Does any UK data leave the United Kingdom?

Short answer: the record stays in the United Kingdom, and the processing happens in the European Union — transcription on Deepgram’s EU regional service, note drafting on Amazon Bedrock, invoked from AWS London and served in AWS’s EU regions — under the UK’s adequacy regulations for the EEA. Remote support access from Australia is the separate exception set out below.

UK to EU

Transcription and note drafting run in the European Union for every consult — transcription on Deepgram’s EU regional service (Frankfurt, Germany), note drafting on Amazon Bedrock, invoked from AWS London and served in AWS’s EU regions — under the consent your organisation gives, disclosed on every note. Ordinary consent to record is a separate authority, given for each consultation. UK-to-EU processing is covered by the UK’s adequacy regulations for the EEA — it is not a restricted transfer needing its own instrument. No clinical data is stored or processed outside the UK and the EU in the ordinary automated operation of the service, and none is transferred to any other third country. Each provider, what it does and where, is on the UK sub-processor list.

The one exception: support from Australia

Akoua is an Australian company, and remote access for support and platform administration may occur from Australia. Specifically:

• it is exceptional rather than routine — a support request you raised, an incident or suspected breach, or where the law requires it;
• it is scoped to the task, not bulk access;
• it requires a platform-administrator role with passkey or second-factor authentication;
• every read and action is written to an append-only audit log;
• the data itself stays stored in the United Kingdom. What crosses a border is the viewing, not the record.

That access would be a restricted transfer under UK GDPR. The agreement template for it incorporates the ICO’s International Data Transfer Agreement with the EU Standard Contractual Clauses by reference, supported by a transfer risk assessment. That documentation is not yet executed. The service is open to United Kingdom organisations. The UK privacy notice and Data Processing Schedule state the same position.

What that means in practice

In its ordinary operation the service processes clinical data by automated means only. Akoua personnel do not read clinical content except in the three circumstances above, and never silently — the audit log is the record, and it can be added to but never edited or removed.