Patient checklist
- 01
Will any AI tool be used in my care or in handling my information?
- 02
What type of AI tool is being used, for example scribe, transcription, triage, imaging, admin or communication?
- 03
What data will it process, such as audio, notes, letters, images, scans, test results or forms?
- 04
What is the name of the supplier?
- 05
Is the tool formally approved by the clinic?
Why this matters: free consumer versions of AI tools often allow the supplier to retain and use input data. Professional or enterprise versions typically have contracts that prevent this.
- 06
Will my data stay in the UK or be processed overseas?
Why this matters: if your data is processed outside the UK, different data protection standards may apply. Your clinic should know where its supplier's systems are hosted.
- 07
Will my data be used to train or improve AI models?
Why this matters: using your data for AI development is a secondary purpose. If this applies, the clinic should be able to tell you and explain the legal basis for doing so.
- 08
Who checks the AI output before it affects my care or medical record?
- 09
How long are recordings, transcripts and draft outputs kept?
- 10
Can I ask for the tool not to be used, and what happens if I do?
Why this matters: you have the right to decline. A well-governed clinic will not make your care shorter, less thorough or more difficult if you exercise this right.
- 11
If the AI produces an inaccurate note or letter, what happens?
Why this matters: AI tools can produce drafts that misrepresent what was said. You have the right to ask for corrections to your health record.
- 12
Who do I contact if I want to raise a concern about how my data was handled?
The clinic should be able to give you the name or role of its data protection contact.
How to ask without sounding difficult
Before we start, could you tell me whether any AI transcription, recording or summarisation tool will be used today? I am not objecting automatically, but I would like to understand what tool is used, whether the note is checked by a clinician, and whether any audio or transcript is kept.
If you are not satisfied with the answer
A clinic that has thought about AI governance will be able to answer most of these questions clearly. If staff cannot name the tool, cannot explain what happens to your data, or suggest that declining is not an option, these are worth following up. You can:
- ask to speak to the practice manager;
- request a copy of the clinic's privacy notice;
- ask for the name or contact details of the clinic's data protection lead.
None of this means a problem exists. It means you are asking the right questions.
What this page is not
General information, not legal advice, a complaints service, or a judgement on any clinic.
For clinic owners and managers
If patients, DPOs, insurers or CQC asked how AI is controlled in your clinic, could you show the evidence? ELSA AI helps private clinics discover, evidence and govern AI tools already in use.