AI Scribe for Physiotherapists in the UK: A Consent and GDPR Checklist

A UK physio clinic needs six things before using an AI scribe: a clear way of telling patients and letting them opt out, a UK GDPR assessment (usually a DPIA), a written contract with the vendor, known data location and audio retention, a human sign-off on every note, and records that still meet HCPC and CSP standards.

The pages that rank for this topic are largely US vendor sales pages, which talk about HIPAA and US billing. They are not much use to a clinic working under UK rules, where the work is settling a lawful basis, a DPIA, a processor contract and the records standards, and keeping evidence of each. What follows is practical guidance, not legal advice, so your data-protection adviser or insurer should confirm the points that matter most.

Follow me on Instagram@sagnikteaches

What the vendors say about UK use

Start with what each tool claims, so the checklist can test those claims. These are statements from the vendors' own pages, read in November 2026, not endorsements.

Connect on LinkedInSagnik Bhattacharya

"Registered" and "certified" are the vendors' words. The MHRA registration for Jane is a product-regulation fact; it says nothing about whether your clinic's use is lawful. Keep the two ideas separate in your head as you work through the steps.

Subscribe on YouTube@sagnikteaches

The checklist, in the order to do it

Twelve steps, each with what to do and the evidence to keep. A small clinic can do the whole list in a few days of part-time work.

Step 1: Name an owner and a purpose

Write one sentence: "We will use an AI scribe to draft clinical notes for first appointments and follow-ups, reviewed and signed by the treating physiotherapist." Name who owns the project, usually the clinic lead or practice manager. Evidence: the sentence and a name in your records.

Step 2: Decide what you will and will not record

List where the tool will be on: in-person, telehealth, a home visit, group classes. Many clinics begin with in-person one-to-one sessions only. Say what is out of scope, such as safeguarding conversations or consultations with a patient who lacks capacity, until you have thought them through. Evidence: a scope paragraph.

Step 3: Work out your lawful basis with your adviser

Under UK GDPR, health records are special category data. Jane's guide says processing for direct patient care relies on the health-care condition in Article 9(2)(h), which is a vendor's statement you should check against your own advice. For many clinics the legal basis for the note is the same as for the clinical record. The consent conversation with the patient is about openness and choice, a separate point. Evidence: your adviser's note or your policy text.

Step 4: Complete a DPIA

A data protection impact assessment is a written analysis of risk and the steps you take to reduce it. New technology processing health data is the kind of case where clinics commonly do one. The Information Commissioner's Office guidance on when a DPIA is needed lists "innovative use or applying new technological or organisational solutions" and "sensitive data or data of a highly personal nature" among the indicators of likely high risk, says that if in any doubt it would always recommend doing one, and asks you to document your reasons if you decide not to. The archived copy I read (October 2026) also says the guidance is under review after the Data (Use and Access) Act, so check the live page. Even if you decide a DPIA is not mandatory, doing one makes you answer the right questions. A short template follows below. Evidence: the completed DPIA, signed and dated.

Step 5: Put a contract in place with the vendor

The vendor will be processing patient data on your behalf. You need a written data processing agreement that covers purpose limits, security, sub-processors, deletion on request and return or deletion at the end of the contract. Ask who the sub-processors are. For example, some tools send text to a third-party language-model provider. Evidence: the signed agreement and a list of sub-processors.

Step 6: Pin down where data lives and how long it stays

Ask three separate questions: where is the audio processed, where is the transcript and draft stored, and are there transfers outside the UK. Jane's UK guide states London servers and no data leaving the UK; Tandem says Europe. Then set retention: audio deleted when the draft is made or after a set number of days, with Jane's clinic-wide options being "keep indefinitely", "delete immediately after successful generation" and "delete after a set number of days". Its help guide adds that a deleted recording stays in secure backups for a week. Evidence: screenshots of the deletion setting and the vendor's written answer on location.

Step 7: Update your privacy notice

Your patient-facing privacy information should mention the AI note-taking tool, the vendor as a processor, what is recorded, how long it is kept and how patients can object or ask for deletion. Put it on the website, the intake form and the clinic's notice board. Evidence: the updated notice with a date.

Step 8: Write the consent and opt-out script

Draft the wording you will use before and during appointments, and the route for patients who say no. A template follows below. Evidence: the script and a short staff briefing note.

