Privacy Notice - Truephase Notes

Version 0.2 · 8 November 2026 · the test-version notice. Version 0.2 adds detail about what the extension keeps on your computer and sends with a fill; nothing about how information is handled has changed. This notice will be replaced by version 1.0 after a solicitor's review and before Notes is used with any real patient. It is published at truephase-notes.vercel.app/legal/privacy and will move to truephase.co.uk/notes/privacy when our own address is connected.

Truephase Notes is a Chrome extension for physiotherapists. It reads the clinic form that is open in JellyPx, takes the conversation the physio had with the patient, asks an AI service to write the notes, and puts them into the form boxes. The physio checks every box and presses Save. The extension never presses Save.

This notice explains what information the extension handles, what Truephase keeps, who else is involved, and what your rights are. Find your section:

• You are a patient at a clinic that uses Truephase Notes - section 1
• You are a physiotherapist or clinic owner using Notes - section 2
• You are looking at the Chrome Web Store listing - section 3

Sections 4 to 9 apply to everyone.

Who we are

Truephase is Truephase AI Limited, a company registered in England and Wales with company number 17469289, of 11 St. Nicholas Road, Thorne, Doncaster, England, DN8 5BS. For anything about your personal information, write to privacy@truephase.co.uk. Our registration with the Information Commissioner's Office is in progress; the registration number will be published here when it is issued, and before Notes is used with any real patient.

1. If you are a patient

Who is responsible. Your clinic is responsible for your health information. In data-protection language it is the controller. Truephase handles your information only on your clinic's instructions, as its processor. Your clinic's own privacy notice applies too. You can exercise your rights through your clinic or through us; we will pass your request on and help.

What the extension reads. Only the JellyPx page that is open on your physiotherapist's screen: the questions on the form, and the patient number, name and date of birth shown on that page, so the extension can be sure it has the right patient. It does not connect to JellyPx's systems and cannot see any other patient's record.

What is sent to Truephase. When your physiotherapist asks the extension to fill in a form, it sends to our server: the form's questions (including any template text already in the long-answer boxes), what was said in the consultation (typed, pasted, or recorded and turned into text), and the patient reference above. If your physiotherapist leaves "Also use earlier visits" ticked, the earlier conversations with you that are saved on their computer are sent as well, so a follow-up note can refer to them. Our server sends the questions and the conversation to an AI service run by Anthropic, in the United States, which drafts the answers.

What we keep. The answers the AI wrote, the AI's short "please check" note to the physiotherapist, and the patient reference, plus the name of the physiotherapist who asked, the date and time, which form it was, and which AI model wrote it. The answers, the note and the patient reference are encrypted before they are stored, with a key that is not kept in the database. We keep them for 12 months, then delete them automatically. Your clinic can delete them sooner, and can set a shorter period for all its records.

What we do not keep. We do not keep the conversation itself. It is sent to the AI service to write the notes and is then discarded by us. We never keep any audio. Anthropic does not use information sent through its service to train its models. Before Notes is used with any real patient, Truephase will have Anthropic's data processing addendum in place with zero data retention, and will say so here.

Recording. Some clinics use the extension's Record button during the consultation. Your physiotherapist must ask you first, and you can say no, or ask them to stop, at any time; they will type the notes instead and your care is not affected. No audio is saved by anyone. At present recording uses Chrome's built-in speech-to-text, which sends audio to Google; for that reason recording is restricted to practice sessions and is not used with real patients. This paragraph will be updated when a transcription provider with a signed data agreement is connected.

Why, and the legal reason. Your clinic uses Notes to write up your consultation accurately and quickly. The legal reason is your clinic's, as the controller; for health information this is normally the provision of health care by a registered professional (Article 9(2)(h) UK GDPR). Your clinic confirms its own basis when it signs up.

Decisions about you. The AI drafts text. It does not decide anything about your treatment. Your physiotherapist reads every answer and can change or delete it before it is saved into your record. If the AI was not told something, it is instructed to leave the box empty rather than guess.

Test version. While this notice is version 0.1, Notes is used with practice patients and made-up conversations only. No real patient's information is processed.

2. If you are a physiotherapist or clinic owner

What we collect when you register.

• Everyone: your full name, email address, mobile number, HCPC registration number, job title (optional), the clinic you belong to, your role (owner or physio), and your password (stored only as a one-way hash by our login provider, Supabase).
• Clinic owners also give us the clinic's details: clinic name, registered business name and Companies House number (if any), address, telephone, email, website, number of physiotherapists, which practice system you use, your ICO registration reference (optional), and whether you treat patients under 18.
• Billing: when billing is switched on, your card details go directly to Stripe, our payment provider. We store only Stripe's reference numbers and the subscription status. We never see or store card numbers.
• What you agreed to: when you accept our Terms of Use, this notice, the Data Processing Agreement or the test-version notice, we record which version, a fingerprint of its exact text, the date and time, your login and the internet address (IP address) used, so we can show you what you agreed to.
• Account activity: a log of what happens on your clinic's account - who filled which form and when, who viewed or deleted a saved note, when the extension was connected or disconnected. This log never contains patient text.

