Skip to content
Legal

Privacy Policy

Effective 20 October 2026

Privacy Policy

How we protect and handle your personal data

Effective date: 20 October 2026

Last updated: 20 October 2026

Docyment respects your privacy and is committed to safeguarding personal data entrusted to us by clinicians, their patients, and website visitors. This Privacy Policy explains what we collect, how we use it, and the choices you have.

1) We're here to help. Get in touch.

If you have questions about how we handle your information, or you want to exercise your rights, please contact us:

You can contact us to:

  • ask questions
  • update your information
  • update or delete your Docyment Platform account
  • change your preferences (e.g., marketing)
  • register a concern or complaint
  • opt out of marketing
  • exercise your data protection rights (see Section 11)

If you're not satisfied with our response, you have the right to contact the Information Commissioner's Office (ICO) at ico.org.uk.

2) About us

  • "Docyment", "we", "our", or "us" means Docyment Ltd (Company No. 16697940) of 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, UK.
  • Our services means the provision of the Docyment Platform and related services to qualified medical practitioners and healthcare organisations (together, "Practitioners").
  • The "Platform" is our web and/or mobile application(s) made available to Practitioners for clinical documentation support.
  • "You" means the reader of this policy (e.g., a Practitioner user, website visitor, job applicant, or other individual interacting with us).
  • "Your information" means personal data about you.
  • "Privacy laws" means UK GDPR, the Data Protection Act 2018, and other applicable data protection and health information laws.

Data controller vs data processor

Depending on the context, Docyment may act as:

  • Data Controller: for personal data we collect about Practitioners, website visitors, billing contacts, and for our own analytics/operations.
  • Data Processor: for patient data that Practitioners input to, or generate via, the Platform. In this case, the Practitioner (or their clinic/organisation) is the Data Controller, and Docyment processes data on their instructions, under a Data Processing Agreement (DPA).

If you're a patient and your clinician uses Docyment, please contact your clinician (the controller) first regarding your personal data. We will support them in responding.

3) What information do we collect?

We collect and hold the following categories of information, including personal information, health information, payment information, device information, and general information to help us improve our services.

When you access and use our website, Platform, or other services, we collect and hold the following main categories of information as detailed in the table below. The collection of extensive data sets, including device information, is crucial for enhancing user experience, optimising service functionality, and ensuring robust security measures. We process such information based on legitimate interests, improving our services and maintaining security, and where applicable, through explicit consent, which is transparently obtained at the point of data collection. If you choose not to provide the requested information, it may impact our ability to deliver these services to you fully.

Category

Details

Your general personal information

Name, professional role/title, clinic name, postal address, country, email, phone, identity and verification data; where you are a Practitioner, we may collect details of your qualifications, registrations, training, and professional background.

Account, usage & support data

Account credentials (hashed), preferences, audit logs, event logs, feature usage, support tickets, communications with us.

Payment & billing information

Billing contact details, invoicing and transaction records; for card payments we rely on a compliant payment processor. We do not store full card numbers.

Sensitive health information

Health information uploaded or generated by Practitioners in the course of care (e.g., HPI, PMH, medications, results, clinical letters). This is processed under the Practitioner's control. Where we must process it to provide the Platform, we apply the safeguards described in our Trust and Security page. No patient data is used to train, develop, or improve our AI models.

Device & technical information

Device ID, device type, operating system, browser type, IP address, approximate location (from IP), timestamps, crash reports, cookies and similar technologies (see Section 9).

Additional information you provide

Survey responses, feedback, product research participation, marketing preferences.

Business improvement (product-usage analytics)

We use product-usage analytics (such as page views and usage and cost counts) to run and improve the Service. We do not use clinical content to train or evaluate our own AI models.

Recruitment data

If you apply for a job: CV, cover letter, contact details, work history, references, right-to-work checks, and (where appropriate) background checks.

If you choose not to provide certain data, we may be unable to deliver parts of the Platform or support you fully.

4) How do we collect your information?