Step 9: Check the medical-device and safety position

Ask the vendor how the product is regulated for UK use, who is responsible for clinical safety, and how errors are reported. If you do NHS-funded work, ask what documents your commissioner or provider expects, such as clinical safety and technology assessment evidence. Heidi's UK page, for instance, lists DCB0129 and DTAC. Evidence: the vendor's written reply and any commissioner requirements.

Step 10: Confirm records standards still hold

HCPC standards say registrants must keep full, clear and accurate records (10.1), complete them promptly (10.2) and keep them secure (10.3). The HCPC also notes that the record system must protect confidentiality and that it is for you to decide, with professional judgement, which records to keep. The Chartered Society of Physiotherapy's record-keeping guidance adds detail that bears directly on a scribe. It says a good record lets an independent reader understand what conversations took place, what was examined, what treatment was given and the clinical reasoning; that amendments should be dated, timed and signed with the original entry still visible; and that electronic systems should show who made the record, show revisions and lock the notes. It also quotes its Quality Assurance Standards: notes written immediately after the contact or before the end of that working day. So check that your scribe or practice system keeps an edit history once a draft is signed, and make same-day sign-off the rule. Evidence: a note on how scribe drafts meet those standards, for instance "reviewed and signed before it enters the record".

Step 11: Set the retention schedule for notes

The HCPC points registrants to retention schedules: section 2 of the Records Management Code of Practice for Health and Social Care 2021 for England and Wales, with separate codes listed for Scotland and Northern Ireland. The CSP's guidance summarises the usual minimum for adults with capacity as eight years from the date of last treatment, with longer periods for children. Look up the period for your record type and write it in your policy, along with what happens to audio, transcripts and drafts. Evidence: a one-page retention table with each item and its period.

Step 12: Train, trial, review

Brief everyone who will use it, run a small trial with consenting patients, review errors, and set a date to revisit the whole checklist. Evidence: training log, trial notes and a review date.

A short DPIA you can start from

This outline is illustrative, filled in for a five-physio clinic. Replace the specifics with your own, and have your adviser review it.

DPIA: AI scribe in [clinic]
1. Description: the tool records appointments, makes a transcript
   and a draft note. Physiotherapist reviews and signs.
2. Data: audio, transcript, draft, final note. Health data.
3. Who is involved: patients, five physiotherapists, vendor
   (processor), vendor's sub-processors [list].
4. Necessity: reduces time on notes by [estimate after trial];
   alternatives considered: typing, dictation, no AI.
5. Risks and what we do about them:
   - Wrong content in a note -> physio reviews every draft; trial scored.
   - Audio kept too long -> deletion set to [rule]; checked monthly.
   - Patient uncomfortable -> written information, opt-out, no penalty.
   - Data leaves the UK -> vendor confirms location in writing [date].
   - Access by too many people -> role-based accounts, no shared logins.
   - Vendor changes terms -> contract review every [12 months].
6. Decision: proceed to trial / do not proceed. Signed and dated.
7. Review date: [date], or earlier if the tool or its terms change.

Keep it short enough that you will update it. A DPIA that lives in a drawer after the first week is a liability, not a protection.

Consent wording for a UK physio clinic

Here is a patient-facing paragraph and a short verbal check. Both are illustrations in plain English for your adviser to adjust. They aim to be open about what happens and make saying no easy. For a deeper look at whether consent can be implied, see the implied-or-explicit consent tutorial.

Information on the booking confirmation email:
"We use an AI note-taking tool in some appointments. With your
agreement, it records our conversation and drafts the physiotherapy
notes, which your physiotherapist checks and corrects before they
go into your record. The recording is deleted [immediately after
the draft is made / after __ days]. [Vendor] processes it for us
under a contract and stores it in [location]. It is not used to
train AI models [if the vendor confirms this in writing]. You can
say no, at any time, and your treatment will be exactly the same.
Reply to this email or tell your physiotherapist on arrival if you
would prefer us not to use it."

Spoken check at the start of the appointment:
"Is it still all right if I use the AI note-taker today? I check
every note myself, and you can ask me to stop whenever you like."

If a patient declines, the clinician notes "AI scribe declined, notes typed" and flags it in the system so the next clinician does not ask afresh. If someone else joins the appointment, such as a family member or an interpreter, ask them too. And if a patient who agreed asks to stop partway, stop at once, say it is off and carry on by typing.

