1. Scope and roles
AIspect (“we,” “us,” or “our”) provides a clinical dictation and radiology-reporting workspace for healthcare professionals and their organisations (the “Service”). This policy applies to the AIspect website, accounts, and Service.
Clinical information is entered into the Service by users acting for a healthcare organisation. That organisation is responsible for deciding whether and how the Service may be used with patient information, obtaining any required notices or permissions, and configuring access for its workforce. AIspect handles that information to provide the Service and as otherwise described here.
This policy does not replace a healthcare organisation’s own patient privacy notice or apply to third-party systems that users access separately.
2. Information we collect
2.1 Account and organisation information
- Account details: Name, email address, organisation name, role, account status, and securely hashed authentication credentials.
- Administration: Signup approval, membership, suspension, connection, and account-support records.
- Communications: Information provided when a user or organisation contacts us.
2.2 Clinical and workspace information
- Report data: Medical record numbers, procedure names, clinical indications, additional information, report drafts and versions, and finalisation status.
- Dictation data: Audio submitted for transcription, transcripts, uncertain-word markers, requested edits, and report-formatting inputs and outputs.
- Reference files: PDFs or images attached to reports, extracted text, and file-processing status.
- Workspace content: Report templates, headers and footers, snippets, highlight keywords, and user settings.
- Collaboration data: Connections, sharing recipients, access and revocation records, onward-sharing notices, and related activity.
2.3 Technical, security, and service information
- Session data: A random session token stored in an essential cookie; only a cryptographic hash of the token is stored in our database.
- Operational data: Request timing, provider/model identifiers, token or credit usage, error codes, and service diagnostics.
- Security records: Login, account-administration, report-access, and other audit events designed to support security and accountability.
- Infrastructure logs: Our hosting and network providers may process standard request data such as IP address, browser details, timestamps, and requested URLs to operate and secure the Service.
3. How we use information
- Create, authenticate, approve, administer, and secure accounts and organisations.
- Transcribe dictation, format and edit reports, extract text from selected reference files, and provide templates and other reporting features.
- Save report histories and support collaboration, sharing, notifications, and user-requested exports or copying.
- Operate, troubleshoot, monitor, and improve the reliability and safety of the Service.
- Respond to support, privacy, and security requests.
- Detect misuse, enforce our Terms of Service, comply with law, and protect users, patients, AIspect, and others.
4. AI and service providers
The providers and provider categories below are current as of the last-updated date. We disclose information to them only as needed to operate the Service, subject to applicable contracts and data-handling terms. If we add or replace a provider in a way that materially changes how personal information is handled, we will update this policy and provide any additional notice required by law.
4.1 Clinical processing providers
Our current clinical processing providers are:
- ElevenLabs: Receives dictation audio and related transcription settings to return text and word-level transcription information. Provider logging or retention depends on AIspect’s deployed account settings and provider terms.
- OpenAI: Receives transcripts, report context, report or template content, and selected extracted reference text when needed for report formatting, edits, discrepancy checks, or document text extraction. OpenAI states that API data is not used to train or improve its models unless the customer opts in. AIspect sends Responses API requests with application-state storage disabled (store: false); separate provider abuse-monitoring retention may still apply under OpenAI’s terms and AIspect’s account-level data controls.
4.2 Infrastructure and communications providers
- Hosting and database providers: Host the application and structured account, report, audit, and operational data.
- Private object-storage providers: Store uploaded report reference files using opaque storage keys.
- Resend: Receives an email address and password-reset message when a user requests a reset email.
4.3 Other disclosures
- Authorised recipients: Report or template content is disclosed to people with whom a user intentionally shares it, including approved cross-organisation connections where enabled.
- Legal and safety reasons: We may disclose information when reasonably necessary to comply with law, respond to valid legal process, investigate abuse, or protect rights and safety.
- Business transfers: Information may transfer as part of a merger, financing, reorganisation, or sale of all or part of the business, subject to appropriate confidentiality protections.
5. Clinical information and user responsibilities
Clinical report data may contain sensitive health information. Users and their organisations must submit only information they are authorised to handle in the Service and must not use development or test environments with identifiable patient information unless AIspect has expressly approved that use in writing.
AIspect does not use clinical content for advertising. We do not sell personal information. We do not use clinical content to train general-purpose AI models unless that practice is separately disclosed and expressly agreed; the current Service sends provider requests for the operational purposes described above.
7. Retention and deletion
We retain information while it is needed to provide and secure the Service, maintain report and audit histories, comply with legal or professional-record obligations, resolve disputes, and enforce agreements. Removing an attachment marks its database record as deleted and removes its private stored object through the Service’s deletion workflow. Other content may remain in report versions, audit records, backups, or records controlled by the user’s organisation.
Users should contact their organisation administrator and privacy@aispect.ai about access, correction, export, or deletion requests. We may need to preserve information where the organisation instructs us to do so or where law, patient-safety, security, or recordkeeping obligations require it.
TODO (business policy): Approve and publish specific retention and backup-deletion periods for account records, clinical reports and transcripts, attachments, provider diagnostics, audit logs, and rejected signup requests.
8. Security
We use technical and organisational safeguards designed for the sensitivity of the information processed. Current controls include approved-account access, role and resource checks, private object storage, hashed passwords and session tokens, revocable sessions, restricted server-side provider keys, audit records, and secure transport on the production Service.
No system can guarantee absolute security. Users must promptly report suspected unauthorised access to security@aispect.ai, avoid sharing credentials, and independently verify all clinical output before use.
9. International processing
AIspect and its providers may process information in countries other than the user’s or patient’s country. The customer organisation is responsible for confirming that its use of the Service and any cross-border disclosure is permitted. Where required, AIspect will use contractual or other lawful transfer mechanisms agreed with the customer.
TODO (business policy): Confirm supported data-hosting regions, the contracting entity’s role for each market, and the cross-border transfer mechanism offered to customers before making a residency or regulatory-compliance commitment.
10. Privacy rights and choices
Depending on location and context, individuals may have rights to request access, correction, deletion, restriction, objection, or a portable copy of personal information, or to complain to a privacy regulator. These rights may be limited by healthcare-record, legal, security, or organisational obligations.
For clinical information controlled by a healthcare organisation, contact that organisation first. You may also email privacy@aispect.ai. We may verify identity and consult the relevant organisation before responding.
12. Children
The Service is intended for authorised healthcare professionals and organisation administrators, not for use by children as account holders. Clinical reports may concern patients of any age when an authorised healthcare organisation lawfully submits that information.
13. Changes and contact
We may update this policy as the Service or legal requirements change. We will revise the date above and provide additional notice when required by law or when changes are material.
Privacy questions and requests: privacy@aispect.ai. Security reports: security@aispect.ai. General support: support@aispect.ai.
TODO (business policy): Add the full legal name and registered address of the AIspect contracting entity and, where required, its privacy representative or data protection officer.
This Privacy Policy is effective as of 2026-09-20.