neoscript

GDPR overview

Compliance is claimed explicitly and in detail. The publisher invokes the GDPR together with the German BDSG and TDDDG, declares alignment with the Swiss DSG and with §393 SGB V, and offers every practice an Article 28 processing agreement (AVV) through a form in the customer account. Data subject rights are enumerated — Articles 7(3), 15, 16, 17, 18, 20 and 21 — with info@neoscript.ai as the contact and a right to complain to a supervisory authority, under five stated principles: lawfulness and transparency, purpose limitation, minimisation, storage limitation, integrity and confidentiality. A voluntary EU AI Act declaration signed in Wuppertal on 08/06/2026 classifies the tool as low-risk and not a medical device. No third-country transfer occurs in the core service; only payment through Mollie may trigger one, under standard contractual clauses. The subprocessor list, updated in January 2026, comes with notice by email and a right to object.

Who owns the data?

neoscript.ai UG (haftungsbeschränkt), Kirchstr. 1, 42103 Wuppertal, Germany, is the controller for the processing described in its own privacy notices, and names a data protection officer reachable at galip@neoscript.ai. For the clinical material itself the roles are reversed: the practitioner remains the controller of the patient record and neoscript acts as processor under Article 28 GDPR. With neoscript Lokal the publisher goes further and states that it holds nothing at all — audio, transcript and report stay on the practitioner's own Mac or PC, and it declares no access to them. Deleting patient data is in every case the user's own responsibility.

Reuse rights

Session audio is handled as health data under Article 9 GDPR. The legal bases invoked are Article 6(1)(b) for the contract, Article 9(2)(h) for processing in the context of care, Article 9(2)(a) where consent is needed, and Article 28 for the processor relationship. Transcription runs on open-source models on the publisher's own infrastructure, and the original audio file is deleted automatically once transcription has succeeded and the record has been produced. Any hand-off to an external AI provider such as OpenAI or Google is ruled out, patient data is never used to train models, and there is no automated decision-making or profiling under Article 22. The software logs no IP addresses and sets no cookies. Practically, the practitioner keeps and reuses the generated documentation freely: it goes into the patient record by Word export or copy-paste without asking anyone. That freedom is implied rather than written, however, because the publisher does not publish any terms of service — no licence, ownership or reuse clause covering the generated documents exists anywhere on the site.

Data retention & training

Hosting summary

For neoscript Pro, the AI processing runs on hardware the publisher owns, colocated at Artfiles New Media GmbH, Wendenstrasse 408, 20537 Hamburg, Germany. A reverse proxy sits at Hetzner Online GmbH in Gunzenhausen, Germany, and handles IP addresses only. The website itself is hosted by netcup GmbH in Karlsruhe, Germany. Around the service, transactional email goes through Brevo (Paris, EU servers), payment and subscription management through Mollie B.V. (Amsterdam, EU servers), and application monitoring through phare.io (Tallinn, servers in Frankfurt at Hetzner). The publisher states that none of these subprocessors handles health data or conversation content, and that the core service involves no transfer to a third country. With neoscript Lokal the question largely disappears: all patient data stays on the practitioner's own device, and the only outbound traffic is the one-time model download from Hugging Face at installation and a licence check against netcup servers in Karlsruhe twice a month.