For patients

AI and Your Health Data in a Private Clinic

Faisal Ali, AAISM, CISM, CRISC

Where AI may touch your information, what a clinic should be able to explain, and what you are entitled to ask.

You may never see the AI tool. It sits in the booking form, the transcription running during the consultation, the software that drafts the referral letter, or the imaging system that flags a shadow on a scan before the clinician looks at it.

Most of this is ordinary and much of it is useful. AI-drafted notes can give a clinician more of the appointment to spend looking at you rather than at a screen.

What matters is whether the clinic can explain it.

Where AI may touch your data

Before the appointment.

Online forms, triage questionnaires, booking systems, automated replies to your messages.

During the consultation.

Ambient scribes and transcription tools that record or listen, then produce a draft note.

After the consultation.

Referral letters, summaries, clinical coding, billing, follow-up messages.

In specialist services.

Dermatology photographs, dental radiographs, ophthalmic scans, fertility records, diagnostic images and treatment planning.

When your data is used to draft your note, and when it may be used for more

When a clinic uses an ambient scribe, your consultation audio or transcript is processed to produce a draft note. That is its primary purpose.

Some suppliers also retain audio after the note is verified, use transcripts to train or improve their AI systems, or share data with third-party processors. These are secondary uses. They require a different legal basis from direct care, and your clinic should be able to tell you whether they apply.

Questions worth asking:

  • Is my audio deleted once the note is checked, or is it kept?
  • Will my transcript or audio be used to train or improve the AI system?
  • Which third parties does the supplier share data with?

A clinic with a clear governance position can answer these without hesitation. An uncertain answer is a reason to follow up.

What a clinic should be able to tell you

A clinic with a documented position can answer these without leaving the room:

  • which AI tool is involved, and its name;
  • whether the clinic has approved it, or whether a staff member is using it informally;
  • what data it processes, including audio, notes, images and correspondence;
  • which supplier holds the data, and whether it stays in the UK;
  • whether the supplier uses the data to train or improve AI models;
  • how long recordings, transcripts and drafts are kept;
  • which clinician reviews the AI output before it enters your record;
  • whether you can decline the tool, and what happens if you do.

Hesitation on one of these is not evidence of wrongdoing. It is a reason to ask a second question.

What this page is not

General information, not legal advice, clinical advice, a complaints service, or a judgement on any clinic. If you have a specific concern, ask the clinic for its privacy notice and its data protection contact.