UK GDPR — who controls your data, and what your rights are

Two kinds of data, two different answers — and getting them the right way round is what makes a rights request go smoothly.

Clinical data: your practice is the controller

Session audio, transcripts, drafted and confirmed notes, letters, the patient identifiers you enter, and the processing-evidence records are controlled by your practice. Akoua is the processor and acts only on the practice’s documented instructions, on the terms in the UK Data Processing Schedule.

So a patient asking to see, correct or erase their health record goes to the practice. Akoua assists — the service ships a rights-request workflow with export, purge that preserves the evidence trail, and an auditable record of what happened.

Account data: Akoua is the controller

Practitioner names, sign-in credentials and factors, billing records and support correspondence are controlled by Akoua, and the UK privacy notice describes that processing.

Your rights

UK GDPR gives you rights over personal data Akoua controls: access, rectification, erasure, restriction, portability and objection. Write to privacy@akoua.ai.

Akoua has appointed Article 27 representatives in the United Kingdom and in Ireland, and requests can be submitted through their verification portal — both are named in the UK privacy notice, along with the portal link.

If you are unhappy with our answer, the Information Commissioner’s Office (ico.org.uk) is your next step. That is the UK route; the Australian service’s equivalent is the OAIC, and the two should not be mixed up.

Automated by design

In ordinary operation the service processes clinical data by automated means only. Akoua personnel do not access clinical content except at your request for support, to investigate an incident or suspected breach, or where the law requires it — and every such access is role-restricted and written to an append-only audit log.