What a UK practice can give its DPO

If your practice is assessing Akoua, this is the short list your data protection officer will ask for. Everything below is published — nothing here needs to be requested.

The documents

• UK Privacy Notice — the two kinds of data and who controls each, where data lives, deletion and retention, your rights, our Article 27 representatives, and the ICO as the complaint route.
• UK Data Processing Schedule — the UK GDPR Article 28 terms: documented instructions, confidentiality, sub-processors, international transfers, breach notification, deletion and return, and audit rights.
• UK sub-processor list — every provider, purpose, processing location and safeguard.

The measures behind them

Summarised from Annex A of the Schedule:

• Isolation — the UK deployment runs in its own cloud account; UK clinical data never co-mingles with another region’s.
• Encryption — TLS in transit throughout; encryption at rest with managed keys for database, object storage and secrets.
• Access control — passkey-first authentication with a second-factor fallback, role-based access, and separately gated platform-administrative access.
• Auditability — security-relevant actions and processing events recorded in append-only stores, enforced at the database layer.
• Processing evidence — every external processing hop is recorded immutably and is disclosable to your practice in-product.
• Backups — automated, encrypted, within the UK region, on a 35-day cycle.

What Akoua does not have

We would rather you heard this from us than found it in a questionnaire. Akoua holds no formal certifications: no ISO 27001, no SOC 2, and no equivalent. Certification is on the roadmap and we will say so plainly when it is real. We describe the audit log as append-only, which is precise, rather than tamper-proof, which would not be.

One contractual item is in flight and named in the documents: the transfer instrument for support access from Australia is drafted but not yet executed. The transcription provider’s data-processing agreement, which was the second, is signed by both parties as of 4 September 2026.

Akoua is a documentation aid, not a diagnostic or clinical decision-support tool. It makes no clinical inferences, and every draft needs the clinician’s explicit review and confirmation.