Privacy Policy
Effective: 1 April 2026 · Last updated: 1 April 2026
This policy explains how VoiceIt processes your data. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Swedish implementation thereof. If anything is unclear, contact us at hannes@digitalclinic.vet.
1. Controller
Clean Wake AB — The Digital Clinic
Sprängarvägen 27, 184 70 Åkersberga, Sweden
Org. nr: 559483-8616
team@digitalclinic.vet
2. Data Protection Officer
Hannes Schippmann
hannes@digitalclinic.vet
3. What data we process
| Data | Source | Retention |
|---|---|---|
| Audio recording | Your microphone | Deleted within 12 hours |
| Transcription text | Generated from audio by AI | Deleted within 12 hours |
| Clinical note | Generated from transcription by AI | Deleted within 12 hours |
| Recommendation letter | Generated from clinical note by AI (if requested) | Deleted within 12 hours |
| Session token | Randomly generated at recording | Deleted with recording data |
Consent cookie (voiceit_consent) |
Set when you accept the consent notice | 1 year |
| Browser preferences | localStorage on your device (microphone choice, language) | Until you clear browser data |
We do not collect your name, email address, or any data that directly identifies you. We do not create user accounts. We do not use tracking or analytics cookies. The only cookie we set (voiceit_consent) is strictly functional — it records that you have acknowledged the consent notice. This cookie is exempt from cookie consent requirements under the ePrivacy Directive as it is necessary for a function explicitly requested by you. Your IP address is processed transiently for the network connection but is not logged or stored in association with your recording.
4. Special category data
Veterinary consultation recordings may contain information about animal health conditions and treatments. While animal health data is not classified as personal data under GDPR, recordings may incidentally contain information about animal owners or other individuals present during the consultation (names, contact details, personal circumstances). We treat all recording content with the same level of protection as personal health data and apply strict retention limits accordingly.
5. Legal basis for processing
| Processing activity | Legal basis (GDPR) |
|---|---|
| Transcribing your audio recording | Consent — Art. 6(1)(a) |
| Generating a clinical note from the transcription | Consent — Art. 6(1)(a) |
| Analysing content to suggest sponsor products | Legitimate interest — Art. 6(1)(f) |
| Generating a recommendation letter for the animal owner | Consent — Art. 6(1)(a) |
| Temporary storage of processing data | Necessary for service provision — Art. 6(1)(b) |
You provide consent by acknowledging the consent notice on the landing page and initiating a recording. You may withdraw consent at any time by deleting your data using the "Delete now" button, or simply by not using the service. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Regarding sponsored product recommendations: our legitimate interest is the funding of a free service through relevant, non-intrusive product suggestions. Sponsor companies do not receive any of your data. You can disregard the recommendations entirely. We consider this interest proportionate given the benefit (free service) and the limited nature of the processing (no data shared with sponsors, all data deleted within 12 hours).
6. How we process your data
- You record audio in your browser. The audio is transmitted to our servers over an encrypted connection (TLS 1.2+).
- The audio file is stored temporarily in encrypted cloud storage (AWS S3, eu-central-1, Frankfurt).
- The audio is sent to Mistral AI (EU, France) for speech-to-text transcription.
- The transcription is sent to Mistral AI for clinical note generation.
- In parallel, the transcription is analysed by Mistral AI to match relevant sponsor products from a static catalogue. No data is sent to the sponsor.
- If you request it, a recommendation letter for the animal owner is generated by Mistral AI using the clinical note and matched products.
- All data — audio, transcription, clinical note, and recommendation letter — is automatically deleted within 12 hours, or immediately when you press "Delete now".
7. Sub-processors
The following third-party services are used to provide VoiceIt. All sub-processors are bound by data processing agreements.
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services EMEA SARL | Encrypted file storage (S3) | EU — Frankfurt, Germany |
| Mistral AI SAS | Speech-to-text transcription, clinical note generation, product matching, recommendation letter generation | EU — Paris, France |
| Render Services, Inc. | Application hosting | EU — Frankfurt, Germany |
| Honeybadger Industries LLC | Error monitoring (no recording data) | EU |
VoiceIt exclusively uses EU-based AI processing. Unlike The Digital Clinic's main platform, which offers a choice of AI providers, VoiceIt is configured to use only Mistral AI (France). No recording data, transcriptions, or generated content is transferred outside the European Economic Area.
