Security and data protection
Security and data protection at Nordnote
Nordnote handles conversations between clinicians and patients. That is why data protection is built in from the start: storage and AI in Sweden, everything stays within the EU, is deleted when you decide and is never used to train AI.
Where data is processed
All storage and AI processing take place in Microsoft Azure data centres in Sweden. Speech recognition runs at a sub-processor within the EU. All data stays within the EU.
| What | Where |
|---|---|
| Audio, transcripts and documents | Sweden (Azure Sweden Central) |
| AI that writes the note | Sweden (Azure OpenAI, Sweden Central) |
| Speech recognition (speech to text) | EU |
The clinic decides, we process
The clinic or care provider is the data controller and Nordnote is the data processor. A data processing agreement (DPA) is part of the subscription and the list of sub-processors is open.
Deletion after the session
Audio, transcripts and documents are deleted automatically according to the clinic's policy, for example one hour after export. Every deletion produces a receipt showing what was removed and when.
No AI training on your consultations
Content is only used to write your note. It is never used to train AI models and never used for analytics.
Patient consent
Before recording starts, the clinician confirms that the patient has consented. The consent is recorded on the session.
Sign-in, permissions and traceability
Users sign in with two-step verification or with their organisation's account via SSO. Roles control who sees what, and every action is written to an audit log – without clinical content.
AI as support, not decision
Nordnote documents what was said. It makes no diagnoses and gives no treatment advice. Diagnosis codes are suggestions the clinician confirms one by one, and nothing is exported without review. We are happy to share our assessment under the EU Medical Device Regulation (MDR).
Need the security documentation?
We send the DPA, the sub-processor list and our MDR assessment to your IT or data protection officer.