Data Processing Agreement

Data Controller: You, the registered ChartScribe user (clinician or healthcare organisation), who determines the purposes and means of processing patient data.

Data Processor: ChartScribe (contact: dpo@chartscribe.io).

This DPA applies to all processing of personal data carried out by ChartScribe on your behalf.

ChartScribe will process personal data for the following purposes:

• Transcribing audio recordings of clinical encounters into structured text
• Generating SOAP notes, clinical summaries, and care plans
• Storing and retrieving clinical documentation securely
• Enabling export to electronic health record (EHR) systems
• Providing offline recording and deferred synchronisation

Categories of data subjects: Patients receiving clinical care from you.

Types of personal data: Health data (special category under UK GDPR Article 9), including symptoms, diagnoses, medications, vital signs, and other clinical information you choose to record.

ChartScribe agrees to:

• Process personal data only on documented instructions from you, including as set out in this DPA and the Terms and Conditions
• Ensure persons authorised to process personal data have committed themselves to confidentiality
• Implement appropriate technical and organisational measures to ensure security of processing
• Not engage another processor without your prior specific or general written authorisation
• Assist you in responding to requests from data subjects exercising their rights
• Assist you in ensuring compliance with security obligations, data breach notification, and DPIAs
• At your choice, delete or return all personal data after the end of provision of services
• Make available to you all information necessary to demonstrate compliance with Article 28
• Allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate

You provide general authorisation for ChartScribe to engage the following sub-processors:

We will notify you of any changes to sub-processors at least 30 days in advance. You may object to a new sub-processor on reasonable grounds.

ChartScribe implements the following technical and organisational security measures:

• Encryption at rest: AES-256-GCM for all stored data including audio recordings and clinical notes
• Encryption in transit: TLS 1.3 for all network communications
• Access control: Role-based access control (RBAC) with MFA enforcement for admin accounts
• Audit logging: All access to patient data is logged with user ID, timestamp, and action
• Pseudonymisation: Audio recordings are processed with patient identifiers separated where possible
• Backup: Encrypted daily backups retained in geographically separate locations
• Staff training: All employees complete annual data protection and security awareness training

ChartScribe will notify you without undue delay and in any case within 24 hours of becoming aware of a personal data breach. The notification will include:

• The nature of the breach including categories and approximate number of data subjects affected
• The likely consequences of the breach
• Measures taken or proposed to address the breach
• Contact details for further information

ChartScribe will assist you in responding to data subject requests (access, rectification, erasure, restriction, portability, objection). We will:

• Provide necessary tools to export individual patient records
• Permanently delete data within 30 days of your instruction
• Provide audit trails of all processing activities

This DPA remains in force for the duration of your subscription. Upon termination:

• ChartScribe will, at your choice, return or delete all personal data
• You have 30 days to export your data
• After 30 days, all patient data will be cryptographically erased (keys destroyed)
• Audit logs will be retained for 7 years as required by law

This DPA is governed by the laws of England and Wales and shall be construed in accordance with UK GDPR.

For DPA-related queries: dpo@chartscribe.io