1. Who we are
Diffusion Solution ("we", "us") makes the VoiCaba suite: clinical software that listens to the conversation during an ambulance call or on a hospital ward, drafts the clinical record from it, and hands the record over to the receiving hospital. The apps are built for registered clinicians working for an ambulance service, hospital or other healthcare organisation that has a contract with us. They are not consumer apps and they are not for the general public.
This policy explains what information the apps and their platform process, why, where it is kept, who can see it, and how to exercise your rights. It is written for three readers: the clinicians who use the apps, the patients whose care is recorded, and the organisations that deploy the apps and need to know what we do on their behalf.
2. Who is responsible for the information
Patient information: the healthcare organisation that deploys the app (the ambulance service, hospital or trust) is the data controller. Diffusion Solution is its data processor and handles patient information only on that organisation's documented instructions, under a written data processing agreement.
Clinician account and device information: your organisation controls your work identity. Diffusion Solution processes the technical records needed to run and secure the service, and is the controller for those.
If you are a patient and want to know what was recorded about you, or want it corrected or removed, the organisation that treated you holds your record and answers those requests. We will help it do so. Our contact details are at the end of this page if you are not sure who to ask.
3. The apps this policy covers
| App | Who uses it | What it does |
|---|---|---|
| VoiCaba EMS Android, iOS |
Ambulance crews | Transcribes the patient encounter, drafts vitals, medications, history and a handover, and sends the confirmed record to the receiving hospital and the crew's own record system. |
| VoiCaba Nursing Android, iOS |
Ward nurses | Transcribes bedside care, drafts observations, drug rounds, admission and discharge notes for the nurse to confirm. |
| VoiCaba ePCR Android, iOS, web |
Clinicians and records staff | Reviews, corrects, signs and exports completed patient care records. It does not record audio or take photographs. |
| Hospital Dashboard and Dispatch Web |
Emergency departments, dispatchers, administrators | Shows incoming handovers, manages organisation settings, users and devices. |
All of them store their data in the Clinical Platform, which we host for each customer in the Microsoft Azure region the customer chose (section 9).
4. Information the apps process
About patients
- The spoken encounter, as text. Speech is streamed to a speech-recognition service and returned as a transcript. Audio is not stored unless the deploying organisation has turned audio retention on, in which case the app tells the crew and the organisation tells its patients.
- Clinical content drawn from the transcript and confirmed by the clinician: identity details, age, sex, NHS number where applicable, vital signs, medications, allergies, history, assessments, treatments, destination and handover notes.
- Photographs and video of the scene, injuries, medication containers or monitor screens, only where the organisation has enabled camera capture and only when the clinician takes them. VoiCaba ePCR displays media attached to a record but cannot capture any.
- Transport progress (distance and estimated arrival at the destination hospital), only when the organisation has turned that on. See the location permission below.
- Patient signatures captured on the device for consent or refusal, where used.
About clinicians and staff
- Work identity: name, work email address, organisation, role and sign-in events, provided by your organisation's Microsoft Entra ID directory. The apps do not create accounts of their own and we never see your password.
- Voice attribution: the apps separate who is speaking so that a bystander's words are never charted as the clinician's. On the device this uses transient voice features that are discarded. A clinician can choose to keep a voice profile on the platform to improve attribution, and can remove it at any time.
- Who did what: an audit trail of which clinician confirmed, corrected, signed or sent each part of a record. Healthcare records require this and it cannot be switched off.
About the device and the service
- Device registration: a device identifier, model, operating-system version and app version, so that your organisation can approve, revoke or remotely wipe the device.
- Diagnostics: application logs and crash reports with patient details redacted before they leave the device. They record which screen was open and what failed, not what was said.
- Usage measurements such as how long a transcript took to arrive or how many corrections a draft needed, used to monitor accuracy and safety. These are not used for advertising, profiling or sale.
We do not use any of this information for advertising, we do not sell it, and we do not share it with data brokers.
5. Device permissions and why each is requested
| Permission | Apps | Why |
|---|---|---|
| Microphone | EMS, Nursing | To transcribe the encounter while a recording session is running. The app shows a persistent notification while it is listening and the clinician can stop it at any time. |
| Camera | EMS, Nursing | To photograph injuries, medication containers or monitor screens for the record, only when the organisation has enabled camera capture. |
| Location (while in use) | EMS | To share the unit's distance and arrival time with the destination hospital during transport, only when the organisation turns this on. Positions are sampled once a minute during an active session, stay on the device, and are purged when the session ends; only the computed distance and arrival time are sent. |
| Bluetooth and local network | EMS | To pair with a GoPro camera or a patient monitor and transfer media or readings. No other devices are scanned for and nothing is sent to them. |
| SMS | EMS | To send a hospital pre-alert message from the device to the receiving department's number, only when the organisation has chosen SMS as a pre-alert channel. The app logs the message length, never the number or the text. |
| Notifications | EMS, Nursing | To show that a session is recording or syncing in the background. |
| Face ID / biometrics | EMS, Nursing | To unlock the app on the device. Biometric data never leaves the device and is handled by the operating system. |
| Internet and network state | All | To talk to the Clinical Platform and the speech service, and to queue work offline until a connection returns. |
Every permission is requested when the feature that needs it is first used, and can be withdrawn in the device settings. The related feature then stops working; the rest of the app does not.
