Last updated 17 August 2026
ScribeAI is operated by Pharoah Technology Ltd (company no. 17220127), registered at 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. For anything in this policy, contact info@pharoahtechnology.co.uk.
This policy describes exactly what happens to what you type into ScribeAI. It is written to match how the service is actually built, not how we would like it to sound.
Before you paste anything: ScribeAI does not offer a Business Associate Agreement, is not marketed as HIPAA-compliant, and is not a clinical system of record. De-identify transcripts before dictating. Do not enter names, dates of birth, NHS or insurance numbers, addresses, or anything else that identifies a patient.
When you generate a note, the transcript travels in a single request from your browser to
our /api/generate endpoint, and from there to our AI provider. The generated note
comes straight back to your browser.
Once the response is returned, the note exists only where you put it — your own records — and in your browser tab until you close it.
To stop one visitor exhausting a free service, the server keeps a short-lived count of how many notes have been generated from your IP address today. It is held in memory only, it is discarded when the server process recycles, and it is never combined with your transcript or used to identify you.
Our hosting provider, Cloudflare, processes standard connection data (such as IP address) to deliver and protect the site, as any web host does.
Health data is "special category" data under the UK GDPR (Article 9) and needs a higher bar than ordinary personal data. ScribeAI is built on the assumption that you de-identify before you dictate, so that no special category personal data reaches us at all. If you paste identifiable patient information despite the warnings, you do so as the controller of that data, and you are responsible for having a lawful basis for it.
Where we process any personal data of yours (for example the IP-based rate count, or an email you send us), our lawful basis is legitimate interests — running, protecting and supporting the service — under Article 6(1)(f) UK GDPR.
These providers may process data outside the UK. Where they do, transfers rely on the safeguards in Article 46 UK GDPR, such as standard contractual clauses or an adequacy decision.
Transcripts and notes: not retained. The rate-limit count: until the server process recycles. Email you send us: kept only as long as needed to answer you.
ScribeAI sets no advertising or analytics cookies and embeds no third-party trackers.
You have the right to access, rectify, erase, restrict, object to and port your personal data. Because we do not store transcripts or hold accounts, in most cases we simply have nothing to return or erase. Email info@pharoahtechnology.co.uk and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.
If this policy changes we will update the date at the top of this page.