Privacy Policy - Clinical Voice AI (Diario Clinico AI)

1. Who we are

Clinical Voice AI (in Italian Diario Clinico AI) is an app by Local People Lab, the brand under which the following work together ("we", "us"):

• Marco Cuccaro, self-employed professional, Via Don Pompeo Beretta 2, 20013 Magenta (MI), Italy, VAT number 08529980966;
• Francesco Di Pierro, Via della Capinera 6, 20147 Milan (MI), Italy.

For the data we control (section 5) we are joint controllers (Art. 26 GDPR): we have agreed between us who handles what, and you can address any request to either of us, at the address below.

• Email for privacy matters and any request: info@localpeoplelab.com
• Website: https://localpeoplelab.com

We have not appointed a Data Protection Officer: it is not required for our activity.

2. In short

• The app is for healthcare professionals (physiotherapists, osteopaths, doctors, psychologists, nutritionists, midwives, speech therapists, developmental therapists and similar) who keep clinical notes about their patients. It is not meant for patients or for anyone under 18.
• Patients, calendar and notes stay on your phone, encrypted. We have no database of your patients and cannot read them.
• If you use AI dictation, the audio of the dictation passes through our service to Google (Gemini on Vertex AI, in the European Union), which transcribes it and splits it into the sections of the note. We do not keep the audio or the text.
• About you we keep only the minimum: your Google account identifier, how many AI notes you used each month, whether you have Pro.
• No ads, no analytics or tracking tools, no sale of data, no training of AI models on your data.

3. Two different roles: your data and your patients' data

Your data as a professional (account, note counter, subscription): we are the data controller.

Your patients' data (names, phone numbers, appointments, clinical notes, dictations): you, the professional, are the controller. You decide whom to add, what to write and how long to keep it; you must inform your patients and have a legal basis to process their health data.

• While the data stays on the phone, we neither receive nor see it: for that part we are not even a processor. We only provide the tool.
• When you use AI dictation, we process the audio (and therefore the health data it contains) on your behalf for the time needed to write the note: for this step we are a processor (Art. 28 GDPR), and Google is our sub-processor.

What we suggest you tell your patients in your own privacy notice: that you keep clinical notes in an app, encrypted on your phone, and that notes may be dictated and transcribed by an artificial intelligence service that processes the audio in the European Union without keeping it.

4. Data that stays on your phone

What you enter in the app stays only on the phone:

• patients (first name, last name, phone number if you add it, a free note);
• calendar (appointments, services, duration, price);
• session notes (the sections of the note and, for dictated notes, the transcript of what you said);
• your settings (greeting name, profession, note sections, colours);
• the name and email of your Google account, received when you sign in.

How it is protected:

• the whole diary is in an encrypted file (AES-256-GCM) in the app's private folder, which other apps cannot see;
• the key is in the phone's safe (Android Keystore) and opens only with the phone unlock (fingerprint, face, PIN or pattern), or with your 24-character recovery code, which only you have;
• the app locks itself when it comes back from the background (immediately, after 1 or 5 minutes, as you choose);
• in the recent apps list the screen is hidden, and screenshots are blocked;
• the diary is excluded from Android's automatic backup and from phone-to-phone transfer.

Only small preferences with no personal data stay unencrypted on the phone (colours, font, calendar view, tips already seen, lock delay).

The dictation audio is not saved on the phone: it stays in memory while you record and until the note is written.

If you tap Call or WhatsApp on a patient's page, their number goes to the phone app or to WhatsApp: it is your choice, and from there that app's privacy policy applies.

5. Data we process as controller

We never store patients' names or data, notes, transcripts or recordings.

The app cannot be used without Sign in with Google: it is needed to recognise you and for the note counter.

6. AI dictation

When you dictate a note (5 minutes at most) and tap "Done":

1. the phone sends, encrypted over HTTPS, the dictation audio, the note sections you chose (their titles and the description of what goes in them) and the profession you chose. The patient's name or other patient data are not sent; only what you say out loud;
2. they reach our service (Google Cloud Run, Milan region), which checks your access and the counter and forwards them to Google Gemini on Vertex AI, in the European Union area;
3. Gemini returns the transcript and the note split into sections; our service sends them back to the phone, where they are saved, encrypted.

Our service does not keep the audio or the text: it holds them in memory for the duration of the request and does not write either of them to its logs.

Google processes this data as our sub-processor, under the Google Cloud terms and the Cloud Data Processing Addendum, and does not use it to train its models. We have turned off the Vertex AI technical memory (cache): Google does not keep the audio to answer faster. Only the abuse monitoring provided for in the Google Cloud terms remains, for a limited time.

Legal basis for the health data in the dictation: the processing is carried out on behalf of the professional, who is the controller, as part of their healthcare activity and under professional secrecy (Art. 9.2.h and 9.3 GDPR).