6. How the information is used
- To draft the clinical record from the encounter and present it to the clinician for confirmation. Nothing goes on the record until a clinician has reviewed it.
- To hand the record over to the receiving hospital and to the organisation's own record system, in the formats the organisation has configured (for example NEMSIS in the United States or FHIR).
- To send the patient care report by email from a Diffusion Solution address to the recipients the organisation has configured.
- To let the organisation manage its users, devices and settings, and to let it revoke or wipe a lost device.
- To keep the service secure, diagnose faults and monitor the accuracy and safety of the drafts.
- To meet legal obligations, including those that apply to healthcare records and to medical-device software.
7. AI and speech processing
The apps use Microsoft Azure AI Speech to turn speech into text, and may run a speech model on the device itself to show a provisional transcript while offline. Clinical extraction (turning the transcript into draft vitals, medications and notes) runs under rules and models that we control. Where an organisation has enabled optional image reading, Azure AI Vision reads medication labels and monitor screens from photographs the clinician has taken.
The speech service is configured not to retain audio or transcripts. We do not use patient information to train models that serve other customers. AI output can be wrong or incomplete, which is why every value is shown to the clinician for confirmation and every change is recorded.
8. Who the information is shared with
- The receiving hospital named as the destination, which sees the handover and the record the clinician chose to send.
- The deploying organisation: its clinicians, records team and administrators, according to the roles the organisation assigns.
- Sub-processors that host and operate the service for us, listed below. Each is bound by a data processing agreement and processes data only to provide its service.
- Authorities, when the law requires it or to protect someone's safety, and then only what is required.
| Sub-processor | Service | Data |
|---|---|---|
| Microsoft Azure | Hosting, database, storage, messaging, speech recognition, image reading, email, logging | Patient records, media and transcripts in the customer's chosen region; redacted logs |
| Microsoft Entra ID | Sign-in and multi-factor authentication | Clinician work identities (held in your organisation's own tenant) |
| Google Play, Apple App Store and TestFlight | App distribution and crash reports to the store | Installation and crash statistics; no patient data |
| GitHub | Source code and release builds | No personal or patient data |
We do not share information with advertising networks, analytics brokers or social networks.
9. Where the information is stored
Each customer's Clinical Platform runs in one Microsoft Azure region, chosen by the customer, and patient information stays in that region and its paired backup region:
- United States: West US 2, backups in the US.
- Canada: Canada Central, backups in Canada East.
- United Kingdom: UK South, backups in UK West.
The app on the device is pinned to one region and cannot send a record anywhere else. Our staff reach production only through named accounts with multi-factor authentication and the platform's own access roles; there is no direct access to the database from outside its private network. Where support access by Microsoft is possible it is governed by Microsoft's data protection terms.
10. Retention and deletion
| Data | Kept for |
|---|---|
| The clinical record | As long as the deploying organisation's records policy requires for a health record. The organisation sets the schedule; the platform applies it. |
| Transcript of the conversation | 90 days on the platform by default, then deleted; the confirmed record it produced is kept with the record. |
| Audio | Not stored unless the organisation turns retention on; then under the organisation's media retention period. |
| Patient data on the device | Encrypted on the device until the record is sent and finished, then removed. A clinician can remove all patient data from the device at any time from Settings, and the organisation can wipe a revoked or lost device remotely. |
| Voice profiles | Until the clinician removes them or leaves the organisation. |
| Platform logs and crash reports | 30 days. |
| Audit trail | With the record, as healthcare records law requires. |
| Backups | Within the backup window of the region (up to 35 days), after which deleted data is gone from backups too. |
At the end of a contract the organisation's data is returned to it in a standard export and then deleted from the platform.
11. Security
- All connections use TLS. Data at rest is encrypted on the platform and on the device.
- Sign-in is through your organisation's directory with multi-factor authentication; devices must be registered and approved by the organisation before they can send a record.
- Access is limited by role, organisation and patient, and every access to a record is logged.
- Patient details are redacted from logs and crash reports before they leave the device.
- We run automated security scanning on every release, keep a threat model and a security baseline for the platform, and commission independent penetration testing.
- If we become aware of a breach affecting a customer's data we notify that customer without undue delay and within 24 hours, so that it can meet its own notification duties.
12. Your rights
Depending on where you are, you have the right to see the personal information held about you, to have it corrected, to have it deleted where there is no overriding reason to keep it, to restrict or object to its use, and to complain to a supervisory authority such as the UK Information Commissioner's Office or your provincial or state privacy regulator.
Patients: contact the healthcare organisation that treated you. It holds your record and will respond; we assist it. Clinicians: your organisation manages your work account. To remove a voice profile, use the app or ask your administrator. For anything that concerns our own processing, contact us using the details below. We answer within one month.
13. Children
The apps are for use by healthcare professionals only and are not directed at children. Patient records may concern children; that information is processed on the instructions of the treating organisation under the same safeguards as any other patient record.
14. Changes to this policy
We will update this page when the apps or our processing change, and we will update the effective date at the top. Deploying organisations are told of material changes in writing before they take effect.
15. Contact
Diffusion Solution
Email: info@diffusionsolution.com
Web: diffusionsolution.com
Please say which app you are asking about, which organisation you work for or were treated by, and whether you are asking for access, correction or deletion.