Privacy Policy
Penwell is a Chrome extension made by Armada Labs Studio Ltd (company no. 16782069, registered at 45 Colebrooke Avenue, Ealing, London W13 8JZ, United Kingdom — "we", "us"). It lets healthcare clinicians dictate notes by voice directly into Cliniko, their practice-management software. This policy explains what data Penwell touches, what we keep, and — mostly — what we deliberately don't.
Questions, requests, or complaints: support@penwell.uk.
The short version
- We never store your dictation. Audio, transcripts, and note text pass through our systems in memory only — they are never saved to disk, logged, or retained by us, not even for a second after your request completes.
- We store one small account record about you: your email address, trial and subscription status, and a monthly count of notes processed. That's the entire database.
- We never see card details. Payments are handled entirely by Stripe.
- No analytics, no trackers, no ads, no selling of data. Ever.
What happens when you dictate
When you dictate, audio is captured in your browser and sent over an encrypted connection to our server (Cloudflare Workers), which passes it to our transcription provider (OpenAI) and, if you use polish or note routing, sends the resulting text to our AI provider (Anthropic). The finished text is returned to your browser and inserted into Cliniko — where it lives under your Cliniko account, governed by your agreement with Cliniko, not by us.
Our infrastructure is built on a zero-storage rule: no audio, transcript, or note content is ever written to storage or logs on our systems. Our error logs contain status codes and timings only, never content.
Our AI providers process content solely to provide the service. Under the commercial API terms we use, they do not use your content to train models; they may retain content for a limited period (typically up to 30 days) for abuse and safety monitoring, after which it is deleted.
Patient information and your responsibilities
Dictated notes may contain patient information, including health data (special category data under UK GDPR). For that clinical content, you (or your practice) are the data controller and we act strictly as a processor: we process it transiently, only to transcribe, polish, or route it as you direct, and we retain none of it. You are responsible for ensuring your own lawful basis for creating clinical records with software tools, exactly as with any dictation or practice-management product. Our processor commitments to you are set out in section 6 of our Terms of Service.
The account record we keep
To run your account we store, in Cloudflare's key-value storage:
| Data | Why | Lawful basis |
|---|---|---|
| Email address | Sign-in (magic links), identifying your account, service messages | Contract |
| Account created / trial end dates | Operating your 14-day trial | Contract |
| Subscription status + Stripe customer reference | Knowing whether you're subscribed; linking to billing | Contract |
| Monthly note count (a number — never content) | Fair-use limits | Legitimate interests |
| Sign-in and session tokens | Keeping you signed in — stored only as one-way hashes | Contract |
| Rate-limit counters | Abuse prevention — stored as one-way hashes, auto-deleted within 15 minutes | Legitimate interests |
We do not collect names, phone numbers, addresses, or anything else at sign-up. Sign-in emails are sent via Postmark; we send you no marketing.
Payments
Payments are processed by Stripe. Your card details go directly to Stripe and never touch our systems; we hold only your Stripe customer reference and subscription status. Stripe processes your payment data as described in its own privacy policy, and appears on your bank statement as PENWELL. Invoices are available through the billing portal in the extension.
Service providers (processors)
| Provider | What they do | What they process |
|---|---|---|
| Cloudflare | Hosting (Workers) and account storage (KV) | Account records; dictation content in transit/memory only |
| OpenAI | Speech-to-text | Dictation audio (transient; no model training) |
| Anthropic | AI text polish and note routing | Dictated text (transient; no model training) |
| Stripe | Payments, invoicing, billing portal | Payment and billing data |
| Postmark (ActiveCampaign) | Sign-in emails | Your email address |
Each provider operates under a data processing agreement. Where processing happens outside the UK (all of the above are US-headquartered with global infrastructure), transfers are safeguarded by UK-approved mechanisms — the UK Extension to the EU–US Data Privacy Framework and/or the UK International Data Transfer Addendum to standard contractual clauses.
How long we keep things
| Data | Kept for |
|---|---|
| Dictation audio, transcripts, note text | Not stored — zero retention on our systems |
| Sign-in links | 15 minutes, then deleted automatically |
| Sessions | 90 days, then you sign in again |
| Rate-limit counters | 15 minutes, automatic |
| Account record | While your account is active, then deleted 12 months after your access ends — or immediately on request |
| Billing records (at Stripe) | As required by UK tax law (6 years) |
Your rights
Under UK GDPR you can ask us to access, correct, delete, restrict, or export the personal data we hold about you, or object to our processing. Given how little we hold, most requests are simple: email support@penwell.uk and we'll respond within one month. Deleting your account removes your account record from our storage; billing records remain with Stripe only as long as tax law requires.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk). We're registered with the ICO under number ZC143978.
Security
All connections use TLS encryption. Sign-in and session tokens are stored only as one-way hashes. API keys for our providers are held in Cloudflare's encrypted secret store, never in the extension. The extension runs only on Cliniko pages, requests no access to other websites, and contains no third-party analytics or tracking code. Our sign-in emails use one-time links that expire in 15 minutes.
What we don't do
No advertising. No analytics or tracking in the extension. No cookies set by our service. No selling, renting, or sharing of data beyond the providers listed above. No use of your content to train AI models. No marketing emails — the only emails you'll get are sign-in links and essential service messages.
Children
Penwell is a professional tool for healthcare practitioners and is not intended for use by anyone under 18.
Changes
If we change this policy we'll update this page and the effective date, and for significant changes we'll email account holders. We won't reduce the zero-storage commitment described here without your explicit consent.