Before putting patient information into an AI service, establish what the service will do with it. Clinical usefulness does not resolve information-governance questions, and a reassuring hosting location does not explain every processing activity.
The original information-governance question remains relevant after Sovereign Health: where does the information go, for what purpose and under whose control? Sovereign deployment adds detail to that enquiry rather than making it unnecessary.
This updated guide concerns UK professional use, with particular reference to NHS England's ambient-scribing guidance and sources reviewed on 19 October 2026. It is not permission to enter identifiable information into an unapproved account or a legal determination about a particular deployment.
Start with the task and the minimum information it needs
A general clinical-reference question does not necessarily require the story of a real patient. Preparing an accurate consultation record may require sensitive information and an approved workflow specifically designed to process it.
These are different uses even when both involve typing into a conversational interface. The service's name or medical branding does not decide which information may be sent.
For each proposed use, identify the purpose, the information necessary to achieve it and the environment in which it will be processed. Establish the applicable organisational arrangements before adding the record, not after a useful answer appears.
The NHS guidance for information-governance professionals provides a relevant starting point for the ambient-scribing use case. It should not be stretched into approval of every AI application.
A consultation can create several distinct information objects
Audio, a transcript, a generated note and the approved clinical record are not the same object. They may exist in different systems, serve different purposes and have different retention arrangements.
Operational information matters too. A support ticket, account identifier or processing log can contain information outside the final note. The absence of a formal record integration does not establish that no sensitive information leaves the organisation.
A practical assessment should therefore follow the data categories individually.
| Information category | Purpose to establish | Question not answered by its existence |
|---|---|---|
| Audio | Capture and speech processing | Whether it is retained after transcription |
| Transcript | Input to documentation or review | Whether every captured statement belongs in the permanent record |
| Generated draft | Material for authorised review | Whether a clinician has accepted its content |
| Approved note | Continuing clinical documentation | Whether temporary copies have been deleted |
| Operational logs | Reliability, security or investigation | Whether clinical content is necessary in those logs |
| Support material | Resolving a particular problem | Whether access and retention match the original care purpose |
This is an original assessment aid. The actual product may use a different architecture, so the organisation should obtain its own data-flow account.
Inference, retention and model improvement are separate activities
Inference is the processing that produces a response. Training or adaptation changes a model using examples. Keeping information for support, evaluation or security can be separate from both.
A promise not to train on patient data is valuable but should not be interpreted as no storage, no subprocessors or no human access. Each of those requires its own answer.
Tandem's security page states that patient and personal data are not used to train its models and that audio is deleted immediately after transcription. These are supplier commitments to examine within the selected arrangement, not proof that every other information category disappears at that moment.
Ask what the contract permits as well as what the marketing page prohibits. Broad labels such as improvement or analytics need enough detail to establish the information used, purpose and recipients.
Retention should follow purpose, not one platform-wide slogan
The approved clinical record may need to remain available while temporary material used to generate it no longer serves the same purpose. An unresolved incident can create a different need for relevant evidence.
The ICO's storage-limitation guidance requires a justified approach rather than a universal retention period for all data.
A useful arrangement identifies the information type, reason for keeping it, access restrictions, normal period and handling of exceptions. A delete button should not be treated as the full specification.
The organisation also needs to know what happens after a contract ends. Immediate loss of access and confirmed deletion are different events, as the portability article explains.
Add sovereignty without losing the rest of the assessment
A sovereignty review can examine infrastructure ownership, operating entities, processing locations, administrative access, model control and the ability to continue or switch services.
Those dimensions complement the purpose and retention questions. They do not replace them.
A UK address is not an automatic compliance conclusion, and overseas processing is not automatically prohibited. The applicable transfer arrangements and the actual entities involved need assessment. The UK clinician's cloud guide explains that distinction in more detail.
A product might satisfy an organisation's geographical requirement while permitting a secondary use that the organisation has not accepted. Another could have strong purpose restrictions while requiring additional transfer assessment. The two conclusions should remain visible until the overall decision is made.
Removing a name may leave a recognisable person
The ICO's anonymisation guidance treats identifiability as a contextual issue. Replacing a name with a code does not necessarily make information anonymous.
A distinctive combination of age, dates, occupation, rare illness and family circumstances can still point to a person. The appropriate response for a general learning task is often to remove the real narrative altogether.
Consider an invented example: a clinician wants to understand what information is necessary before interpreting a medicine-related laboratory change. The learning question can ask about that principle without including a real appointment date, postcode, workplace or family story.
This is not an instruction to strip clinically necessary context from an actual decision. Where the task genuinely requires patient-specific information, use a suitably authorised clinical process rather than rely on cosmetic redaction.
Organisational approval must match the use
Approval should concern the actual product, account type, configuration, information and clinical function. A colleague's personal subscription or a supplier's presence on a public registry does not automatically cover the proposed task.
A practical approval record should identify who administers access, which features are enabled, who reviews outputs and how concerns are escalated. It should also identify changes that require renewed attention, such as a new processor, function or retention purpose.
Staff need an understandable route for questions and mistakes. A system that offers no clear alternative can encourage improvised use without resolving the underlying work requirement.
The goal is an approved route that fits the task, not a blanket assumption that every consumer-branded tool is identical or every healthcare-branded tool is suitable.
Apply the same scrutiny to iatroX
iatroX's privacy policy describes UK/EU storage and processing by service providers, including AI providers where needed for the requested feature. Those are separate statements; they should not be condensed into a claim that every operation remains within one locally operated system.
For simulations, the policy says not to use real patient-identifiable information. It distinguishes live audio processing from retained learning transcripts and assessment material, with finalised learning records normally kept for up to 180 days subject to the stated arrangements.
This makes fictional educational practice a different use from uploading a real consultation for documentation. The distinction should remain clear even when a clinician uses both types of product during the same week.
A general question through Ask-iatroX can support learning or evidence inspection without becoming an assumed record-processing integration.
Ask for an account that another clinician can understand
Before deployment, the service should be explainable in ordinary terms: this information is used for this task, these organisations process it, these controls apply, this person checks the output and this is what happens afterwards.
Detailed contracts and technical diagrams still matter. Their purpose is to substantiate that account, not replace it with a collection of labels nobody can interpret.
Sovereignty can make part of the explanation stronger. It cannot make purpose, retention, transparency or clinical responsibility irrelevant. The defensible decision is about the complete use, not the most reassuring sentence on the supplier's website.
Frequently asked questions
Does sovereign hosting mean patient data are never retained or accessed by a supplier?
No. Hosting, retention and access answer different questions. Review the actual service arrangement for each information category and purpose.
Is deleting a patient's name enough to use their case in a personal AI account?
Not necessarily. Indirect details may remain identifiable. Use a genuinely general or fictional learning question, or an approved patient-data workflow where individual information is necessary.
Can real patient-identifiable information be used in iatroX Simulations?
No. The published privacy policy explicitly instructs users not to do so. Simulations are a learning environment, not a substitute for an approved clinical documentation service.
Explore a general clinical question through source-linked reference