Data Protection & Privacy
ChartScribe is an Irish company processing clinical data under EU GDPR. This page sets out how we protect your data, your rights, and how to exercise them.
Your Rights
Access, erase, export your data
Wiki Privacy Notice
Full Clinical Wiki privacy notice
Data Processing
Agreements with sub-processors
Contact DPO
Wells Electronics
Data Protection Officer (DPO)
Wells Electronics serves as the Data Protection Officer for ChartScribe, as required under GDPR Article 37 given the large-scale processing of special category (health) data.
Register a concern or complaint
If you believe your data rights have been infringed, you have the right to lodge a complaint with the Irish Data Protection Commission:
dataprotection.ieData Protection Impact Assessment (DPIA)
A DPIA is required under GDPR Article 35 because the Clinical Exchange involves high-risk processing: special category (health) data, large-scale processing of clinician credentials, and reputation profiling. This is a public summary of our assessment.
Nature, Scope, Context & Purpose
The Clinical Exchange is a peer-to-peer forum for verified clinicians to discuss clinical documentation, coding, safeguarding, and practice management. All contributors must be verified licensed clinicians. Data subjects are healthcare professionals worldwide. Processing includes account creation, identity verification, public posting, voting/reputation, and optional anonymised AI training.
Necessity & Proportionality
Identity verification is necessary to prevent fraud and maintain clinical trust. Verification documents are deleted after 30 days (only hashes retained). Public posting is necessary for the forum's purpose, but users retain full deletion rights. Reputation data is proportionate to community quality goals and can be opted out.
Identified Risks & Mitigation Measures
| Risk | Likelihood | Mitigation |
|---|---|---|
| Unauthorised access to verification docs | Low | AES-256 at rest, role-based access, 30-day auto-deletion |
| Patient identifiers in public posts | Medium | Pre-publish checklist, keyword auto-flagging, community reporting |
| Reputation data misuse | Low | Opt-out available, no automated decision-making based on score |
| Data breach (sub-processor) | Low | EU-only sub-processors, DPAs, SCCs, encryption |
| Account takeover | Medium | 2FA required, email verification, session management |
DPO Sign-off: This DPIA has been reviewed and approved by Wells Electronics (DPO). The assessment concluded that with the implemented mitigations, the processing meets GDPR necessity and proportionality requirements. Next review date: 6 months from launch or upon material change.
Full DPIA Record — ChartScribe Clinical Wiki
1. Description of Processing
Processing: User-generated clinical discussions, verification of medical professionals, voting/reputation systems, integration with ChartScribe note editor and .care patient portal for optional badge display.
2. Purpose
Enable peer-to-peer knowledge sharing to reduce clinician isolation and improve patient care, while feeding anonymised data back to improve AI scribe accuracy.
3. Necessity & Proportionality
Necessary for the legitimate aim of professional collaboration. Proportional because participation is voluntary, anonymisation is enforced, and users have full control over their data including granular consent and one-click erasure.
4. Risks Identified
5. Mitigation Measures (All Implemented)
7. Consultation
DPO (Wells Electronics) consulted. Will consult the Irish Data Protection Commission if material changes to processing occur.
Conclusion: Proceed — benefits outweigh risks with mitigations in place. Annual review scheduled. Material changes will trigger re-assessment and potential DPC consultation.
Lawful Basis for Processing
Under GDPR Articles 6 and 9, we process different categories of data on different lawful bases. You can withdraw consent for consent-based processing at any time without affecting the lawfulness of processing before withdrawal.
Verification documents (medical license, ID badge)
RequiredLawful basis: Legal Obligation + Explicit Consent (Art. 9(2)(h) + Art. 9(2)(a))
Purpose: To verify you are a licensed clinician before granting posting rights. We must ensure all contributors are genuine healthcare professionals.
Retention: 30 days after successful verification; only a hashed identifier and expiry date retained for re-verification.
User-generated posts, questions, answers
WithdrawableLawful basis: Legitimate Interest (Art. 6(1)(f)) + Explicit Consent for Publication (Art. 9)
Purpose: To operate a professional clinical knowledge-sharing community. Legitimate interest in facilitating peer-to-peer medical education.
Retention: As long as your account is active. Deleted within 90 days of account closure or deletion request.
Voting, reputation, badges
WithdrawableLawful basis: Legitimate Interest (Art. 6(1)(f))
Purpose: To maintain community quality and recognise helpful contributions. You can opt out of reputation display in your profile.
Retention: As long as account is active. Anonymised after deletion.
Anonymised contributions for AI model improvement
WithdrawableLawful basis: Legitimate Interest (Art. 6(1)(f)) — with strong anonymisation (pseudonymisation + aggregation)
Purpose: To improve ChartScribe AI clinical note quality and terminology accuracy. Individual posts are never directly used.
