Skip to the content

Data

Confidentiality is not a setting

This page is written so that it can be passed on to a data protection officer without having to be translated first.

The audio

Speech recognition happens on the device

A session in the clinic is transcribed on the clinician’s own iPad. The audio does not leave the device, and there is no audio file to retrieve, listen in on or leak. What is sent onwards is text.

In video consultations, recording takes place only if the client taps yes inside the meeting — not at the clinician’s instigation alone. Recordings are held encrypted in the clinic’s own area and are deleted by the clinic, not by us and not automatically.

The names

Pseudonymisation before anything leaves the server

Before a transcript is used to write a draft note, the client’s and the clinician’s names, CPR numbers, telephone numbers, email addresses and postal addresses are replaced by placeholders. The language model sees [KLIENT], not a name. The placeholders are put back locally, after the text has come back.

A detail that has cost us one mistake: the ordinary way of finding word boundaries in JavaScript does not recognise Å as a letter. A surname such as «Åkjær» therefore slipped through the first version. The test that caught it sits in the system’s standing test set and is run every time.

Encryption

One key per clinician

Clinical records and recordings are held encrypted with AES-256-GCM. The key is derived from the clinician’s own access key and a random salt, and is never held on disk.

The consequence is that two clinicians in the same clinic cannot read each other’s material — and that we can read neither. It also means that a forgotten key cannot be reset by us. That is a drawback we accept deliberately.

Location

Where it is held, and who processes it

  • Servers Germany, within the EU/EEA.
  • Language model Anthropic, under a data processing agreement. Transcripts are pseudonymised before they are sent.
  • SMS GatewayAPI, a Danish supplier with European data storage. Messages contain no health data, and the sender name does not reveal the clinic’s field.
  • Reporting Sygeforsikringen «danmark», when the client is to receive a subsidy. That is a disclosure, and it must appear in the clinic’s record of processing activities.

This list is the full one. If there is a sub-processor we have not named, that is an error — write to us and we will correct the page.

The way out

An export you can take with you

The whole clinical record can be downloaded as a zip of ordinary files: one note per HTML page in a folder per client, client list and appointments as CSV, all of it as JSON alongside, and checksums, so you can demonstrate that what you received is what you hold.

None of it requires our software. This is not a convenience: a psychology clinic has a five-year retention obligation, and the obligation is the clinic’s. If you cannot get the clinical record out in a usable form, you cannot cancel your agreement with us and still comply with the law.