Data processing agreement
This agreement is between the practice, clinic or other organisation that uses Chronix Scribe (the controller) and Chronix Health Group Ltd, a company registered in England and Wales (company number 16663224), registered office 11-13 Upper High Street, Epsom, Surrey, KT17 4QY, ICO registration ZB962513 (the processor). It forms part of the terms of service and meets Article 28 of the UK GDPR.
1. Scope
1.1 This agreement applies to the personal data the processor processes on the controller's behalf when providing Chronix Scribe (the controller data), as described in Annex 1. It does not cover personal data the processor controls itself (such as clinicians' account details), which the privacy notice covers.
1.2 It lasts for as long as the processor processes controller data, including after the terms end until clause 11 has been completed.
2. Definitions
"UK GDPR", "Data Protection Act 2018", "personal data", "special category data", "processing", "data subject", "personal data breach" and "supervisory authority" have the meanings given in the data protection legislation of the United Kingdom. Sub-processor means another processor the processor engages to process controller data. Working day means Monday to Friday, excluding public holidays in England.
3. Roles
3.1 The controller decides why and how controller data is processed. The processor processes it only on the controller's documented instructions, which are: these terms and this agreement; the controller's use of Chronix Scribe's features and settings; and any other written instruction the parties agree.
3.2 If the processor believes an instruction breaks data protection law it will tell the controller promptly. If the law requires the processor to process controller data other than on instructions, it will tell the controller first unless the law forbids that.
4. Controller's responsibilities
The controller:
- has a lawful basis for the processing, for health data usually Article 9(2)(h) UK GDPR with Schedule 1 of the Data Protection Act 2018;
- tells patients about the processing (for example in its own privacy notice) and makes sure everyone present agrees before each capture, using the app's consent step;
- makes sure every draft is reviewed by a clinician before it is signed;
- keeps its own records of the processing it carries out.
5. Processor's obligations
The processor:
5.1 processes controller data only on documented instructions (clause 3);
5.2 makes sure everyone it authorises to process controller data is bound by confidentiality;
5.3 takes the technical and organisational measures in Annex 2 (Article 32 UK GDPR);
5.4 engages sub-processors only as clause 9 allows;
5.5 helps the controller, by appropriate technical and organisational measures, to respond to data subjects exercising their rights (clause 13);
5.6 helps the controller meet its obligations on security, breach notification, data protection impact assessments and prior consultation (Articles 32 to 36), taking into account the nature of the processing and the information available to the processor;
5.7 returns and deletes controller data at the end of the contract as clause 11 sets out;
5.8 makes available the information needed to show compliance with Article 28 and allows audits (clause 14);
5.9 never stores audio on its servers or with any sub-processor, never uses controller data to train AI models, and never uses it for its own purposes or for marketing.
6. Confidentiality
The processor keeps controller data confidential and discloses it only to its personnel and sub-processors who need it to provide Chronix Scribe, or when the law requires.
7. Security
The processor protects controller data with the measures in Annex 2 and reviews them regularly. It may improve them but will not reduce the overall level of protection.
8. Records of processing
The processor keeps a record of the processing it carries out for controllers (Article 30(2) UK GDPR) and gives it to the ICO on request.
9. Sub-processors
9.1 The controller gives general authorisation for the processor to use the sub-processors listed on the sub-processors page, which forms Annex 3 by reference.
9.2 The processor will give the controller at least 30 days' notice by email and on that page before adding or replacing a sub-processor. The controller may object on reasonable data protection grounds within that period; if the parties cannot resolve the objection, the controller may end the terms and receive a refund of any prepaid amount for the period after the end date.
9.3 The processor imposes on each sub-processor, by written contract, data protection obligations no less protective than this agreement, and remains responsible to the controller for each sub-processor's performance.
10. International transfers
The processor transfers controller data outside the UK only as Annex 3 describes and only with an adequate safeguard: UK adequacy regulations (including the UK–US data bridge for certified recipients) or the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, with a transfer risk assessment.
11. Return and deletion at the end of the contract
11.1 Export at any time. The controller's owner and members can download a complete JSON export of the controller data their sign-in can read, free, at any time, from Settings → Data management.
11.2 Instruction to return and delete. When the terms end, or at any earlier time on the controller's written instruction, the processor returns and deletes the controller data. The owner gives that instruction in the app with Settings → Data management → Request organisation export and deletion, which (a) produces the export, (b) marks all of the organisation's data as deleted straight away, and (c) sends the owner a written confirmation quoting this clause, the date of the export, the date of the deletion request and the date deletion becomes permanent. The owner may instead email support@chronixhealthgroup.com.
11.3 Return. If the owner needs data that their own sign-in could not export (for example records only another member could see), they reply to the confirmation within the 30-day window and the processor returns that data to them before permanent deletion.
11.4 Deletion within 30 days. Deleted data can be restored by the owner for 30 days. After 30 days it is permanently removed from live systems, including every member's account and any image files, and it leaves the processor's rolling backups within a further 30 days.
