Privacy Policy
Last updated: 30 October 2026
This policy explains what personal data Sondeas collects, why, who processes it for us, and the rights you have. It covers the Sondeas website, the web app, the Android and Mac apps and the browser extension.
1. Who we are
The controller of your personal data is WESOLVERS LTD, a company registered in United Kingdom (company number 11797268), Kemp House, 152 - 160 City Road, London EC1V 2NX, United Kingdom. For anything about your data, write to [email protected].
When a clinic or practice uses Sondeas for its patients, the practice is the controller of its patients' data and we process it on the practice's instructions, under a data processing agreement (DPA) that practices can sign with us.
2. Information we collect
- Account details: your name, email address, password (stored only as a hash) or the account you sign in with (Google or Facebook), your language and settings.
- Your content: recordings and uploads, transcripts, notes and other outputs, and anything you write in Sondeas. In clinical use this can include health data about patients.
- Payment details: your plan, purchases and invoices. Card details go straight to Stripe; we never see or store your full card number. To limit free trials to one per card, we keep a fingerprint of the card that Stripe gives us; it does not reveal the card number.
- Usage and device data: sign-in times, the features you use, error reports, IP address and browser or device type, used to run and secure the service.
- Messages to us: what you send through the contact form, support requests and practice demo requests.
- Cookies: the cookies needed to keep you signed in and remember your choices. Analytics and marketing cookies are off until you turn them on under Privacy choices.
3. How we use your information
| Purpose | Legal basis |
|---|---|
| Run your account and provide the service you ask for (transcription, outputs, storage, sync across devices) | Contract |
| Process payments, invoices and refunds | Contract; legal obligation (tax records) |
| Keep the service secure and prevent fraud and abuse (including the human check at sign-up) | Legitimate interests |
| Send service emails (verification, security, receipts, important changes) | Contract |
| Answer your messages and demo requests | Legitimate interests |
| Measure and improve the website and campaigns, only with your consent | Consent |
We do not sell your data and we do not use your content to train our own models.
4. Who processes your data for us
We send data to these providers only for the task you ask for:
| Task | Providers |
|---|---|
| Transcription | OpenAI, Groq, AssemblyAI, Deepgram |
| Notes, summaries, letters, translations, Ask answers | OpenAI, Anthropic |
| Help assistant (questions about using the app) | Anthropic |
| Voiceover (text to speech) | OpenAI |
| File and recording storage | Google Cloud |
| Payments and invoices | Stripe |
| Human check at sign-up and on forms | Cloudflare (Turnstile) |
| Sign in with Google or Facebook | Google, Meta (only if you choose them) |
| Service emails | our email delivery provider |
| Website analytics and advertising measurement | Google, Meta, Microsoft, Pinterest (only with your consent) |
With your consent to marketing cookies, when you sign up, request a practice demo, get your first transcript or note, or pay, we tell the ad platform whose ad brought you: the ad's click identifier, a hashed (one-way scrambled) copy of your email address, your IP address and browser type, and the amount paid. We never send your recordings, notes or anything about patients.
Under their API terms, OpenAI and Anthropic do not use data sent through their APIs to train their models. We send every Deepgram request with model improvement turned off.
Some of these providers process data outside the UK and the European Economic Area, mainly in the United States. Where that happens, the transfer is protected by safeguards the law recognises, such as the standard contractual clauses.
5. How we protect your data
Recordings and notes are encrypted at rest. Sensitive fields are encrypted with ChaCha20-Poly1305. If you set a privacy passphrase, your notes are encrypted with keys derived from it that only you hold, so our staff cannot read them. Practice data is encrypted with keys that belong to the practice.
6. How long we keep it
We keep your account and content until you delete them or close your account. Deleted content is removed from the service; payment records are kept for as long as tax law requires. Practice demo requests are kept for 12 months. Practices can set their own retention rules for clinical records.
7. Your rights
You can ask to see, correct, export or delete your personal data, to restrict or object to how we use it, and to withdraw consent at any time. You can export or delete your data yourself from Settings, change your cookie choices under Privacy choices, or write to [email protected]. We answer within one month.
If you are not happy with how we handle your data, you can complain to the UK Information Commissioner's Office (ico.org.uk) or to the data protection authority where you live.
8. Children
Sondeas is not for anyone under 18, and we do not knowingly collect data from children.
9. Changes to this policy
If we change this policy in a way that matters to you, we will tell you by email or in the app before the change applies. The date at the top shows the latest version.
10. Contact us
Privacy and data requests: [email protected]. Security: [email protected]. Post: WESOLVERS LTD, Kemp House, 152 - 160 City Road, London EC1V 2NX, United Kingdom.