  • Directly from you: when you register, sign in, contact support, complete forms, or interact with the Platform and website.
  • Automatically: via cookies, SDKs, logs, and similar technologies when you browse or use the Platform (see Section 9).
  • From third parties:
  • payment processors (for billing status)
  • your employer/clinic (for enterprise onboarding)
  • recruitment agencies and referees (for applicants)

5) How do we use your information?

We adhere to privacy by design principles by integrating data protection from the outset of designing our systems and business practices. Our measures include robust encryption, stringent access controls, and continuous threat monitoring.

Main purposes and legal bases

Purpose

Examples

Legal basis (UK GDPR)

Access & account management

Create and manage your user account; authenticate users; provide core functionality.

Contract (Art. 6(1)(b)); Legitimate interests (service security)

Service delivery

Generate draft clinical letters; store drafts; provide collaboration and audit trails under the Controller's instructions.

Contract; Legitimate interests; Special category data processed under Art. 9(2)(h) (healthcare) when acting for the Controller

Support & communications

Respond to queries; service notices; security alerts; product changes.

Legitimate interests; Legal obligation where applicable

Marketing

Send updates and offers to Practitioners/contacts (no PHI used).

Consent (where required); Legitimate interests with opt-out

Legal & compliance

Detect, prevent and investigate misuse, fraud or security incidents; comply with legal obligations.

Legal obligation; Legitimate interests

Recruitment

Assess applications, run checks where appropriate.

Legitimate interests; Legal obligation

AI model training: For the avoidance of doubt, we do not use any patient data to train, develop, or improve our AI models.

If we intend to use data in a way not described here, we will update this notice and, where required, seek your consent.

6) Marketing and how to opt out

We may send you direct marketing communications and information about our services or products. This may take the form of emails or other forms of communication. We'll always conduct our marketing practices in accordance with privacy laws and other applicable laws.

If we do send you marketing messages using your information, you'll be able to opt out at any time. We may also market our services to you generally – including via social media, advertising through our website and other digital or non-digital platforms. We'll always do this in accordance with our legal requirements. You can opt out at any time by:

Without your consent, we will not:

  • use any of your health information to send you marketing communications; or
  • disclose any of your information to a third party in order for them to market to you.

7) Do we store or share information outside of your country?

Your personal information is primarily stored in the UK

We recognise the importance of data security and privacy and are committed to protecting your information. For customers located in the United Kingdom, Patient records, documents and temporary audio are stored in London. To serve requests and produce documents, clinical content is processed in the United States by our hosting provider (Vercel) and our AI providers (OpenAI and AssemblyAI). Each transfer outside the UK is protected: Vercel and Stripe are certified under the UK Extension to the EU-U.S. Data Privacy Framework; OpenAI and AssemblyAI use the EU Standard Contractual Clauses with the UK Addendum; Brevo processes data in the EEA, which is covered by UK adequacy regulations; other transfers use appropriate safeguards under UK GDPR Article 46, such as the UK International Data Transfer Addendum. Our sub-processor list shows the safeguard for each provider. Certain features rely on AI and transcription processors (see Section 15) that may involve processing outside the UK or EEA. Where personal data is transferred outside the UK or EEA, Docyment uses appropriate safeguards such as contractual protections and transfer mechanisms required by applicable data protection law.

Some functionalities of our Platform rely on third-party service providers. Such processing is governed by data processing agreements that enforce strict compliance with UK GDPR and the Data Protection Act 2018. These agreements ensure that your personal data remains secure, confidential, and protected against unauthorised access or disclosure, while enabling us to provide essential functionalities through trusted service providers.

Enterprise customers can request our Data Processing Addendum and Sub-processor List: DPA | Sub-processors

8) Who do we share your information with?

We may share your personal information with our other partners and for other reasons we tell you about in this policy, on our website, on our Platform or where we otherwise communicate this to you.

We may share your personal information with:

  • our employees and related companies;
  • third party suppliers and service providers (including providers for the operation of our Platform, websites and/or our business) - see our sub-processor list;
  • professional advisers, dealers and agents;
  • payment systems operators (e.g., merchants receiving card payments);
  • anyone to whom our assets or businesses (or any part of them) are transferred;
  • specific third parties authorised by you to receive information held by us, and other parties involved in the delivery of healthcare services; and/or
  • other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law.

