Privacy Notice Update: Use of Heidi AI Scribe Technology

Purpose of Processing with Heidi AI

Compass House Medical Centres now uses Heidi, an AI-powered scribe technology, to assist clinicians in accurately and efficiently documenting patient consultations. You will be asked to confirm you are happy with this before any transcribing is undertaken. This section outlines how we collect, use, and protect personal data processed by Heidi to ensure we meet high standards of privacy and confidentiality.

Types of Personal Data Processed

Heidi processes two main types of personal data during consultations:

• Patient Information: This includes the patient’s name, contact details, medical history, diagnosis, treatment information, and any other information shared during consultations.
• Clinician Information: This includes audio recordings capturing the clinician’s voice and any professional identifiers, such as names and titles.

Purpose and Legal Basis for Processing with Heidi AI

The processing of data with Heidi AI is done to support clinicians in maintaining accurate and timely medical records. This processing is carried out with explicit patient consent under:

• GDPR Article 6(1)(a): Consent of the data subject.
• GDPR Article 9(2)(h): Necessary for the provision of health or social care.

Data Retention and Security with Heidi AI

Data Retention: Audio data captured during consultations is temporarily stored for transcription and is deleted once the clinician verifies and finalises the documentation in the Electronic Health Record (EHR).

Data Security: Data is encrypted during processing and stored on NHS-compliant secure servers located within the UK. Only authorised staff and clinicians have access to this data.

Sharing and Access Controls

Heidi operates as a data processor under a contractual agreement with Compass House Medical Centres. Heidi is fully compliant with NHS data security standards, and access to AI-transcribed data is restricted to healthcare providers directly involved in your care.

Your Rights

Patients have the right to:

• Access: Request details of how their data is processed by Heidi.
• Withdraw Consent: Opt-out of Heidi’s use during consultations.
• Rectification: Request correction of any inaccuracies in their health records.

For questions about your data or to withdraw consent, please email compasshouse@nhs.net