Enterprise Data Protection Policy (EDP)
Last updated: 27 October 2026
Summary
- We keep clinician account data separate from clinical case content.
- Clinician account data is held by our sign-in and database providers.
- Clinical assessment content is saved in the clinician's browser by default. We do not store it as a patient record.
- Clinical content is sent only when the user runs AI analysis, asks an AI follow-up question or creates an export.
- AI requests go to an AI model provider. It states that it does not use this data to train its models by default.
What this covers
- clinician account and organisation data
- patient or clinical data entered into the workflow
- AI processing and exports
- storage, retention and governance
Two kinds of data
Clinician data: email address, display name, role, work setting, organisation and the sign-in details needed to run the account.
Clinical data: what a clinician enters about a case, such as the presenting complaint, medications, allergies, observations, history, investigations, results and export content.
We handle these differently. Clinician data is used to run the account. Clinical data is working content and is not kept as a patient record.
Where clinician data is kept
Our sign-in and database providers hold the account and profile used for role, location, organisation and setup. Access to each profile is limited to the signed-in user who owns it.
Where clinical data is kept
In-progress assessments are saved in the browser on the clinician's device so work is not lost. We do not store them as patient records. There is no central ClinicalAssist patient database.
When clinical data leaves the device
Clinical content is sent only when the clinician uses a feature that needs our servers:
- AI assessment analysis
- AI follow-up questions
- PDF, DOC or TXT exports
So the accurate description is "stored in the browser by default, sent when the user asks for these actions", not "patient data never leaves the device".
AI providers
AI requests are sent to an AI model provider. It states that it does not use this data to train its models by default, but it may keep it for a limited time to check for abuse. Organisations should decide whether their governance allows any patient-identifiable data to be sent to such providers, and guide their staff accordingly.
Our position for enterprise review
- ClinicalAssist is not your organisation's patient record.
- We store user identity and access details centrally so we can run and tailor the service.
- Clinical content is saved in the browser and sent only for actions the user asks for.
- Exports are created on request, returned to the user and not kept.
- The product should be used in line with your local NHS or organisational governance, confidentiality and information-handling rules.
How long data is kept
- Account data is kept while the account is active, and as needed for support, legal, security and operational reasons.
- Clinical data in the browser stays on the device until it is cleared, replaced or removed.
- AI requests are kept by our providers only as their own policies allow.
Related policies
Read this together with our Privacy & Data Handling policy and Cookies & Browser Storage policy.
Contact
Enterprise or data protection questions? Email hello@clinicalassist.io.