Start here
Patient Data, Privacy & Security — Essential FAQs
Clear answers based on Unpack’s current application, policies and supplier evidence. This is due-diligence information, not legal advice; items still awaiting evidence are marked “To be confirmed”.
Trust & Security
Straight answers about how Unpack handles recordings, transcripts, AI and personal information.
This page explains how Unpack is currently designed and operated. It does not replace your practice’s own data-protection responsibilities or professional guidance.
Registered with the Information Commissioner’s Office (ICO)
Azimuth Associates LTD t/a Unpack — registration number ZB497244
Trust & Security Pack
Scope, safeguards, governance and the regulatory approach for Unpack.
Article 28 controller–processor terms for practice use.
Who may process personal data to help us provide Unpack.
How long each type of information is currently kept, and why.
The technical and organisational measures currently in place.
Practical guidance for practices considering recording patients.
Supplier information practices need to complete their own DPIA.
Supplier assessment with material risks and conditions. Formal legal and DPO approval pending; not a substitute for a practice DPIA.
Regulatory governance
Regulatory Status & Intended Purpose
A concise statement for practices, enterprise customers, data-protection teams and due-diligence reviewers.
Executive summary
Unpack is designed for documentation, communication analysis and professional development. It does not provide patient-specific diagnosis, prognosis, clinical risk or suitability assessment, or treatment recommendations. Clinical decisions remain with the treating clinician.
What Unpack does
- Records and transcribes professional conversations.
- Creates source-grounded draft clinical documentation for clinician review.
- Organises and retrieves information previously discussed.
- Analyses how information was communicated and documented.
- Helps clinicians prepare for future conversations.
- Provides communication coaching and professional development.
What Unpack does not do
- Patient-specific diagnosis or prognosis.
- Clinical risk or treatment-suitability determination.
- Recommendations for treatment, investigation, medication, dosage or referral.
- Replacement of the treating clinician’s professional judgement.
Prepare suggestions concern how to communicate and revisit information already discussed. They do not suggest patient-specific clinical actions.
How the boundary is enforced
Intended-purpose controls
Product wording and functions are reviewed against the documented purpose and exclusions.
AI system boundary
Shared instructions prohibit new patient-specific clinical inferences and recommendations.
Source-grounded notes
Clinical Notes reproduce or organise only information and plans evidenced in the source material.
Clinician approval
Draft notes require review, correction, editing where needed and approval by the treating clinician.
Communication-only support
Prepare and coaching address communication and previously discussed information, not clinical action.
Output safeguards
Additional safeguards are applied where implemented to block model-authored clinical recommendations and inferences.
Regulatory change control
Patient-related functionality and claims are assessed before release against this boundary.
Regulatory approach
Use in healthcare, transcription, summarisation and preparation of draft documentation do not by themselves determine medical-device status. Formal classification depends on intended purpose, functionality and claims.
Unpack is deliberately designed to operate within the documented intended purpose above. Regulatory status is reviewed as functionality and claims evolve. This statement is not an MHRA approval, certification or classification of Unpack.
Governance and change control
Any proposed feature that derives new patient-specific clinical information or recommends a patient-specific clinical action must undergo regulatory review before release.
The same boundary is documented in the internal Wiki and maintained through product and claims review.
Version 2026-09-29.2 · Reviewed 29 September 2026
Guidance considered
These official MHRA materials inform the approach. They do not constitute endorsement, approval, certification or classification of Unpack.
GDPR and responsibilities
Recording patients and colleagues
Where data goes
Security and access
Retention and deletion
Practices and governance
How we keep this pack current
Each document above describes how Unpack is built and operated today, and is maintained as the service changes. Where a supplier term, retention period or assurance activity is outside our direct control or has not been independently verified, each document says so plainly rather than implying more. Internal information-security, incident-response, data-subject-rights and access-control procedures are documented and maintained by the operator; they have not been independently audited or externally certified, and we do not claim otherwise.
If your practice has a data-protection or information-governance questionnaire, send it to info@unpackhealth.co.uk and we will answer from the current Unpack architecture rather than guessing.