Can an AI vendor train on our data if it is anonymised?

Truly anonymous data falls outside UK GDPR, but anonymising consultation audio and clinical text is hard, and the anonymising step is itself processing of patient data. Ask for a no-training commitment that covers anonymised and derived data too, so there is nothing to argue about.

Is an opt-out from model training good enough?

It is weaker than a default of no training. An opt-out depends on someone switching it off, and on that setting surviving product changes. For patient data, ask for no training as the contractual default.

How long should an AI scribe keep consultation audio?

Only as long as it needs to produce and check the draft. Many vendors delete audio within days. Whatever the period, it should be fixed, written into the DPA and stated in your privacy notice.

Is the transcript part of the medical record?

That is your decision as controller. Most clinics treat the approved note as the record and the transcript as supporting data with a shorter retention period. Decide, write it in your policy and privacy notice, and apply it consistently.

What happens to our data if we cancel?

Your data processing agreement should say. Look for a defined export window, deletion at the end of it including backups, and written confirmation. If the contract is silent, ask before you sign.

Do the vendor's AI model providers count?

Yes. If your vendor sends data to a third-party model, that provider is a sub-processor. The no-training commitment and retention limits need to flow down to it, and it should appear on the sub-processor list.

AI Model Training on Patient Data and Retention: What UK Clinics Should Demand

Short answer

Only if your contract allows it, and for patient data it should not. Training a vendor's models is a different purpose from delivering care, and a processor may only act on your documented instructions. Ask for an unqualified no-training commitment in the DPA, plus a written retention schedule for audio, transcripts and notes, with deletion on request.

Why training is a contract question

Your AI vendor is your processor. Under UK GDPR Article 28 it may only process patient data on your documented instructions. Using that data to train or improve its own models is a new purpose, outside what you engaged it to do, and the purpose limitation principle says data collected for one purpose should not be used for an incompatible one. A vendor that does it anyway risks becoming a controller in its own right.

Watch the wording. 'We may use data to improve our services' can mean training. 'Opt-out available' means training is on unless someone remembers to switch it off. The answer you want is an unqualified no, covering audio, transcripts, notes and metadata, and covering the vendor's model providers as well as the vendor itself.

Retention: three kinds of data, three answers

Audio: needed only until the transcript and draft exist. Short, automatic deletion is the norm to look for.
Transcripts: useful for checking a note if a question is raised, but not usually part of the clinical record. Decide a period and write it into your privacy notice.
Approved notes: part of the clinical record, kept under your normal record retention schedule, usually in your patient management system.

UK GDPR's storage limitation principle says personal data should be kept no longer than necessary, and NHS England's ambient scribing guidance asks organisations to define how long audio, transcripts and outputs are kept. Write the answers down in your DPIA.

Deletion you can rely on

How is data deleted, and does deletion reach backups?
Will you confirm deletion in writing when we or a patient ask?
What happens to our data when we cancel, and how long do we have to export it?
Is all of this in the data processing agreement?

What Motics does

Patient data is not used to train, fine-tune or improve any AI model, ours or any sub-processor's. Contractual agreements with all sub-processors prohibit any other use.
AI models run in isolated, temporary environments, and input data is discarded after each request.
Scribe audio is deleted within 48 hours. Transcript and note retention is configurable per clinic, with no minimum retention period.
Deletion destroys the data's encryption keys, making it permanently unrecoverable. We process erasure requests under GDPR Article 17 and confirm in writing.
You can export your data at any time. On termination there is a reasonable retrieval period before deletion, as set out in our Data Processing Agreement.

Full detail on our security and compliance page and the Trust Centre. Ask any vendor, including us, to put these answers in writing.

Primary sources

Practical orientation for UK clinics, not legal advice. For your own circumstances, take advice from your data protection officer, indemnity provider or a solicitor.

Can AI vendors train on our patient data, and how long should they keep it?