Privacy Policy
Dr House — emergency department triage decision support
Last updated 21 September 2026
Draft. Not yet reviewed by a lawyer or a DPO.
This describes, accurately, what the software actually does with data today. It is not a compliant privacy notice for processing real patient data. Before any real patient data touches this system you need a Data Protection Impact Assessment, a documented lawful basis under GDPR Articles 6 and 9, a data processing agreement with the hospital, and sign-off from a Data Protection Officer. None of those exist yet.
1. Roles
During the pilot, your organisation is the data controller and ACE AI Spark, Inc. is a processor acting on its instructions. No data processing agreement is yet in place; one is required before processing any personal data of patients.
2. What is actually collected
Staff accounts
- Email address and a display name
- A password, stored only as a hash by our authentication provider
- The site you belong to, and which triages you recorded
Triage records
- A free-text label. Intended for a location such as “Cubicle 4”. The interface instructs staff not to enter names, and the system cannot enforce that — anything typed there is stored.
- Age, and flags for pregnancy, immunosuppression and anticoagulation. Age plus clinical findings is health data under GDPR Article 9 even without a name.
- Presenting complaint, including free text in the patient’s own words
- The across-the-room assessment, red flags ticked, and observations
- The engine’s suggestion and every rule that fired, the category assigned, and the reason given for any override
Avatar sessions
- The briefing sent to the avatar, which contains the triage findings above
- The transcript of what was said, and the call duration
Avatar calls are processed by ACE AI Spark’s live avatar platform and its upstream providers. Audio leaves this system to be processed by them. That transfer needs to be mapped and covered by agreements before real data is involved.
Not collected
No analytics, advertising or tracking cookies. No third-party trackers. The only cookies are those needed to keep you signed in.
3. Where it is stored
In a PostgreSQL database hosted by Supabase in London (eu-west-2), inside the EU/UK region. The application is hosted by Vercel. Authentication emails are sent through Resend.
4. Who can see it
Access is enforced by the database itself, not only by the application. Every query runs under the signed-in user’s own rights, and a staff member can read only the triages belonging to their own site. This was verified by test: a user at a second site reads zero rows from the first.
ACE AI Spark staff with database administration access can technically read stored records. That access is not currently logged or restricted by role, which is a gap that must close before real patient data is processed.
5. Records cannot be changed or deleted
Triage records are append-only and enforced as such by the database. Neither staff nor administrators can edit or delete one through the application; a correction is a new record.
This conflicts with erasure rights
A data subject’s right to erasure and rectification under GDPR Articles 16 and 17 sits in direct tension with an immutable clinical audit trail. There are legitimate grounds for retaining medical records, but which apply here is a question for the controller and its DPO, and the answer should be written down before go-live rather than after a request arrives.
6. Retention
No automated retention or deletion schedule is implemented. Records persist until deliberately removed. A retention period must be agreed with the controller and enforced before real use.
7. Security
- Encrypted in transit (TLS) and at rest by the database provider
- Row-level access control enforced in the database
- Server-side secrets never exposed to the browser
- Scheduled jobs authenticated by a shared secret, refusing to run without one
Not yet in place: multi-factor authentication, administrator access logging, an independent penetration test, and a documented breach-notification procedure.
8. Your rights
Where GDPR applies you may request access, rectification, erasure, restriction, portability, or object to processing. During the pilot, direct requests to your own organisation as controller, or to us at idoboaca@aceaispark.com. You may also complain to your supervisory authority — in Romania, ANSPDCP.
9. Contact
ACE AI Spark, Inc. — idoboaca@aceaispark.com. No Data Protection Officer has been appointed; whether one is required is among the questions for the DPIA.