Privacy Policy
Last updated: 6 October 2026
Scrivora AI is operated by Stormlick Ltd (company number NI653683, Northern Ireland, United Kingdom). We process personal data under the UK GDPR, the EU GDPR and the Data Protection Acts of the UK and Ireland. This policy says what we collect, why, where it goes, how long we keep it and how to exercise your rights.
Who is responsible
For patient data, the clinic is the controller and Scrivora is the processor. The clinic decides what is recorded and why; Scrivora processes it only on the clinic’s instructions, under a Data Processing Agreement. If you are a patient, your clinic is the first place to ask about your data; we will help it answer.
For staff accounts, website enquiries and billing, Scrivora is the controller.
What we process, why, and for how long
| Data | What it includes | Why we process it | How long we keep it |
|---|---|---|---|
| Staff identity | Name, work email, role, sign-in events | To give you an account and record who did what | Life of the clinic’s account, then 30 days |
| Patient identity and contact | Name, date of birth, contact details, appointment history | To keep the clinic’s patient record and manage appointments | As instructed by the clinic; deleted when the clinic deletes the record or closes its account |
| Health data (special category) | Consultation transcripts, clinical notes, assessment reports, prescriptions, attachments | To produce the clinical documentation the clinic asks for | As instructed by the clinic, as above |
| Consultation audio | The recording made in the clinic’s browser during a consultation | To transcribe it. Audio is sent to the clinic’s chosen AI provider for transcription and is not stored by Scrivora | Not retained after transcription |
| Telephone calls and messages | Call audio, transcripts and SMS for clinics using the telephone agent | To answer and make calls on the clinic’s behalf and record what was agreed | As instructed by the clinic |
| Enquiries (leads) | Names, phone numbers, emails and messages from the clinic’s website form or imported sheet, and call-back notes | So the clinic can respond to people who asked about its services | Until the clinic closes the enquiry or its account |
| Billing | Clinic name, billing contact, invoices | To charge the subscription and issue invoices | 7 years, as tax law requires |
| Security and audit records | Sign-in sessions; an audit log of key actions: documents filed, data exported, records erased, enquiries imported, sessions ended by the platform team, billing events | To keep patient data safe and to answer questions about what was done to a record | Sessions 30 days; the audit log for the life of the account, and it cannot be edited or deleted |
Lawful bases: performance of the contract with the clinic (staff accounts, billing); the clinic’s provision of health care under Article 9(2)(h) GDPR and its own lawful basis (patient and health data, processed on the clinic’s instruction); legitimate interests in keeping the service secure (security and audit records); and legal obligation (billing records).
Where it goes: our sub-processors
Clinical records are stored in the European Union. Some processing, in particular AI transcription and drafting, telephone services and payments, is carried out by the providers below. Where a provider processes data outside the UK or EU, transfers are covered by the UK International Data Transfer Addendum or the EU Standard Contractual Clauses in our agreement with that provider.
| Provider | Used for | Where | What reaches it |
|---|---|---|---|
| Google Cloud Platform | Hosting, database and secret storage (Cloud Run, Cloud SQL, Cloud Build); Vertex AI Gemini and Dialogflow CX for the SMS assistant and telephone agent, for clinics that switch those on | Belgium (europe-west1) for storage; AI services in the EU or US region of the service | All clinical records; SMS and call content for clinics using the assistant or agent |
| Google Firebase | Sign-in, staff profiles, consultation transcripts and drafts | EU for stored data; sign-in service runs globally | Logins, transcripts |
| AI provider chosen by the clinic: OpenAI, Anthropic or Google (Gemini API) | Transcribing consultation audio and drafting notes and reports, using the clinic’s own API key | United States or EU, depending on the provider and endpoint | Audio and transcript text, for the duration of the request only. The clinic’s own agreement with that provider governs whether it may retain or learn from the data; we recommend a paid or business tier whose terms exclude training |
| Deepgram | Live speech recognition for the telephone agent (only clinics that switch the agent on) | United States | Call audio while the call is in progress |
| Twilio or Telnyx | Telephone numbers, calls and SMS (only clinics that switch these on) | United States, with EU routing where configured | Phone numbers, call and message content |
| Stripe | Subscription payments | United States and EU | Clinic billing contact and card details (never seen by Scrivora) |
| Google Sheets | Importing enquiry lists a clinic keeps in Google Sheets, with the clinic’s own Google sign-in | Global | Enquiry names, phone numbers, emails and messages |
| Email provider (Gmail, Microsoft 365 or Zoho SMTP) | Sending staff invitation and notification emails | Global | Staff names and email addresses |
For consultation transcription and drafting, the AI provider is chosen and contracted by each clinic in its settings, and Scrivora sends data to it only to produce the output the clinic requested. The SMS assistant and telephone agent, for clinics that switch them on, use Google Vertex AI under Scrivora’s own Google Cloud agreement. Scrivora does not train models on clinic data. We will tell clinics at least 30 days before adding a sub-processor.
How we protect it
- Encrypted in transit (TLS 1.2 or later) and at rest (AES-256) on Google Cloud.
- Each clinic’s data is isolated in the database by row-level security, so one clinic’s queries cannot return another’s records.
- Key actions, including every document filed, data export, erasure and import, are written to an audit log that cannot be edited or deleted.
- Users are signed out automatically after 10 minutes without activity (30 minutes while a report has unsaved edits, and never in the middle of a recording).
- Access by Scrivora staff is limited to what support requires.
Children
Scrivora is used by clinics that assess and treat children, including ADHD and autism assessments. Children’s records are processed on the clinic’s instruction as controller, with the clinic responsible for the consent of a parent or guardian where it is needed. Scrivora accounts themselves are for clinic staff aged 18 or over.
Your rights, and how to use them
Under the GDPR you can ask to see the personal data held about you, have it corrected, have it deleted, receive a copy in a usable format, and object to or restrict certain processing. You are not subject to decisions made solely by automated means: every AI output is reviewed by a clinician.
- Patients: ask your clinic. It can view, correct, export and delete your record in Scrivora directly. If you would rather write to us, we will pass your request to the clinic and help it respond.
- Clinic staff and website enquirers: email support@scrivora.co with your name and what you are asking for.
- We respond within one month. We may ask for proof of identity first, so that nobody else can obtain your data.
- If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or, in Ireland, the Data Protection Commission (dataprotection.ie).
Retention and deletion
We keep data for the periods in the table above. When a clinic closes its account it has 30 days to export its records, after which we delete them from our live systems on request to support@scrivora.co; database backups expire within a further 30 days. Audit records and billing records are kept for the periods the law requires.
Cookies and browser storage
Scrivora sets no advertising or analytics cookies. What the app stores in your browser, and why, is listed in the Cookie Policy.
Changes
We will post changes here and, for material changes, tell clinics by email at least 30 days before they take effect.
Contact
Privacy contact: support@scrivora.co
Stormlick Ltd, 74 Braehead Road, Nixon’s Corner, Londonderry, BT48 9XE, United Kingdom.