Data Processing Agreement

Last updated: 16 August 2026

This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Hikayat AI Ltd (company number 17401822, registered in England and Wales) (“Hikayat”, “we”, the “Processor”) and the clinician or clinic using Hikayat Scribe (“you”, the “Customer”, the “Controller”). It governs our processing of personal data on your behalf under UK GDPR and the Data Protection Act 2018, and takes effect when you accept it at sign-up or by using the service to process patient data.

1. Roles

For the clinical data you process through Hikayat Scribe (consultation transcripts and the notes generated from them, including any patient identifiers you enter), you are the data controller and Hikayat is the data processor. You determine the purposes and means of processing your patients’ data; we process it only to provide the service, on your documented instructions (which include your configured use of the app). For your own account data, Hikayat is the controller, as described in our Privacy Policy.

2. Your responsibilities as Controller

• You are responsible for having a lawful basis to process your patients’ personal and special-category (health) data.
• You are responsible for obtaining your patients’ consent to be recorded before recording a consultation. The app requires you to confirm this consent before recording starts.
• You must not enter more identifying patient detail than is necessary for your records.
• You are responsible for compliance with the laws and professional/regulatory obligations that apply to you in the country where you practise.

3. Our obligations as Processor

We will:

• process the data only to provide the service and only on your instructions, and not for our own purposes;
• ensure persons authorised to process the data are bound by confidentiality;
• apply appropriate technical and organisational security measures (see Section 6);
• assist you, taking into account the nature of processing, with data-subject requests and with your security, breach-notification and impact-assessment obligations;
• make available information reasonably necessary to demonstrate compliance with this DPA;
• on termination, delete the data in line with the retention period below, unless we are legally required to retain it.

4. Sub-processors

You authorise Hikayat to engage the following sub-processors to provide the service. Each is engaged under a written agreement imposing data-protection obligations, and each publishes a Data Processing Addendum incorporating the EU Standard Contractual Clauses as its transfer safeguard:

• OpenAI (US) - speech-to-text transcription. Audio is processed transiently to produce text and is not stored by Hikayat.
• Anthropic (US) - generation of the structured clinical note from the transcript.
• Vercel (US) - application hosting.
• Neon (US) - database hosting.
• Firebase / Google - authentication, only for users who sign in with Google.

We will give you reasonable notice of any intended change to this list, giving you the opportunity to object.

5. International transfers

The sub-processors above are based in the United States, so data is processed there. Each operates under standard contractual data-protection terms (EU Standard Contractual Clauses) as described in our Privacy Policy. We do not sell your data or share it for marketing.

6. Security

Clinical data (transcripts, generated notes, patient reference text) is encrypted at the field level (AES-256-GCM) before storage. All traffic is encrypted in transit (TLS). We do not store audio - it is discarded once transcribed. We maintain an audit log of access to clinical records. Access requires an authenticated account.

7. Data breaches

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay after becoming aware, with the information reasonably available to us, so that you can meet your own notification obligations.

8. Retention and deletion

Consultation transcripts and notes are retained for 180 days and then automatically and permanently deleted. On termination of your account, or on your documented request, we will delete your clinical data in line with this period, unless retention is required by law.

9. Not a medical device

Hikayat Scribe is a clinical documentation aid, not a diagnostic device and not a substitute for clinical judgment. Every generated note is a draft you review, edit and approve. Nothing in this DPA makes Hikayat responsible for clinical decisions, which remain yours.

10. General

This DPA is governed by the laws of England and Wales. Where it conflicts with the Terms of Service on the subject of data protection, this DPA prevails. Clinics or hospital groups that require a separately countersigned copy can request one at ceo@hikayatai.com.