Data protection

For your account and billing records, New Age Bridge Ltd (trading as DictaFlex) is the controller. For patient, client or case content you dictate into the platform, your organisation is the controller and DictaFlex is the processor, acting only on your instructions.

Performance of our contract with you for providing the service, legitimate interests for security and service integrity, legal obligation for tax and records, and consent where we ask for it separately (for example non-essential cookies).

Data is held with managed cloud infrastructure providers. Speech recognition, email delivery and payment processing are performed by contracted sub-processors, each limited to that purpose. Where any transfer outside the UK or EEA occurs, it relies on approved safeguards such as the UK International Data Transfer Addendum.

Role-based access enforced server-side; row-level security on every data table; encryption in transit and at rest; two-factor authentication; full audit logging of administrative and record activity; document version history; scheduled automated security scanning; and least-privilege administrative access.

You control your content and can delete it at any time. On workspace closure, content is removed within a reasonable period, other than records we must keep for legal, tax or security purposes.

We maintain an incident log and response procedure. Where a breach affects your data we notify you without undue delay with the facts as known, the likely consequences and the steps taken, so you can meet your own reporting duties.

We assist controllers with access, correction, deletion and portability requests, and can enter into a data processing agreement. Ask via our contact page. Our general privacy policy sets out individual rights in full.