What the extension keeps on your computer. Your login tokens; during a recording, the words heard so far and the time you ticked the consent box; the position of the on-page recording bar; and, for each practice patient, the earlier conversations together with that patient's name, date of birth and patient number, so the next SOAP note can use earlier visits. They stay in Chrome's local storage on that computer, are not encrypted by the extension and are not synced to other devices. You can delete a patient's conversations from the popup ("Forget this patient's saved conversations") or all of them from the extension's Settings page at any time. Before real patients, this history moves to our server, where it is encrypted like everything else.

Why we use your information. To provide the Service, bill the clinic, keep the account secure, keep a record of what you agreed to, and tell you about the Service.

Legal reason. Our contract with your clinic; our legitimate interest in running and securing the Service; legal obligations (keeping invoices for tax); and your consent for any optional emails.

How long. For as long as your clinic has an account, then 30 days. Invoices: 6 years, as tax law requires. The account log and the record of which agreements were accepted: 6 years.

3. If you are reading the Chrome Web Store listing

The extension has a single purpose: filling JellyPx physiotherapy clinic forms from the patient conversation, for the physiotherapist to check and save.

It reads only the JellyPx form page open on your screen (login.jellypx.com) and our own practice copy of that form (truephase-notes.vercel.app/practice). The extension's own code sends data only to Truephase's server (truephase-notes.vercel.app; truephase.co.uk when our own address is connected). The optional Record button uses Chrome's built-in speech-to-text, which sends the audio to Google (section 4). It does not sell data, does not use it for advertising, does not use it to decide creditworthiness or for lending, and does not transfer it to anyone except the companies in section 4 for the purposes in this notice. It handles health information (the conversation and the clinical answers), personally identifiable information (the patient's name, date of birth and patient number; the physiotherapist's name and email), authentication information (your Truephase login token) and website content (the questions, template text and patient details on the open form page), all for the single purpose above and nothing else.

Truephase Notes' use and transfer of information received from the user's browser adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

4. Who else handles the information

A sub-processor is a company that handles personal information on our behalf so that we can provide Notes. The companies below are the complete list for Notes. Each is bound by written terms to protect the information and to use it only to provide its service to us. We email every clinic at least 14 days before adding or changing one. The current list is always at Companies we work with.

A transcription provider with a signed data agreement, in the UK or EU, will be added before recording is allowed with real patients. Clinics will be told 14 days in advance.

5. Where information goes

Our database is in London. Our server code runs in London. The AI model is run by Anthropic in the United States, so the conversation text and the form's questions leave the UK for the seconds it takes to draft the notes. For that transfer we rely on Anthropic's data processing addendum and, as applicable, the UK Extension to the EU-US Data Privacy Framework or the Information Commissioner's Office's International Data Transfer Addendum. Stripe's processing of billing details follows Stripe's own UK and international arrangements.

6. How we keep it safe

Every clinic's records are separated in the database by rules the database itself enforces: one clinic can never see another's, and we test this automatically. Answers and patient references are encrypted in our server before they reach the database, with a key held only in our server's configuration, so a copy of the database alone is not enough to read them. Everything travels over encrypted connections (HTTPS). The extension never holds an AI key or any key to our database or to Stripe; it holds only your own login token. Truephase staff can see how many forms a clinic has filled, never the text. Every fill, refused fill, view and deletion of a saved note is logged.

7. Your rights

You can ask for a copy of what we hold about you, to correct it, to delete it, to restrict or object to what we do with it, and to receive it in a portable form. Write to privacy@truephase.co.uk. We respond within one month, free of charge. We may ask you to confirm who you are. If you are a patient, we will normally need your clinic's help to find your records, because the patient reference is encrypted and we do not look inside it without the clinic; Retention and deletion explains exactly how that works. If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve it first.

8. Children

Clinics may treat people under 18. The clinic is responsible for the consent and notices that children and their parents need; Truephase processes the information exactly as for any other patient. We ask each clinic at registration whether it treats under-18s.

9. Changes

We post changes here with a new date and version number, and tell clinics directly and in advance of any change that affects how patient information is handled. Version 1.0 will follow a solicitor's review of this notice.

Truephase AI Limited · 11 St. Nicholas Road, Thorne, Doncaster, England, DN8 5BS · privacy@truephase.co.uk