We require recipients to handle personal data securely and lawfully in accordance with applicable data protection laws.

9) Cookies and similar technologies

Our website and Platform use cookies and similar technologies to operate, secure, and improve the service.

Cookie categories

  • Strictly necessary (authentication, security, load-balancing)
  • Functional (remembering preferences)
  • Performance/analytics (aggregate usage, no PHI)
  • Marketing (only with consent; never using PHI)

You can configure your internet browser to accept all cookies, reject all cookies or notify you when a cookie is sent. If you refuse the use of cookies in this way you may not be able to access the full functionality of our website. Please refer to your internet browser's instructions or help screens to learn more about these functions.

We may also use third-party analytics tools to help us gather and analyse information about your use of our website and Platform. These tools assist us in understanding usage patterns, improving user experience, and optimising the performance of our services. For the avoidance of doubt, no Protected Health Information (PHI) or sensitive health information is shared with or transmitted to third-party analytics tools for these purposes. Any information collected through these tools is limited to non-sensitive data and does not include any details that could identify patients or relate to their health conditions, treatment, or care.

Cookie details & lifetimes: see Cookie Policy.

10) How do we protect your information?

We employ administrative, technical and physical safeguards appropriate to the sensitivity of the data.

Measure

Summary

Encryption

Encrypted in transit (TLS 1.2 or higher) and encrypted at rest by our database provider.

Access controls

Role-based access and least privilege. Docyment staff use company accounts with 2-step verification enforced. Users who sign in with email and password must set up two-step verification before accessing patient data; Apple sign-in is protected by the two-factor authentication Apple requires; Google sign-in relies on the security of your Google account. Audit logging of consequential actions.

Data separation

Logical separation of customer data; environment segmentation.

Vulnerability management

Regular patching and code review.

Monitoring & incident response

Logging and an incident response process with customer notification obligations.

Backups & continuity

Database backups provided by our database hosting provider.

Staff training

Confidentiality obligations for staff.

Further details: Security Whitepaper / Trust Center.

11) Your rights

Subject to conditions and exemptions under UK GDPR, you have rights to:

  • Access your personal data
  • Rectify inaccurate or incomplete data
  • Erase your data (right to be forgotten)
  • Restrict processing
  • Object to processing (including where based on legitimate interests or direct marketing)
  • Data portability
  • Withdraw consent (where processing is based on consent)

How to exercise your rights: When you contact us regarding a request for access, correction, erasure, or to make a complaint, or if you wish to object to processing, withdraw consent, or request data portability, please include your name and contact details (such as email address and phone number) and clearly describe your request. We are committed to addressing your enquiries promptly and will acknowledge receipt of your correspondence swiftly. We aim to respond within one month. If we are unable to fulfil your request due to legal or other reasons, we will explain why. Verification of your identity may be required to protect your information and ensure it is not disclosed improperly.

Contact us: Email privacy@docyment.com with your requests or questions.

  • Patients: please contact your clinician (data controller) first; we will support them in fulfilling your request.
  • Complaints: If you are not satisfied with how we handle your query or manage your information, including our response to your requests, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to address your concerns first.

12) How long do we keep your information?

We retain personal data only as long as necessary for the purposes set out in this policy, in accordance with UK GDPR principles of data minimisation and storage limitation.

Data Type

Retention Period

Legal Basis

Practitioner account data

Kept while your account is active. Deleted or anonymised when you ask us to delete your account; otherwise reviewed at least once a year

Legitimate interests (audit trail, dispute resolution)

Billing & payment records

7 years after final transaction

Legal obligation (UK tax & accounting law)

Support tickets & communications

Kept only as long as needed and reviewed at least once a year

Legitimate interests (service improvement, support history)

System logs & audit trails

Kept only as long as needed and reviewed at least once a year

Legitimate interests (security monitoring, compliance)

Marketing data (with consent)

Until consent is withdrawn

Consent

Patient data (as Processor)

As instructed by the Data Controller

Processing instructions from Controller

Patient clinical records are controlled by the clinic or organisation that uses Docyment, which is the data controller for them. Each clinic sets how long its clinical records are kept, in line with UK clinical record-keeping rules, which often require 8 years or more. Docyment never deletes clinical records automatically. They are deleted or exported only on the clinic's instructions.