Retention: Anonymised data retained indefinitely; opt-out prevents future inclusion.
chartscribe.care patient-linked insights
WithdrawableLawful basis: Explicit Consent (Art. 9(2)(a)) — separate granular consent
Purpose: To provide continuity of care features between clinical documentation and patient follow-up.
Retention: Per patient consent lifecycle. Separate from wiki data.
Audit logs (views, posts, votes, edits)
RequiredLawful basis: Legal Obligation (Art. 6(1)(c))
Purpose: Regulatory compliance, incident investigation, and community safety. Required for medical platform accountability.
Retention: 6 years (Irish statute of limitations for medical liability).
Article 9 — Special Category Data Exemptions
Clinical discussions, case examples, medical histories, referrals, and verification data involve special category data (data concerning health) under GDPR Article 9. Paragraph 1 creates a general ban on processing such data. Paragraph 2 lists 10 exemptions that lift the ban. We rely on a layered three-tier approach:
Explicit Consent
Used for: Account creation, public posting, reputation, badge display, AI training opt-in
Health or Social Care Purposes
Used for: Displaying clinical discussions, moderator review, community safety, audit logs
Public Interest in Public Health
Used for: Anonymised AI training (with opt-in), aggregate analytics, quality improvement
| Processing Activity | Art. 9 Exemption | Art. 6 Basis | Key Safeguards |
|---|---|---|---|
| Account creation & verification | 9(2)(a) | 6(1)(b) | AES-256, 30-day doc deletion |
| Publication of clinical discussions | 9(2)(a)+(h) | 6(1)(f) | PHI checklist, keyword flagging |
| Voting, reputation & badges | 9(2)(a) | 6(1)(f) | Opt-out, no automated decisions |
| Moderator content review | 9(2)(h) | 6(1)(f) | Professional secrecy, 48hr SLA |
| Anonymised AI training | 9(2)(i) | 6(1)(f) | Pseudonymisation + opt-in |
| .care badge display | 9(2)(a) | 6(1)(a) | Granular opt-in, turn off anytime |
| Audit logging | 9(2)(h) | 6(1)(c) | 6yr retention, DPO access only |
Exemptions not relied on: 9(2)(b) employment, 9(2)(c) vital interests, 9(2)(d) not-for-profit, 9(2)(e) publicly made data, 9(2)(f) legal claims, 9(2)(g) substantial public interest, 9(2)(j) archiving/research. See the full Article 9 framework for reasoning.
Sub-Processors
All sub-processors are located in the EU/EEA or have adequacy decisions + Standard Contractual Clauses. Data Processing Agreements (DPAs) are in place with each.
| Processor | Location | Role | Safeguards |
|---|---|---|---|
| ChartScribe Hosting (EU) | Ireland (AWS eu-west-1) | Infrastructure | EU-based, ISO 27001 certified |
| Identity Verification Service | EU/EEA | License verification processing | DPA in place, AES-256 encryption, 30-day deletion |
| Email Service Provider | EU/EEA | Verification & notification emails | DPA in place, TLS 1.3, EU data residency |
| AI Model Provider (Anonymised) | EU/EEA | Anonymised content analysis only | No PII transferred, pseudonymisation, DPA |
Data Retention Schedule
| Data Category | Retention Period | Basis |
|---|---|---|
| Active wiki posts & answers | Account lifetime + 2 years | Legitimate interest / user control |
| Deleted posts (soft delete) | 90 days then permanent erasure | User right to erasure |
| Verification documents | 30 days after approval | Data minimisation |
| License hash + expiry | Account lifetime + 2 years | Re-verification obligation |
| Voting & reputation data | Account lifetime; anonymised on deletion | Community integrity |
| Audit logs | 6 years | Legal obligation (statute of limitations) |
| Account metadata | Account lifetime + 2 years | Contractual necessity |
| Anonymised AI training extracts | Indefinite (no personal data) | Legitimate interest / anonymised |
Technical & Organisational Measures
Encryption at Rest
AES-256 for all stored data including verification documents
Encryption in Transit
TLS 1.3 for all data transmission
Pseudonymisation
AI training data is pseudonymised before any processing
Role-Based Access
Viewer / Contributor / Moderator / Admin access levels
Audit Logging
Full trail of every view, post, vote, edit (6-year retention)
Penetration Testing
Quarterly third-party security assessments
Staff Training
All team members complete annual GDPR training
Breach Procedure
Detect → Contain → Notify DPC within 72hrs if risk to rights
Data Breach Response Procedure
Detect
Automated monitoring + user reporting
Contain
Immediate isolation within 1 hour
Assess
DPO evaluates risk to rights
Notify DPC
Within 72 hours if risk exists
Notify Users
If high risk to individuals
Exercise Your Data Rights
GDPR grants you comprehensive rights over your personal data. Access, rectify, erase, or export your data at any time from your rights dashboard.
Go to Your Rights DashboardAll requests processed within 30 days, free of charge.