Last updated 25 September 2026
ScribeAI is operated by Pharoah Technology Ltd (company no. 17220127), registered at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. For anything in this policy, contact info@pharoahtechnology.co.uk.
This policy describes exactly what happens to what you type into ScribeAI. It is written to match how the service is actually built, not how we would like it to sound.
Before you paste anything: ScribeAI does not offer a Business Associate Agreement, is not marketed as HIPAA-compliant, and is not a clinical system of record. De-identify transcripts before dictating. Do not enter names, dates of birth, NHS or insurance numbers, addresses, or anything else that identifies a patient.
When you generate a note, the transcript travels in a single request from your browser to
our /api/generate endpoint, and from there to our AI provider. The generated note
comes straight back to your browser.
Once the response is returned, the note exists only where you put it — your own records — and in your browser tab until you close it.
To stop one visitor exhausting the free service, we count how many notes are generated from your IP address each day. The count is stored in our database under a key made of the product name, your IP address and the date. It is never combined with your transcript, is used for nothing else, and is deleted within two days. On a paid plan, your monthly use is counted against your random licence number instead.
If you buy the Solo Provider plan, you pay on Stripe's checkout page. Stripe collects your payment details, email address and billing information; we never see your full card number. When you return, we read the checkout session from Stripe to confirm the payment, and Stripe also notifies our payment ledger, where we record the product, the amount, the date, your Stripe customer reference and your email address, so that we can support you and keep accounts. We keep payment records for as long as the law requires us to keep accounting records, currently six years. Our lawful bases are performing our contract with you and our legal obligations.
The plan is unlocked by a signed licence that your browser keeps in its local storage, not in a cookie. It holds the product, the plan, an expiry date and a random licence number, and does not contain your name, your email address or anything you dictate. Stripe's checkout pages are on Stripe's own website and use Stripe's own cookies, for example for fraud prevention.
Our hosting provider, Cloudflare, processes standard connection data (such as IP address) to deliver and protect the site, as any web host does.
Health data is "special category" data under the UK GDPR (Article 9) and needs a higher bar than ordinary personal data. ScribeAI is built on the assumption that you de-identify before you dictate, so that no special category personal data reaches us at all. If you paste identifiable patient information despite the warnings, you do so as the controller of that data, and you are responsible for having a lawful basis for it.
Where we process any personal data of yours (for example the IP-based rate count, or an email you send us), our lawful basis is legitimate interests — running, protecting and supporting the service — under Article 6(1)(f) UK GDPR.
These providers may process data outside the UK. Where they do, transfers rely on the safeguards in Article 46 UK GDPR, such as standard contractual clauses or an adequacy decision.
Transcripts and notes: not retained. The rate-limit count: until the server process recycles. Email you send us: kept only as long as needed to answer you.
ScribeAI sets no advertising or analytics cookies and embeds no third-party trackers.
You have the right to access, rectify, erase, restrict, object to and port your personal data. Because we do not store transcripts or hold accounts, in most cases we simply have nothing to return or erase. Email info@pharoahtechnology.co.uk and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
If this policy changes we will update the date at the top of this page.