AI can make mistakes: it may misunderstand words or leave information out. Always reread the note before treating it as final; you can correct it by hand. The app does not diagnose or give clinical advice and does not make decisions for you. It is not a medical device.

You don't have to use AI: notes can also be typed or dictated with the phone keyboard's microphone, and in that case nothing is sent.

7. Backups

Manual backup (More → Backup): the app creates a file with the encrypted diary and you save it wherever you like (Drive, email, files). It opens only with your recovery code. We do not receive it.

Automatic backup to Google Drive (if you turn it on in More → Backup): the app saves the same encrypted file in the app's private folder on your Google Drive (a hidden folder only the app can see; the app cannot see the rest of your Drive). It is updated at most every 30 minutes. The file is encrypted on the phone before it leaves, with a key Google does not have: neither Google nor we can read it. The relationship with Google Drive is between you and Google; we do not receive the copy. You can turn it off at any time and delete the copy (section 13).

8. Pro subscription

Pro is bought inside the app through Google Play: payment, invoice and cancellation are handled by Google, and we never see your card details. To know whether your Pro is active we use RevenueCat, which receives from Google Play your purchase history and your Google account identifier (not your email, no patient data). The RevenueCat library in the app does not collect the advertising ID.

9. Sign in with Google

You sign in with your Google account. Google gives us your name, email and an account identifier; Google's privacy policy also applies to sign-in (https://policies.google.com/privacy). You can remove the app's access to your account at https://myaccount.google.com/connections.

10. Who receives the data

We do not sell data or give it to anyone for advertising. These parties process it on our behalf, as processors or sub-processors:

• Google Cloud EMEA Limited (Ireland): our service (Cloud Run, Milan), the counter (Firestore, Milan), technical logs, transcription with Gemini (Vertex AI, European Union area);
• RevenueCat, Inc. (United States): subscription status.

These are independent controllers for the services you use with them: Google (Sign in with Google, Google Drive) and Google Play (payments).

We may have to disclose data to authorities only where the law requires it.

11. Data outside the European Union

Our service, the counter and transcription are in the European Union. Outside the Union:

• to RevenueCat in the United States: the account identifier and purchase history, on the basis of the standard contractual clauses approved by the European Commission, included in RevenueCat's data processing agreement;
• to Google, which may use sub-processors outside the Union for support and security, with the safeguards set out in its Cloud Data Processing Addendum.

12. What we don't do

• We show no ads.
• We use no third-party analytics, tracking or crash-reporting tools.
• We do not use the phone's advertising ID.
• We do not use your data or your patients' data to train AI models.
• We make no automated decisions about you (Art. 22 GDPR).

13. Account and data deletion

How to delete everything related to Clinical Voice AI (Diario Clinico AI) by Local People Lab.

1. If you have Pro, cancel the subscription first on Google Play (Play Store → profile icon → Payments & subscriptions → Subscriptions → Diario Clinico AI → Cancel). Deleting the account does not stop payments: Google handles them.

2. In the app: Altro (More) → Elimina account (Delete account). In one step it permanently deletes the diary from the phone (patients, calendar, notes and their key), the copy on Google Drive and the data we hold (account identifier, note counter, RevenueCat customer). An internet connection is needed. It cannot be undone: the diary can only be recovered from a manual backup made earlier, with the recovery code.

3. If you no longer have the app, or cannot use it:

• delete the Google Drive copy from Google Drive on a computer: Settings (gear) → Manage apps → Diario Clinico AI → Options → Delete hidden app data;
• for the data we hold, write to info@localpeoplelab.com with the subject "Account deletion Clinical Voice AI", from your Google account address (or stating it in the message). You don't need to reinstall the app. We delete everything within 30 days and reply when it is done.

4. Manual backups (Altro → Backup e dati) you delete yourself, wherever you saved them.

After deletion, only these remain:

• Google Cloud technical logs (IP address, request time), deleted automatically within 30 days;
• the data Google Play keeps for payments and tax obligations, as the seller, under its own privacy policy.

5. Remove the app's access to your Google account, if you wish: https://myaccount.google.com/connections.

14. Your rights

You can ask us at any time to access, correct or delete your data, restrict its use, receive it in a readable format (portability), and object to processing based on legitimate interest (Arts. 15-21 GDPR), by writing to info@localpeoplelab.com. We reply within one month.

You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, https://www.garanteprivacy.it) or with the authority of the country where you live or work.

Patients who want to exercise their rights over the data in the diary must contact the professional treating them, who is the controller: we do not have their data. If they write to us, we refer them to the professional.

15. Children

The app is for adult professionals and does not knowingly collect data of minors as users. Data of underage patients that a professional enters in the diary remains under that professional's responsibility as controller.

16. Changes

If we change this policy we update the date at the top and, if the change is significant, we say so in the app.