The Shropshire, Telford and Wrekin Community and Hospitals NHS Trust is committed to providing you with safe, high-quality care. 

Some of our clinicians use a digital tool called Heidi Scribe during consultations, appointments and assessments, to help them write up your notes. This notice explains what information Heidi Scribe uses, and how we look after it.

What is Heidi Scribe?

Heidi Scribe is a digital tool that listens to your consultation and turns it into a draft clinical note or letter. Some people call this an ‘ambient AI scribe’.

It’s designed to free up your clinician’s time so they can focus on you, rather than typing notes. Heidi Scribe does not make decisions about your care, give a diagnosis, or replace your clinician’s judgement. Every note it produces is checked, edited if needed, and approved by your clinician before it goes into your health record.

Why do we use Heidi Scribe?

We use Heidi Scribe to:

  • Make clinical notes more accurate.
  • Reduce clinician administration, so they have more time for patients.
  • Help letters and referrals to go out more quickly.
  • Improve your experience during consultations.

How is data collected and processed?

During your consultation, Heidi Scribe listens and creates a written transcript of the conversation.  This may include:

  • Your name and other details that identify you such as full name, DOB and NHS number.
  • What you tell your clinician about your symptoms, medical history, medications and treatment.
  • Anything your clinician records as part of your care.

Your clinician checks and confirms this information before it’s added to your medical record.

Heidi Scribe processes this information in a secure system that meets NHS Digital and UK GDPR requirements.

Who is responsible for your information?

The Shropshire, Telford and Wrekin Community and Hospitals NHS Trust is responsible for your information – in data protection terms, we are the ‘Data Controllers’.

Heidi Scribe processes information on our behalf, under a contract that says it can only use it in the way we instruct (this is called being our ‘Data Processor’).

Heidi Scribe will not share your information with anyone else without your consent, unless the law requires it (for example, safeguarding).

Your information is encrypted and stored securely and only authorised healthcare staff at our Trusts can access your information.

What is our lawful basis for processing?

We use your information under UK data protection law because it’s necessary to provide you with health and social care, and to manage health services:

  • UK GDPR Article 6(1)(e) – necessary for carrying out a task in the public interest.
  • UK GDPR Article 9(2)(h) – necessary for providing health or social care and managing health services.

How is your information protected?

Keeping your information safe is important to us. Heidi Scribe has strong security in place, including:

  • Encrypting data in transit and at rest.
  • Restricting access to authorised users only.
  • Meeting UK data protection requirements.
  • Independent security checks and recognised certifications.
  • Logging and monitoring who accesses your information.

Does Heidi Scribe use patient information to train AI models?

  • No. Heidi Scribe does not use your consultation data, transcripts or clinical notes to train its AI models. Your information stays under the control of the Trust using the service.

Where is data stored?

  • Heidi Scribe stores data in the UK and operates its systems to meet UK GDPR and other data protection requirements. The output of a consultation will be held in your clinical record. The transcripts are retained for a period of 90 days for quality assurance purposes and then automatically deleted. Transcripts may be kept longer if deemed necessary for legal, complaint or safety investigations. Audio is not stored.

Will my information be shared?

  • Information from Heidi Scribe only becomes part of your clinical record once your clinician has checked it. Beyond that, we’ll only share it under normal NHS information-sharing rules for your care, or where we’re legally required to (for example, safeguarding).
  • We do not sell your information, and neither does Heidi Scribe.

Do I have a choice?

Your clinician will tell you if Heidi Scribe is being used during your consultation. If you have any concerns, speak to your clinician where you can raise an objection – we can discuss other options. Your care will not be affected if you raise concerns or ask us not to use an AI scribe during the consultation, Heidi dictation will be used post consultation.

Your Rights

Under UK data protection law, you have rights over your personal information. You can:

  • Be told how your information is used.
  • Access your personal information.
  • Ask us to correct information that’s wrong.
  • Ask us to restrict how we use your information in some circumstances.
  • Object to how we use your information.
  • Complain to the Information Commissioner’s Office (ICO) if you’re unhappy with how we’ve handled your information.

For more information about your rights, visit: www.ico.org.uk

For more information about accessing your record, visit : Access to Medical Records – SaTH