is saved to your record without human sign-off.
5. Who your data is shared with
To deliver Hi Scribe, eConsult uses the following third-party processors (sub-processors). Each is bound by contract to process data only as instructed and to apply appropriate security measures. None of them retain your data after processing.
| Processor | Purpose | Location | Data retained? |
| Google Speech-to-Text | Converts consultation audio into a live transcript | UK | No |
| AWS Comprehend | Removes identifiable information from the transcript before summarisation | UK | No |
| Google Vertex AI | Generates the draft clinical summary from the anonymised transcript | EU | No |
| AWS CloudWatch / DataDog | Security and operational logging of session metadata only | UK | Limited (metadata only – see section 8) |
We do not sell your data. We do not share it with advertisers. We do not use it for any purpose other than operating Hi Scribe on behalf of your GP practice.
If eConsult’s business is sold or restructured, personal data may be transferred to the new entity. Any new owner would be required to handle your data in accordance with this notice.
6. International transfers
Audio transcription (Google Speech-to-Text) and anonymisation (AWS Comprehend) take place within the UK.
AI summarisation (Google Vertex AI) is processed within the European Union. Google Vertex AI is configured to restrict processing to EU data centres only, ensuring that identifiable data never leaves the UK or EU.
No data is transferred to the United States or any other country outside the UK or EU. Where EU processing is involved, appropriate safeguards are in place in accordance with UK GDPR requirements for international transfers.
7. Data security
eConsult has implemented appropriate technical and organisational measures to protect your data. These include:
- All data transmitted between Hi Scribe and third-party processors is encrypted in transit using TLS
- Audio data is never stored – it is processed in real-time only
- Transcript and summary data is held in-session only and is never written to eConsult’s servers
- Session data is automatically cleared on logout, browser refresh, or application closure
- Access to Hi Scribe is restricted to authenticated, authorised clinical staff
- Where feedback is submitted by a clinician, access to that data within eConsult is role-based and audited
- eConsult holds UKAS-accredited ISO 27001 certification
- eConsult meets and exceeds NHS Data Security and Protection (DSP) Toolkit standards
- A Data Protection Impact Assessment (DPIA) has been completed for Hi Scribe and is available on request
We have procedures in place to respond to suspected data breaches and will notify you and the ICO where we are legally required to do so.
8. Data retention
Hi Scribe is designed to minimise data retention. The table below sets out how long each type of data is held.
| Data type | Retention period |
| Consultation audio | Never stored. Processed in real-time only and immediately discarded. |
| Live transcript | In-session only. Automatically cleared when the clinician starts a new consultation, logs out, refreshes, or closes the application. |
| Anonymised transcript | In-session only. Cleared as above. |
| Draft clinical summary | In-session only. Cleared as above. |
| Approved clinical note (saved to EHR) | Retained in your patient record by your GP practice, in line with NHS records management standards – typically 10 years for GP records. |
| Session metadata (timestamps, session IDs) | Retained in AWS CloudWatch/DataDog for security and operational monitoring purposes. Not linked to patient identity. |
| Feedback data (clinician-submitted only) | Retained by eConsult for up to 2 weeks or until reviewed by the relevant team member, whichever is sooner. Access is strictly limited. |
No data – audio, transcript, or summary – is stored on eConsult’s servers during or after an active session unless a clinician voluntarily submits feedback.
9. Your rights
Under UK data protection law, you have rights in relation to your personal data. Because your GP practice is the Data Controller, you should direct most requests to them in the first instance.
Your rights include:
- Request access to your personal data (a “data subject access request”)
- Request correction of inaccurate or incomplete data
- Request erasure of your data (where there is no lawful reason to continue holding it)
- Object to processing where we rely on public task or legitimate interests as our lawful basis
- Request restriction of processing in certain circumstances
- Request transfer of your data to another organisation (data portability), where applicable
If your request relates specifically to how eConsult handles your data, contact our Data Protection Officer:
Email: privacy@econsult.health
Post: Data Protection Officer, eConsult Health Limited, 13th Floor, Millbank Tower, 21-24 Millbank, London SW1P 4QP
We will aim to respond to all legitimate requests within one month. Complex or multiple requests may take longer, in which case we will keep you informed.
10. How to contact us and make a complaint
For general privacy queries relating to Hi Scribe:
Email: privacy@econsult.health
Post: eConsult Health Limited, 13th Floor, Millbank Tower, 21-24 Millbank, London SW1P 4QP
If you are not satisfied with our response, or believe we are processing your data unlawfully, you have the right to complain to the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
eConsult Health Limited | Company No: 07628675 | Registered in England and Wales
13th Floor, Millbank Tower, 21-24 Millbank, London SW1P 4QP | privacy@econsult.health