Information processed to deliver an individual patient's care is not automatically available for every later use. Quality improvement, product development, research and model training may involve different purposes, recipients and safeguards. A service should assess each proposed use explicitly rather than treating the original care relationship as permission for an unlimited data pipeline.
This UK-focused article is dated 10 October 2026, with NHS examples in England. The ICO's purpose-limitation guidance is the starting point: establish why personal information is processed and assess subsequent uses appropriately. This is not a claim that every secondary use is prohibited or that consent is the only possible legal route.
Follow the purpose as the data moves
Consider a fictional clinic using an approved AI scribe. The recording supports a draft note, the clinician checks it and the approved record supports continuing care. Later, the supplier proposes keeping selected transcripts to improve its summarisation system across customers.
The information may look identical, but the proposed purpose has changed. The people benefiting, the recipients, the retention period and the extent of patient identifiability may also differ. Those changes deserve assessment rather than a statement that the data already entered the platform legitimately.
A useful question is: would the service process this information in this way if it were not trying to improve or develop the product? If not, the new activity should not be casually described as necessary to complete that patient's consultation. This is a practical analysis tool, not a substitute for the applicable legal test.
Quality improvement is not one undifferentiated category
Checking an individual output before it reaches the record differs from reviewing a sample of encounters to understand local service quality. Both differ from developing a commercial model for wider deployment. A label such as quality improvement may cover very different arrangements.
The assessment should identify the actual activity. Who selects the records? Who sees them? Are reviewers examining identifiable conversations, extracted features or genuinely anonymised material? Does the work change the patient's care, the local service or a product used elsewhere?
None of these questions assumes a bad purpose. Improving systems can be valuable. The point is to make the purpose and its information requirements visible, rather than allowing a broad beneficial label to hide decisions about access and reuse.
Separate training from deployment and monitoring
The ICO's response on purpose limitation in the generative-AI lifecycle distinguishes purposes across development and deployment. That material is regulatory guidance and consultation analysis, not a declaration that every model-training arrangement has the same legal answer.
For a healthcare service, distinguish running the model on the current prompt, monitoring service reliability, investigating a specific error, evaluating performance and changing the model using retained examples. A promise not to train on patient information does not answer every monitoring or retention question. Equally, an approved evaluation process does not automatically authorise broader training.
A supplier should be able to describe which activities actually occur. Buyers should resist both extremes: assuming all improvement is harmless because it benefits future patients, or assuming every technical log is covert training. The evidence should establish the purpose rather than the article inventing it.
Use a purpose-by-purpose review
The following is a proposed review template for clinical, information-governance and supplier teams. It is not a completed assessment of any named platform.
| Proposed use | Questions requiring an answer |
|---|---|
| Individual care | What information is necessary to deliver this service to this patient? |
| Immediate output checking | Who checks the output, and what is retained after approval? |
| Local quality review | Which records are sampled, by whom and for what defined improvement? |
| Product evaluation | Does the work serve a different organisation or wider product purpose? |
| Model training | What information changes the model, and under what assessed arrangement? |
| Research | Which research provisions, governance and safeguards actually apply? |
| Service analytics | Can the purpose be achieved without identifiable clinical content? |
For each row, document the responsible organisation, legal and confidentiality assessment, information required, access, retention, transparency and relevant rights. A single paragraph saying "used to improve services" is unlikely to give a buyer the operational detail needed to understand these distinctions.
Research status does not resolve every question
A project should not become automatically acceptable because it is described as research. The ICO's guidance on research provisions explains the need to consider the relevant grounds and safeguards. Applicable research arrangements must be established for the actual activity, rather than inferred from an intention to publish.
Likewise, the use of anonymised information requires a credible anonymisation assessment. Pseudonymised transcripts may still be personal data, and distinctive clinical narratives can retain identifying detail. Anonymisation itself also involves handling the original information, so the process and responsible party need to be understood.
For the fictional clinic, the supplier might propose several alternatives: a smaller authorised sample, a genuinely anonymised dataset, synthetic examples or a different evaluation design. These are options to assess, not automatic solutions. The chosen method should preserve enough information to answer the research question without treating more data as inherently better.
Explain the arrangement in terms patients can understand
A privacy explanation should distinguish the care service from optional or separately assessed uses where relevant. Avoid implying that refusing a particular additional use necessarily means refusing all care unless that is genuinely the service's lawful and explained position.
The NHS ambient-scribing guidance, checked on 10 October 2026, describes the individual-care processing arrangement and the need to examine purposes beyond it. It should not be quoted as blanket permission to retain consultations for general product development.
Patients and staff need an accurate account of who uses the information and why. An explanation that focuses only on external model training may leave unanswered questions about the platform's own review team, analytics provider or retained support records. Transparency should follow the complete process, not just the most reassuring part of it.
Reassess when the business model or feature changes
A product can acquire new purposes without changing its visible interface. A supplier may add benchmarking across organisations, new evaluation services or a different training arrangement. A contract renewal should therefore include a review of material data-use changes, not merely price and user numbers.
A proposed change process should identify what is new, which information is affected and whether the existing assessment remains applicable. The organisation should know how it will be notified and what options it has if the new arrangement is unsuitable.
This standard applies to iatroX and other reference or learning platforms as well. A query used to answer a learning question should not be assumed available for unrelated purposes merely because it is not an EHR entry. iatroX's privacy policy, checked on 10 October 2026, is the relevant source for its stated processing, rather than an inference from the platform's clinical branding.
The constructive position is purpose-specific permission and accountability, not a blanket prohibition on learning from data. Better systems require useful evidence; trustworthy systems also explain how that evidence is obtained and why the use is justified.
Frequently asked questions
Can data collected for direct care automatically be used to train an AI model?
No automatic conclusion follows from the original care purpose. The proposed training use needs its own assessment of purpose, applicable grounds, confidentiality, safeguards and transparency.
Is every quality-improvement activity the same as research?
No; the actual purpose and activity matter. Labels should not replace a clear account of who uses which information and why.
Does removing names make secondary use unrestricted?
Not necessarily; the remaining information may still identify people. Pseudonymisation and effective anonymisation need to be distinguished before drawing conclusions about further use.
Explore clinical questions without transferring unnecessary patient detail →