A retention table for audio, transcript and notes

Retention is where clinics often wing it. Fill in a table like this for your own tool and keep it with the policy. The rows are illustrative, and the periods in square brackets must come from your own records code and advice.

Patients' rights when a scribe is in use

Recordings, transcripts and drafts about an identifiable patient can fall within a subject access request and a deletion request, depending on the circumstances. Plan for this before it happens. Decide who handles a request, how long you will keep audio so there is less to find, and how you tell the vendor to delete data on a patient's behalf. A patient who objects after the fact should get a straight answer and a record of what was done. If the vendor's tool cannot delete a particular recording when asked, find that out in the trial, not in the middle of a complaint.

Also think about breach reporting. If the vendor tells you of an incident, your duty to assess and, where needed, report is the clinic's. The contract should say how fast the vendor must tell you. Write that number in your policy and diary it for review.

A worked example: a five-physio clinic over four weeks

Take an illustrative private clinic with five physiotherapists, 20 appointments each a day. The lead decides to trial Jane's scribe, since the clinic already runs on Jane. In week 1 she completes the DPIA, signs off the vendor information, switches the recording deletion setting to delete immediately after generation, and sends the revised privacy notice. In week 2 she briefs the team and sets up the intake-form consent. In weeks 3 and 4, two physiotherapists test it on patients who have agreed, using the free tier's five notes a month for early practice and then the unlimited add-on at 15 pounds a month each.

At the end she checks eight things: how many patients agreed, how many declined, whether any note had a wrong side or number that was nearly signed, the average review time against typing time, whether deletion settings held, whether any patient raised a concern, whether the privacy notice matched practice, and whether the HCPC points in step 10 are met by the sign-off routine. If the answers are good, she widens to the rest of the team and sets a date three months on to repeat the review. If not, she pauses and fixes the cause. The cost of the pilot is a few hours of her time and 30 pounds for the two add-on seats. These figures are illustrative.

A SOAP draft checked the way an HCPC audit would read it

HCPC standards ask for records that are full, clear and accurate, so test each draft against those three words. Here is a fictional first appointment for a runner with knee pain, with the draft a scribe might produce and what the physiotherapist fixes.

What was said (summary): Patient, a recreational runner, has had
right knee pain for six weeks, worse on stairs, no locking.
Physio finds tenderness at the medial joint line, full range of
movement, negative ligament tests. Advice: reduce running, simple
strengthening, review in two weeks.

Illustrative draft:
S: Left knee pain for six weeks, worse on stairs. Locking reported.
O: Medial joint line tenderness. Full range. Ligament tests negative.
A: Probable meniscal irritation.
P: Reduce running, strengthening programme, review in two weeks.
   Consider referral for imaging.

Physio's fixes:
- "Left" corrected to "right".
- "Locking reported" deleted: patient said there was no locking.
- "Probable meniscal irritation" kept only because it was her
  clinical impression, stated aloud.
- "Consider referral for imaging" deleted: not discussed.

Against the three words: the draft was not accurate (wrong side, invented symptom), not full (the strengthening exercises were unspecified) and not clear (an unsupported referral line). After the edits it meets the standard because a person who knows the patient read and signed it. That is why "reviewed and signed before it enters the record" is the line to put in your policy.

Telehealth, home visits and group classes

Not every appointment has the same risks. Telehealth adds a second location: the patient may be at home with other people in the room, and you cannot see who is listening. Ask the patient to confirm who is present and whether they are happy for the call to be recorded, and say who else might hear. Home visits put the device in a private home where family members may speak, so ask them too. Group classes involve several patients whose voices would be captured, and each would need to agree, which is hard to arrange. Most clinics should leave group sessions out of scope at first, and write that into step 2.

Staff, supervision and insurance

A scribe changes how your team works, so treat it as a workplace change as well as a data project. Brief staff on what the tool records, what it does with the audio and who they ask when something looks wrong. Make sure students and locums know the rules before their first shift. Contact your professional indemnity insurer and ask whether using an AI scribe affects your cover or whether they publish expectations. Keep the reply in the same folder as the DPIA. If you supervise students, decide whether their notes may be scribed and how you will review them, because a draft that reads fluently can hide a student's gaps in reasoning. The CSP's guidance already says the supervising physiotherapist must countersign a student's record, so a scribed student note needs that countersignature too.

