Patient Recording Guidance

• Define the intended purpose in concrete terms — for example reflection on communication and coaching — and keep recording within it.
• Establish the controller and processor roles. For practice-directed patient content the practice is normally the controller and Azimuth Associates LTD t/a Unpack the processor under the Data Processing Agreement.
• Identify and record your Article 6 lawful basis.
• Identify and record your Article 9 condition where health information will be present, which it usually will be in a clinical conversation.
• Assess whether a DPIA is required. Recording patients, processing health data and using AI analysis together make that assessment likely to be needed. Our DPIA support page gives you the supplier facts to work from.
• Update your privacy notice and any transparency information patients actually see.
• Write a short local recording policy: when recording is appropriate, when it is not, who may do it, and what happens if a patient objects.
• Train the team on that policy before anyone records a patient.

Tell the patient clearly, in your own words and before you start, that the conversation will be recorded. Cover:

• that a recording is being made, and when it starts;
• why — the purpose your practice has decided on;
• that the recording is transcribed and analysed by Unpack, a third-party service used by the practice;
• who at the practice can access the recording and the transcript;
• that Unpack is not the clinical record and does not replace it;
• what choice the patient has, and that they can say no.

We deliberately do not give a script and call it sufficient. The wording that works depends on your purpose, your lawful basis and your patients, and it should be agreed locally and checked by your adviser.

• Do not record. Do not start, and stop if you have already started.
• Refusal must not disadvantage the patient’s care or the way they are treated.
• Continue the consultation normally.
• Do not press the point, repeat the request, or ask again later in the same visit in a way that feels like pressure.

• Keep to the conversation. Collect no more personal data than the purpose needs.
• Avoid drawing in information about people who are not part of the conversation — relatives, other patients, colleagues discussed in passing.
• Apply the same professional confidentiality you would without a recording.
• Stop the recording if the conversation moves somewhere it is no longer appropriate to record, or if the patient changes their mind.

• Treat the transcript as containing special-category health data, because it very often will.
• Under the current implementation, stored audio is deleted as soon as processing has completed successfully. Failed-audio expiry is designed for seven days, but the scheduled sweep was missing at audit. Verified remediation remains outstanding; no seven-day deletion guarantee is made.
• Transcripts, analyses and history are retained while the account is active, until deleted by a user or removed by account purge — see the Retention Schedule.
• Delete material you no longer need rather than leaving it in place.
• Your clinical record-keeping obligations are separate and unaffected. What belongs in the clinical record still has to be recorded there.

• The same transparency expectations apply, plus employment and workplace ones. Staff should know what is recorded, why, who sees it and how it will and will not be used.
• Have a clear written policy, and make coaching recordings a known, agreed part of how the practice works.
• Do not use Unpack as covert monitoring or surveillance of staff. It is not built for that, and framing it that way creates both a legal and a cultural problem.

• Where the practice is the controller, the practice normally receives and handles access, erasure, objection and rectification requests.
• Azimuth Associates LTD t/a Unpack assists as processor under the DPA, and will pass on any request that reaches us directly rather than answering it ourselves.
• Route requests to whoever in your practice owns data protection, and log them.

• Decide the purpose of recording and write it down.
• Assess whether a DPIA is required, and complete one where it is.
• Identify your Article 6 lawful basis and your Article 9 condition, with advice where needed.
• Update the practice privacy notice and any patient-facing information.
• Agree and sign a data-processing agreement with Azimuth Associates LTD t/a Unpack.
• Review the subprocessor register and record your acceptance or questions.
• Write a short internal recording policy covering when recording is and is not appropriate.
• Agree the wording the team will use when telling a patient a conversation will be recorded.
• Brief and train everyone who will record, and record that briefing.
• Decide who has access to what, and how access is removed when someone leaves.
• Decide your retention position once a fixed transcript period is formalised.
• Agree how a patient objection, rights request or incident is escalated and to whom.

• Recording is always started deliberately by a user. Unpack does not listen in the background and does not record unless a recording is started.
• Recording requires the device microphone permission to have been granted.
• A confirmation gate asks the user to confirm consent to record before a recording starts. This is an operational prompt, not a legal determination.
• Access is controlled by authentication and row-level access policies in the database, so users see only what their account and practice role allow.
• Users can delete individual sessions, transcripts and content, and can request account deletion.
• Stored audio is deleted after successful processing. Failed-audio expiry is designed for seven days, but the scheduled sweep was missing at audit; verified remediation remains outstanding. No seven-day guarantee is made. The transcript is unaffected.
• Privileged support access to an account is MFA-gated and written to a tamper-resistant admin audit log with the stated reason.
• A data-processing agreement, subprocessor register, retention schedule and security measures statement are published in full for your review.

• Your Article 6 lawful basis for recording and processing.
• Your Article 9 condition for special-category health data.
• Whether recording a particular patient or conversation is clinically or professionally appropriate.
• The content of your practice privacy notice and patient-facing information.
• Whether a DPIA is required for your intended use, and what it concludes.
• What goes into the clinical record. Unpack is not the clinical record.