Privacy Notice

1. Who we are and who controls your data

This notice covers two data controllers whose activities are connected through the Patient Thread platform. Depending on how you interact with us, one or both entities may hold data about you.

Both companies are registered with the Information Commissioner's Office (ICO). Lawrence Medical Limited's ICO registration number is ZA053166.

To contact us about your data: chris@patientthread.com

2. What data we collect and why

A. Clinician and practice data

Patient Thread Ltd is the data controller for this category.

When a clinician or practice subscribes to Patient Thread, we collect:

• Name, email address, and professional registration number (GMC or equivalent)
• Practice name, address and specialty
• Billing information (card details are processed by Stripe — we do not store them)
• Account activity and usage logs
• Communications with our support team

We use this data to provide and administer your subscription, issue invoices, communicate service updates, and comply with our legal obligations.

B. Patient data

Lawrence Medical Limited is the data controller for this category.

When Patient Thread is used to manage patient care, the following categories of personal data are processed:

• Identity and contact data: name, date of birth, NHS number, email address, telephone number, home address
• Clinical data (special category): diagnoses, medications, laboratory results, consultation notes, clinic letters, correspondence with GPs and other clinicians, and imaging reports
• Patient-contributed data: results, symptoms, and health information that patients upload directly to their own record within the Patient Thread app
• Video consultation data: audio and video recordings made during video consultations, retained only until the transcript is successfully written and then deleted (see section 3)
• Access audit data: records of who accessed each patient record and when, retained as an immutable audit trail

C. AI scribe and video transcription

Where the AI clinical scribe feature is used during your consultation, the audio is transmitted to a third-party transcription service (Deepgram) and converted to text. Before that text is passed to an AI system (Anthropic Claude) for draft note generation, all known patient identifiers — including name, NHS number, and dates of birth — are automatically replaced with anonymised placeholders. Claude therefore receives pseudonymised clinical content only, not identifiable data. The raw audio is deleted as soon as the transcript is written. The transcript itself is not stored. The AI-generated draft note is reviewed and edited by your clinician before forming any part of your permanent record.

3. How long we keep your data

• Clinician account data: retained for the duration of your subscription and for seven years after termination, to comply with financial and legal record-keeping obligations.
• Clinical patient records: retained in accordance with the NHS Records Management Code of Practice 2021. For adult patients, a minimum of eight years from the date of last treatment, or age 25 if that is longer. For children and young people, until the patient's 25th birthday or eight years after last treatment, whichever is later.
• Raw video and audio recordings: deleted within 24 hours of successful transcription, or within 30 days if transcription fails.
• Consultation transcripts: not retained. The raw transcript is used transiently to generate a draft clinical note and then discarded. It is never written to persistent storage.
• AI-generated draft consultation notes: retained as part of the clinical record once reviewed and accepted by the clinician, subject to the same retention schedule as other consultation notes.
• Audit logs: retained for seven years.

4. Who we share your data with

We do not sell personal data. We share data only with sub-processors engaged to deliver the Patient Thread service. All sub-processors are bound by data processing agreements requiring them to process data only on our written instructions and to maintain appropriate security standards.

We may also disclose personal data where required to do so by law, by court order, or where necessary to protect the vital interests of a patient.

5. International data transfers

Several of our sub-processors are headquartered in the United States. The United Kingdom has not adopted a general adequacy decision covering US organisations. Where we transfer personal data to US-based processors, we rely on the UK International Data Transfer Agreement (UK IDTA) or the equivalent approved transfer mechanism incorporated into each sub-processor's data processing agreement.

Clinical audio and consultation content transmitted to Anthropic (Claude) and Deepgram is processed solely for the purpose of generating a draft clinical note. Neither processor retains data beyond the duration of the immediate processing request, in accordance with their respective data processing agreements and usage policies.

All primary patient record data is stored on European infrastructure (Frankfurt, Germany) and does not leave the European Economic Area for storage purposes.

6. Security

We implement the following technical and organisational measures to protect personal data:

• Row-level security enforced at the database layer: no database query can return data outside the clinician's own organisation
• TLS encryption in transit for all data
• AES-256 encryption at rest on European infrastructure
• All privileged operations executed server-side; the iOS and web apps use only a scoped public key with no administrative privileges
• Immutable audit logging of all patient record access, including timestamp, clinician identity and organisation
• No patient data stored on-device beyond active session

In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and affected individuals without undue delay where the risk is high.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, contact us at chris@patientthread.com. We will respond within one calendar month. There is no charge for making a request.

8. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at chris@patientthread.com. We take all complaints seriously and will respond within 14 days.

You also have the right to lodge a complaint directly with the Information Commissioner's Office:

9. Cookies

The Patient Thread web application uses only technically necessary session cookies required for authentication. We do not use advertising, analytics, or tracking cookies. No cookie consent banner is required.

The patientthread.com marketing website does not set any cookies.

10. Changes to this notice

We will notify registered clinicians by email of any material changes to this privacy notice. The version date at the top of this page will always reflect the most recent update. Previous versions are available on request.