Where a UK clinic can go wrong

• Treating the vendor's badge as the checklist. A claim of UK GDPR compliance or a medical-device registration does not complete your DPIA, contract or consent steps.
• Copying a US consent form. US wording is built around HIPAA and state recording laws. Use plain English that reflects UK rules, and have it checked.
• Leaving audio on the default. Defaults differ between tools. Check and set the deletion rule yourself.
• Unreviewed notes. A signed note is your professional record. A scribe draft that no one read is not.
• Forgetting the interpreter or relative. They are on the recording too.
• No exit plan. If you stop using the tool, how do you get your data out and make sure the vendor deletes the rest? Put it in the contract.

For a view of where scribes sit among other AI tools in a clinic, see AI tools for physiotherapy clinics and, if your clinic software may already include AI features, the clinic software comparison. If you want help turning the checklist into steps your team will follow, that is what my AI implementation consultation can map on a 1:1 call, with your data-protection adviser taking the final legal decisions.

UK physio scribe questions

Do I need explicit consent under UK GDPR to use a scribe?

Not always as the legal basis for processing, because health care can rely on other conditions. But patients should be told and given a chance to ask questions or opt out, and a recording of a conversation raises its own expectations. Ask your regulator, insurer or data-protection adviser how they want it framed for your clinic.

Is a DPIA compulsory for an AI scribe?

Many clinics will find one is required or at least wise, because the tool processes health data using new technology. Check the ICO's guidance on when a data protection impact assessment is needed, and if in doubt, do one. It also gives you a written record of your reasoning.

Does a vendor being MHRA-registered mean it is safe to use?

No. Registration shows the product has gone through a regulatory route for medical devices, which is useful information. It does not replace your own checks on data protection, consent, accuracy of notes and fit with your records. You remain responsible for each note you sign.

Can I keep the recording for as long as the clinical record?

You should keep audio only if you can justify it. The signed note is normally the clinical record, so many clinics delete audio once the draft is made. Set the shortest period that works, write it into your privacy information and policy, and check the tool's own deletion settings.

What do I tell patients who say no?

Tell them nothing changes in their care and that you will write notes yourself. Record the decision in the notes and flag it so colleagues do not start the scribe. Never make treatment or booking depend on agreeing to the scribe.

Further reads

• Heidi Health for Dentists: Setup, Templates and Patient Consent — A worked consent set-up inside one scribe tool.
• AI Scribe for an NHS Practice: Registry, DTAC and DPIA Checklist — Registry, DTAC and DPIA steps for NHS-facing practices.
• Best AI Scribe for Physical Therapy: Four Tools Compared — How four tools compare on notes for physical therapy.
• AI Receptionist for Physiotherapy Clinics: Cost and Booking Setup — The front-desk side of AI in a physiotherapy clinic.
• How Physiotherapists Use AI to Write Treatment Notes Faster — How physiotherapists use AI to write treatment notes faster.
• Creating Home Exercise Programmes With AI for Physio Patients — Another AI use in physio, and its own checks.
• Osteopath Software: Which Packages Add AI and What to Check — A seven-part checklist for osteopaths comparing practice software that advertises AI, with verified vendor prices and a scoring sheet.
• AI for Physiotherapists: Employer and Workplace Contract Proposals — Write a workplace physio proposal with AI: scope, pricing tiers, reporting and confidentiality, shown with a 40-employee worked example.
• Chartered Society of Physiotherapy and AI: A Clinic Checklist — Turn the CSP's AI principles into a working checklist: what each asks of a clinic, who owns it, what evidence to keep and when to review.
• How Can AI Help Physiotherapy Clinics Write Referrer Updates? — Turn a clinician's own bullet points into a clear referrer update, with templates for first, progress and discharge letters and a review step.
• Osteopath AI: Notes, Bookings and Letters Under GOsC Guidance — GOsC's interim AI guidance turned into three practice jobs: case notes, booking replies and patient letters, with consent wording and a review routine.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: Jane App help guides 'AI Scribe for the UK: FAQ' and 'Setting a Recording Deletion Policy', and its UK price list; Tandem Health home and pricing pages; Heidi UK compliance page and UK price list; HCPC record-keeping pages (standards 10.1 to 10.3 and FAQs); the Chartered Society of Physiotherapy's record-keeping guidance; the ICO's 'When do we need to do a DPIA?' guidance (archived copy, 12 October 2026). Prices and claims as read on 4 November 2026.