11.5 What is kept. The processor keeps only what the law requires it to keep and nothing containing patient information: billing and accounting records for 6 years, and a deletion log entry recording what was deleted, when and by whom.
11.6 On request, the processor confirms in writing that deletion is complete.
12. Personal data breaches
12.1 The processor notifies the controller without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting controller data.
12.2 The notice describes, as far as then known, the nature of the breach, the categories and approximate numbers of data subjects and records concerned, the likely consequences, and the measures taken or proposed; further information follows as it becomes available.
12.3 The processor helps the controller notify the ICO (within 72 hours of the controller becoming aware, where required) and affected data subjects, and takes reasonable steps to contain the breach and prevent it happening again.
13. Data subject requests
If a data subject contacts the processor about controller data, the processor passes the request to the controller within 5 working days and does not respond itself except to confirm that it has passed the request on. The processor gives the controller the help it reasonably needs to respond, including through the export and deletion features.
14. Audits and information
14.1 The processor makes available all information reasonably needed to show that it meets this agreement, including its security documentation and the records in clause 8.
14.2 The controller (or an independent auditor it appoints, bound by confidentiality) may audit the processor's compliance once a year on at least 30 days' written notice, during working hours and at the controller's cost, and at any time after a personal data breach affecting controller data or when a supervisory authority requires it. The processor may meet a request by providing a current independent certification or audit report covering the same controls where one exists.
15. Data protection impact assessments
The processor gives the controller the information it reasonably needs to carry out a data protection impact assessment on its use of Chronix Scribe, including a summary of the processor's own assessment.
16. Liability
Each party's liability under this agreement is subject to the limits in the terms of service, except where the law does not allow liability to be limited.
17. Precedence and changes
If this agreement conflicts with the terms of service on data protection, this agreement prevails. Changes follow clause 17 of the terms (new version, notice, re-acceptance).
18. Law and courts
This agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.
Annex 1 — Details of the processing
| Subject matter | Providing Chronix Scribe: capturing consultations with consent, transcribing speech to text, drafting notes, patient summaries and documents from what was said, and storing them for the controller |
| Duration | The term of the contract, plus the return and deletion period in clause 11 |
| Nature and purpose | Collection (transcription of speech in memory; audio is never stored on the processor's servers or by any sub-processor), structuring, drafting with AI limited to what was said, storage, retrieval, sharing of patient summaries at the clinician's choice, export and deletion — to document consultations for the controller |
| Features included | Optional features, each used only at the clinician's choice: translation and interpreter mode (machine translation labelled); telehealth capture of a call's audio after the clinician records the remote participants' agreement; patient summary links (expire after 30 days, stop when the visit is deleted); sending signed notes to the controller's practice system and FHIR export; dictation into other web pages (the text is not kept); pre-visit recap; documentation checks on note structure; saved writing preferences (never note content). |
| Types of personal data | Consultation transcript text; draft and signed notes and addenda; patient summaries and their share-link records (expiry, open count); translations; documents and letters; patient display names and references; clinical images uploaded by clinicians and their annotations; consent confirmations, including remote-participant confirmations for telehealth; records of notes sent to practice systems; tasks. Special category data: data concerning health, and any other special category information spoken in the consultation |
| Data subjects | Patients; people present at a consultation (such as relatives, carers and interpreters); clinicians and practice staff named in records |
Annex 2 — Technical and organisational measures
- No audio at rest: audio is never stored on the processor's servers or by any sub-processor; speech is transcribed in memory and in transit, and batch transcription jobs are deleted from the provider as soon as the text is returned. The optional offline mode of the Chronix Scribe mobile app (when the mobile app is released) holds audio encrypted on the clinician's own device only until it has been transcribed, and then deletes it.
- Encryption: TLS in transit; encryption at rest for the database and file storage.
- Location: database and file storage in London (UK); transcription in Europe.
- Separation: row-level security separates every organisation's data at database level; access is by role.
- Keys: provider and payment keys are held only on the server, never in the browser.
- AI safeguards: drafting is limited to what was said; ungrounded clinical statements are removed with a visible marker; every note is labelled and must be signed by a clinician.
- Deletion: 30-day restore window, then permanent removal of database records and image files by scheduled jobs; deletion log kept.
- Resilience: managed daily database backups kept for 7 days, so up to 24 hours of changes could be lost in a full restore; uploaded image files are not covered by these backups. Restores follow a written procedure and each drill is recorded.
- Practice-system credentials: held encrypted, readable only by the server when sending a note, and removed when the connection or the organisation is deleted.
- Access by our personnel: limited to what is needed to run the service, under confidentiality.
- Incidents: breach notification within 48 hours (clause 12).
Annex 3 — Sub-processors
The current list, with each provider's role and location, is on the sub-processors page.
Contact: privacy@chronixhealthgroup.com · support@chronixhealthgroup.com