ChartScribe Clinical Wiki
Privacy Notice
Controller & Contact
Data Controller
Wells Electronics UK
ChartScribe
Data Protection Officer
We take your privacy extremely seriously. This notice explains how we handle data specifically within the Clinical Wiki. For the broader ChartScribe platform privacy notice, see our main Privacy Policy.
What Data We Collect in the Wiki
Account data
Name, specialty, verified license status
User-generated content
Questions, answers, comments, templates you post
Engagement data
Votes, replies, "Helpful" marks
Technical data
IP address, device type, timestamps
Verification documents
License photo / ID badge — processed and then minimised
Lawful Basis & Purpose
Contract & Legitimate Interest
To provide the professional networking service you signed up for.
Consent (explicit where required)
Publication of your posts, use of anonymised content to improve AI, and verification processing.
Legal Obligation
License verification and audit trails.
Special Category Health Data
Any clinical discussion is treated as special category data under GDPR Article 9. We rely on explicit consent (Art. 9(2)(a)) plus health care purposes (Art. 9(2)(h))as our primary exemptions, with public health interest (Art. 9(2)(i)) for anonymised aggregate use.Full Article 9 framework.
Article 9 Exemptions by Processing Activity
How We Use Your Data
To display and moderate discussions.
To improve the AI scribe using fully anonymised contributions (with opt-in).
To show your Moderator badge (if applicable) to peers and patients in .care (with your control).
For safety and compliance (moderation, audit).
Who We Share With
Moderators & our team
Only as needed, with role-based access controls
Sub-processors under strict DPAs
Hosting in EU, moderation tools, AI provider — all EU/adequacy
Advertisers
Never. We do not sell or share data for advertising.
Third parties
Never sold. No data brokers. No marketing lists.
Never sold. Never shared with advertisers.
Your Rights (Easy One-Click in Profile)
Access
See all data we hold about you
Rectification
Correct inaccurate or incomplete data
Erasure
"Delete my account & all contributions" — full account deletion
Restriction
Temporarily limit how we use your data
Objection
Stop certain types of processing
Portability
Export your data in machine-readable format
Withdraw consent anytime in Settings → Privacy
Lodge a complaint with the Irish Data Protection Commission or your local supervisory authority
Retention
Security
AES-256 encryption
All data at rest
TLS 1.3
All data in transit
SOC 2 aligned controls
Security framework
Regular testing
Penetration tests & vulnerability scans
Breach notification
Within 72 hours where required
Role-based access
Strict need-to-know permissions
International Transfers
All core processing takes place within the European Economic Area (EEA). In the event that any data must be transferred outside the EEA, we use Standard Contractual Clauses (SCCs) plus supplementary measures (encryption, pseudonymisation, access controls) to ensure an adequate level of protection.
EU-based by default. No routine transfers to third countries.
Children
This service is not applicable to children. The Clinical Wiki is exclusively for licensed healthcare professionals with verified medical credentials. We do not knowingly collect data from anyone under 18.
Changes to This Notice
We will notify you of any material changes to this privacy notice via email and in-app notification at least 30 days before they take effect. Minor changes (clarifications, formatting) will be posted here with an updated effective date.
Contact
For any privacy questions, data rights requests, or concerns:
Wells Electronics — Data Protection Officer