8. International data transfers
All VoiceIt data processing takes place within the EU/EEA. We do not transfer your recording data, transcriptions, or generated content to countries outside the EEA. Error monitoring metadata (which does not include recording content) may be processed by Honeybadger under Standard Contractual Clauses approved by the European Commission.
9. Data retention and deletion
All recording data, transcriptions, clinical notes, and recommendation letters are automatically and permanently deleted within 12 hours of creation. A scheduled process runs daily to identify and remove expired data, including audio files from cloud storage.
You may delete your data immediately at any time by clicking "Delete now" on the result page. Deletion is permanent and irreversible. It removes all associated data: the audio recording, transcription, clinical note, recommended products, and recommendation letter.
Data stored locally in your browser (consent acknowledgement, microphone preference, language setting) remains on your device in localStorage and is never transmitted to our servers. You can clear this through your browser settings at any time.
10. Your rights
Under the GDPR, you have the following rights. We have mapped each to how it applies in VoiceIt:
| Right | How to exercise it |
|---|---|
| Access (Art. 15) | Your clinical note and recommendation letter are displayed on the result page for up to 12 hours. |
| Erasure (Art. 17) | Click "Delete now" on the result page. All data is also automatically deleted within 12 hours. |
| Withdraw consent (Art. 7(3)) | Delete your data and stop using the service. Withdrawal does not affect prior processing. |
| Data portability (Art. 20) | Copy your clinical note to clipboard or download it as PDF before deletion. |
| Rectification (Art. 16) | Not applicable — we do not store identifying personal data and content is auto-deleted within 12 hours. |
| Restriction (Art. 18) | Not applicable — given the 12-hour retention, restriction is functionally equivalent to deletion. |
| Object (Art. 21) | You may object to sponsor product recommendations by contacting us. You may also simply disregard them. |
| Lodge a complaint | Contact IMY (Integritetsskyddsmyndigheten), the Swedish Authority for Privacy Protection, at imy.se. |
11. Security measures
- All data in transit is encrypted with TLS 1.2 or higher.
- Audio files are stored with AES-256 server-side encryption in AWS S3.
- Session tokens are cryptographically random (256-bit) and unguessable.
- No user accounts or passwords exist — there are no credentials to breach.
- Data is automatically purged within 12 hours, limiting the window of any potential exposure.
- Application error monitoring does not capture or log recording content.
12. Sponsor data isolation
VoiceIt is funded by veterinary industry sponsors (currently VetNova). It is important to understand how the sponsorship works technically:
- Sponsors provide a static product catalogue. This catalogue is stored in our application code, not sent per session.
- Your transcription is matched against this catalogue by our AI infrastructure to suggest relevant products.
- The matching happens entirely within our systems. No recording data, transcription, clinical note, or session information is shared with, sent to, or accessible by the sponsor.
- Sponsors receive no data about individual sessions, users, or consultation content. They receive no analytics, usage statistics, or aggregate data derived from consultations.
- The sponsor's logo and product names are displayed as part of the recommendation interface. This is the full extent of the sponsor's presence in the service.
13. Automated decision-making
VoiceIt uses AI to generate clinical notes, product recommendations, and recommendation letters. These outputs are generated automatically without human review. However, none of these outputs constitute decisions with legal or similarly significant effects on you. The clinical note is a draft for your review. Product recommendations are suggestions you may disregard. The recommendation letter is a template you may edit before use.
14. Children's data
VoiceIt is a professional tool for veterinary practitioners. It is not directed at individuals under 16 years of age. We do not knowingly process personal data from children.
15. Changes to this policy
We may update this policy to reflect changes in our practices, technology, or legal requirements. Material changes will be posted on this page with an updated effective date. We encourage you to review this page periodically.
16. Contact
For all privacy-related enquiries:
Data Protection Officer: Hannes Schippmann
hannes@digitalclinic.vet
General enquiries:
Clean Wake AB — The Digital Clinic
Sprängarvägen 27, 184 70 Åkersberga, Sweden
team@digitalclinic.vet
17. Supervisory authority
If you believe your privacy rights have been violated, you have the right to lodge a complaint with:
IMY — Integritetsskyddsmyndigheten (Swedish Authority for Privacy Protection)
www.imy.se
If you are located in another EU member state, you may also contact your local supervisory authority.