Where your patients’ recordings go
Stored encrypted in London. Processed in the UK and EU. Not used to train AI models. Every company that touches the data is named below, with a link to its terms.
Who handles what, where, and for how long.
| What | Where | Provider | Kept for | Proof |
|---|---|---|---|---|
| The recording | London, encrypted | Amazon Web Services (AWS) | Deleted 30 days after the note is signed. Deleted straight away if the patient withdraws consent. | |
| Transcription | EU | Deepgram, through its EU endpoint | Not used to improve Deepgram’s models: model improvement is switched off on every request. How long Deepgram holds audio while it processes it is set by its own terms, linked here. | |
| Note writing | EU | Google Gemini on Vertex AI, through Google’s EU endpoint | Google’s terms say it won’t use the data to train or fine-tune its models. Any short-term cache is deleted within 24 hours. | |
| The signed note, transcript and consent record | London, encrypted | Amazon Web Services (AWS) | Kept as part of the patient’s clinical record. |
Why delete the audio at all? A kept recording is part of the clinical record, so it comes under retention rules and subject access requests. Should an AI scribe store audio?
Other companies we use, never patient data.
- Amazon Web Services (Cognito and SES): sign-in for your team and the emails Squte sends, run in London.
- Stripe: your practice’s card and subscription payments. Stripe is a US company with UK and EU entities.
- Vercel: hosts this website and keeps standard visit logs. A US company.
- Unsplash: serves the photographs on this website, so it sees visitors’ IP addresses. A US company.
The journey of one recording
01
Consent
You read the consent line before recording. The patient’s answer, the wording used and the time are saved with the visit.
02
Recording
Audio goes from your iPad or laptop over an encrypted connection and is stored, encrypted, on servers in London.
03
Transcription
Deepgram turns speech into text on its EU service. Model improvement is switched off, so the audio isn’t used to train its models.
04
Note writing
Google Gemini drafts the note from the transcript on Google’s EU endpoint. Google doesn’t train on it either.
05
Review and sign
The draft waits for you. Nothing goes in the record until you’ve checked and signed it, and every change is logged.
Ask first, then record.
NHS England says patients must be told at the start of each appointment and given a clear chance to object (Mills & Reeve).
“We use an AI note-taker that records our conversation to write up your notes. It’s kept secure and processed in the UK and EU, and you can say no. Are you happy with that?”
- The patient’s answer is saved with the visit: the wording used, how it was given and the time. Squte will not transcribe a visit without it.
- If the patient says no, nothing is recorded. You type the note, or build it with chairside chips, as you would without Squte.
- If the patient changes their mind later, the recording is deleted straight away.
The consent kit: posters, booking messages and privacy-notice wording →
What we never do
- Train AI models on your recordings or notes, or let our providers do so.
- Transcribe a visit without the patient’s recorded consent.
- Add anything to a patient’s record without a clinician signing it.
- Show one practice’s patients to another practice.
What your practice still does
Your practice is the data controller, so some of the paperwork is yours. Squte gives you the facts to fill it in; it doesn’t make a practice compliant on its own.
- Complete a data protection impact assessment (DPIA) before you start.
- Complete a clinical safety assessment to the DCB0160 standard.
- Add AI scribing to your practice privacy notice.
- Tell patients, for example with a poster in reception and a line in booking messages.
NHS England asks practices using ambient scribes for these documents (NHS England guidance).
Is Squte a medical device?
No. Squte drafts notes from what was said. It records a diagnosis only when you say it, and it never suggests diagnoses or treatment. Under the MHRA’s guidance of 29 July 2026, a scribe that transcribes and summarises for the clinician to review is generally not a medical device; one that suggests diagnoses or treatment is (MHRA).
Certificates
We don’t hold any security certificates yet, so we don’t claim any. Each one will be listed here, with the date it was awarded, once we have it.
For your data protection lead
Before your practice starts, we sign a data processing agreement with you and send the detail behind this page: who processes what, where and for how long, with answers to your security questionnaire.
More questions? Read the FAQ.
Read next
- Should an AI scribe store audio? →The trade-offs of keeping appointment recordings, how the defence bodies treat them, and what Squte does.
- Patient consent for AI scribes →A consent kit for UK dental practices: what to say, when to tell patients, recording a refusal, poster and privacy-notice wording.
- Governance pack →What a practice needs before using an AI scribe: Squte’s data flows for your DPIA, a DCB0160 hazard-log starter, and where to find the patient poster and privacy-notice wording.
- FAQ →Answers about consent, liability, accuracy, practice software, data, medical-device status and price.
Last changed : first published.