Trust & Security · Supplier assessment
This supplier-side assessment describes Unpack’s processing and the risks to individuals. Version 1.0 is an external-review edition of the working assessment dated 8 October 2026, incorporating subsequent supplier correspondence and retention findings. It is not approved, signed off, legally reviewed, DPO reviewed or independently verified. No residual risk has been formally accepted.
Each practice, as controller, remains responsible for its own lawful-basis decisions and DPIA. This document is not a substitute for that assessment and is not legal advice. DPIA support for practices is available separately.
Written clarification from Lovable confirms that identifiable patient recordings and transcripts are restricted under its standard terms on all standard plans, including Business. An Enterprise arrangement would require a separately negotiated written exception; a plan upgrade alone does not resolve this.
Expansion of identifiable patient-data processing remains on hold. No approved exception or completed move to independently contracted processing is evidenced. Existing processing also requires the owner’s containment and legal-review decision; this assessment does not authorise continued use under restricted terms. A practice’s consent or DPIA cannot override the supplier restriction.
Resolution requires an appropriate written agreement and legal review, or a separately contracted backend and direct AI-provider arrangement that keeps patient data out of Lovable-managed processing. Article 28 coverage, downstream retention/no-training terms and international transfer safeguards remain to be confirmed.
Unpack records or imports conversations, transcribes them and generates communication analysis, coaching, reflection, staff-meeting notes and answers to questions. Preparation may use previously recorded information from explicitly linked patient history.
The assessed purpose is documentation, retrieval of previously discussed information, communication analysis and professional development. Unpack is not intended to diagnose, treat or recommend patient-specific clinical action. The practice retains responsibility for clinical decisions, review of draft notes and the clinical record. See Regulatory Status & Intended Purpose.
| Party | Responsibility |
|---|---|
| Practice | Controller for practice-directed patient and staff content: purpose, access, transparency, Article 6 basis, Article 9 condition, rights and its own DPIA. |
| Azimuth Associates Ltd t/a Unpack | Processor for practice content, acting on documented instructions. Published DPA terms are offered for review; publication is not evidence of execution or a verified downstream contractual chain. |
| Unpack’s independent-controller activities | Accounts, billing, security records, AI-consent records, support, legal compliance and de-identified product metrics. The applicable position is described in the Privacy Policy and remains subject to legal review. |
| Professionals and coaching participants | Access to personal and explicitly shared coaching content according to their authorised role; private journeys are not practice-wide records. |
| Patients, staff and meeting participants | Data subjects whose voices, statements and potentially sensitive information may be included. |
| Processing suppliers | Lovable and its Cloud infrastructure, OpenAI, Google Gemini and Firebase services; contractual scope and eligibility remain subject to the conditions above. |
The flow below describes the existing arrangement, not an endorsement of its eligibility for patient data. Patient audio and text currently pass through Lovable-hosted application processing and the AI Gateway, not only through storage.
User device (web or mobile app)
Recording after participant-consent reminder,
or deliberate upload / paste / reviewed import
↓
Unpack application hosted by Lovable
↓
Lovable Cloud: audio, transcripts, outputs,
accounts and consent records (Frankfurt)
↓
Lovable AI Gateway → OpenAI transcription
↓
Transcript quality checks; bounded retry;
failed quality checks block analysis
↓
Lovable AI Gateway → OpenAI / Google Gemini
analysis, preparation and answers
(current user AI agreement required)
↓
Saved outputs → authorised users only
(explicit patient linkage and role-based sharing)
↓
User deletion / account-deletion process;
audio deletion after successful processing;
failed-audio deletion assurance remains open
Notifications: Firebase Cloud Messaging receives
device tokens and short notification text.
Provider backup and log deletion periods remain
unconfirmed.Device-local audio may be held temporarily while recording or upload completes. Retention and deletion assurance must cover device copies as well as application storage and provider copies.
| Measure | Assessment status |
|---|---|
| Authenticated, role-based access and explicit patient linkage | Application controls are in place; no claim of independent certification or comprehensive security validation is made. |
| Restricted administrative access and administrative MFA | Application controls are in place; support access remains subject to authorisation. |
| Password controls | Minimum 12 characters, protected password verification and attempt throttling are implemented. |
| AI agreement and transcription-quality controls | Current agreement is required; failed transcription-quality checks block analysis. These controls do not establish clinical accuracy. |
| Transport and storage protection | TLS and provider encryption at rest are provider-stated. Unpack does not claim end-to-end or application-level encryption of content. |
| Independent assurance and recovery | Independent penetration testing, Unpack certification and verified recovery commitments remain outstanding. |
These are assessed controls, not a certification or an absolute security guarantee. Further supplier information is in Security & technical measures.
The following summary retains material risks and mitigations from the working assessment. Residual status is provisional, not an acceptance decision. Detailed risk scoring, evidence and actions are retained internally for governance review.
Critical — unresolved
Mitigation: Hold on expansion of identifiable patient-data processing; a separately negotiated exception or independently contracted processing arrangement requires legal review.
Residual position: Standard plans do not permit this health-data use. No approved exception or completed migration is evidenced; the hold remains.
High — unresolved
Mitigation: Named-provider disclosure, affirmative user agreement and withdrawal controls; request binding provider terms and applicable UK transfer safeguards.
Residual position: User agreement is not a supplier contract. Full-chain no-training terms, processing locations and backup/log periods remain unconfirmed.
Medium — practice-dependent
Mitigation: Deliberate recording with a participant-consent reminder; practice recording guidance and separate Article 6 / Article 9 decisions.
Residual position: Practices must demonstrate lawful, proportionate use, handle refusal without pressure and consult staff where appropriate.
High — review pending
Mitigation: Authenticated access, role-based permissions, explicit patient linkage, restricted support access, administrative MFA and password controls.
Residual position: Access controls do not remove all disclosure risk. Independent security assurance remains outstanding.
High — partly mitigated
Mitigation: Transcription-quality checks, retry and analysis blocking; draft outputs require professional review. Clinical decisions and the clinical record remain with the practice.
Residual position: Quality checks cannot establish clinical accuracy. Patient-specific diagnosis or treatment recommendations are outside the assessed purpose.
Open — deletion assurance required
Mitigation: Audio deletion after verified successful processing, user deletion and the account-deletion process; verify failed-audio expiry and provider deletion terms.
Residual position: Automated deletion of failed or incomplete audio processing is undergoing verification. Until that verification is complete, Unpack does not make a guaranteed seven-day deletion commitment for failed audio. Transcript limits and backup/log periods remain unresolved.
High — assurance pending
Mitigation: Restricted access and security records; proposed processor notification obligations and assistance to practices.
Residual position: Supplier notification arrangements, incident-response assurance and recovery commitments require confirmation. The published DPA is not proof of an executed contract.
Issued for external review does not mean approved for expanded patient-data processing. The expansion hold remains until supplier eligibility is contractually resolved and legally reviewed, with remaining supplier, retention and transfer risks assessed.
The document owner must arrange legal and DPO/data-protection review, decide the handling of existing patient-data processing, verify retention remediation, confirm applicable supplier commitments and record any subsequent risk-acceptance decision. If high residual risk remains, the need for prior consultation with the ICO must be assessed.
There is no approval date or named risk acceptance in this edition because none is evidenced. Any approval or change to these conditions requires a controlled revision; it will not be implied by this version number.
Revision record: Version 1.0 · 13 October 2026 · issued for external review by Azimuth Associates Ltd / CTO. Based on the 8 October working assessment; public wording and material supplier/retention status updated. Formal legal and DPO approval remains pending.