Last updated: 16 August 2026
This Privacy Policy explains how Hikayat AI Ltd (“Hikayat”, “we”, “us”) collects, uses and protects personal data through Hikayat Scribe (hikayatai.com and www.hikayatai.com), an AI clinical documentation assistant for doctors.
Hikayat AI Ltd is a private limited company registered in England and Wales, company number 17401822.
Hikayat Scribe is used by clinicians (“Customer”, “you”, “the doctor”) to record or dictate consultations and generate structured draft clinical notes. There are two different roles Hikayat plays under UK GDPR, and it is important to be clear about which applies to which data:
We collect:
We do not store audio. When you record or dictate, your browser uploads short (roughly 90-second) audio segments to our server, which sends them to our transcription provider to be converted to text. The audio itself is never written to our database or disk - it is discarded as soon as the text transcript is returned. Only the resulting text is kept.
We use a small number of specialist providers to run the service. Each only receives the data it needs to perform its function:
Most of our clinicians are in South Asia and the Middle East, so in practice the most relevant fact is this: your data is processed in the United States by our transcription and note-generation providers (OpenAI and Anthropic), and our hosting providers (Vercel, Neon) are US-based companies. We require all of these providers to protect your data under standard contractual data protection terms - each of OpenAI, Anthropic, Vercel and Neon publishes a Data Processing Addendum that incorporates the EU Standard Contractual Clauses as its transfer safeguard, and we rely on those terms. As a UK-registered company, this arrangement also satisfies our own obligation under UK GDPR when we transfer data outside the UK/EEA. We are continuing to review specific data protection requirements as they develop in the jurisdictions where our clinicians practice, and we will update this policy as that picture becomes clearer. We do not sell your data, and we do not share it with any other third party for marketing purposes.
Consultation transcripts and notes are retained for 180 days from creation, after which they are automatically and permanently deleted. Account data is kept for as long as your account is active, plus a reasonable period after closure to meet legal and accounting obligations. Audit logs are kept for security and accountability purposes.
Clinical data (transcripts, generated notes, patient reference text) is encrypted at the field level (AES-256-GCM) before it is stored in our database. All traffic to and from the app is encrypted in transit (TLS). We keep an audit log of access to clinical records (who viewed, generated or deleted what, when, and from where). No system is completely secure, but we take reasonable technical and organizational measures to protect your data.
If you are the controller of the data (your own account data, or your patients’ data if you are the doctor), UK GDPR gives you the right to:
To exercise any of these rights, email ceo@hikayatai.com. If you are a patient and have a query about a consultation recorded about you, please contact the doctor or clinic who recorded it directly - they are the controller of that data.
Hikayat Scribe is intended for use by licensed healthcare professionals, not by children, and we do not knowingly collect account data from children. Consultation content processed on a doctor’s behalf may include information about a minor patient; responsibility for the lawful basis, consent and appropriate handling of that data rests with the treating doctor/clinic as the data controller.
Hikayat Scribe uses only the cookies strictly necessary to keep you signed in and to operate the service securely. We do not currently use analytics, advertising or third-party tracking cookies.
We may update this policy from time to time, for example as the product or our sub-processors change. We will update the “Last updated” date above when we do. Material changes will be communicated to account holders.
For any question about this policy or your data, email ceo@hikayatai.com.