We will publish defined retention periods once automated clean-up is in place. Until then, we review our retention practices at least once a year and will securely delete or anonymise personal data when it is no longer needed. You may request earlier deletion by contacting privacy@docyment.com, subject to our legal and contractual obligations.

13) Children

The Platform is intended for use by Practitioners and healthcare organisations, not by children directly. We do not knowingly collect personal data from children as end-users of the Platform. Patient data may include information about children processed under the Controller's instructions for the provision of care.

14) Employees & applicants

If you are a current/former employee or an applicant, we may process:

  • General personal data: name, contact details, image, identifiers
  • Educational & professional information: qualifications, references, memberships
  • Sensitive information (where lawful): health information, certain criminal background data (where role-appropriate)
  • Financial information: bank details, tax status
  • Work-related information: performance, training, compliance records

Contact people@docyment.com or privacy@docyment.com for our Employee Privacy Notice.

15) Key service providers

Docyment Ltd is a standalone company. We work with trusted third-party service providers to deliver our Platform:

  • Data Controller: Docyment Ltd (Company No. 16697940), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, UK.
  • Hosting & Infrastructure: Vercel (for website and application hosting)
  • Database Services: Supabase (for secure data storage and management)
  • AI & Transcription: OpenAI and AssemblyAI (for transcription, extraction, and clinical document generation) Email: Brevo (account and service emails). WhatsApp messaging, where a clinic enables it: Meta. Payments: Stripe and, for iPhone subscriptions, Apple. On desktop web and in our iPhone and Android apps, audio is streamed for live transcription and is not saved. If you use the web app in a phone browser, the recording is stored temporarily in London and deleted automatically, normally within 28 hours.
  • Additional sub-processors: See our complete sub-processor list

AI and transcription processors

When a Practitioner uses dictation, recording, writing, scanning, extraction, or document generation features, Docyment may send relevant clinical content, audio recordings, scanned images, transcribed text, generated draft documents, selected patient context, relevant prior clinical notes, and the Practitioner's professional identity to AI and transcription processors including OpenAI and AssemblyAI. These processors are used only to provide transcription, extraction, clinical document generation, and document review. Patient data is not used to train, develop, or improve AI models.

These service providers process personal data on our behalf under strict contractual agreements that require them to protect your data and use it only as instructed by us. We regularly review and assess our service providers to ensure they maintain appropriate security standards.

16) Third-party services & integrations

If you choose to connect Docyment with third-party services (e.g., EHRs, cloud storage, identity providers), their collection and use of your data is governed by their privacy policies. You are responsible for reviewing and managing those integrations.

  • Current sub-processors: See our comprehensive sub-processor list for full details including locations, purposes, and data protection safeguards

We do not transmit PHI/sensitive health data to third-party analytics tools for marketing or product analytics.

17) Automated decision-making

Docyment may use automated processing to suggest structure or phrasing in clinical documents. These features do not make clinical decisions: they are assistive and remain under the control and professional judgement of the Practitioner. We do not engage in automated decision-making producing legal or similarly significant effects about individuals.

18) Data Protection Officer

Our Data Protection Officer is Dr Sherif Darwish, who is also our Senior Information Risk Owner. Contact: privacy@docyment.com.

19) Changes to this policy

If we need to change this policy in a way that affects the way we handle your information, if you use our Platform, you'll receive an alert from us. We will also publish the changes to it on our website. We encourage you to check our website periodically to ensure that you are aware of our current Privacy Policy. The latest version will always be available at: docyment.com/legal/privacy-policy.

20) Key commitments (at a glance)

  • No model training on patient data.
  • Patient data stored in London; some processing in the United States with appropriate safeguards.
  • Strong security: encryption in transit/at rest, access controls, monitoring, incident response.
  • Clear roles: Controller (our own data) vs Processor (patient data for Practitioners).
  • Your rights respected under UK GDPR.

Helpful links