BetterLetter Privacy Notice

What is BetterLetter?

St Andrews Medical Centre uses BetterLetter, an AI-supported clinical document processing system provided by Dyad Artificial Intelligence Limited.

BetterLetter helps the practice manage incoming clinical letters more efficiently by:

• Importing clinical letters into a secure workflow
• Analysing letters to suggest relevant clinical codes (e.g. SNOMED CT)
• Supporting accurate filing into your medical record
• Assisting with document workflow and task allocation

All final clinical decisions and coding are reviewed and approved by appropriately trained staff at the practice.

Why we use BetterLetter

We use this system to:

• Improve accuracy and consistency of clinical coding
• Reduce delays in processing hospital and specialist letters
• Ensure important clinical information is added promptly to your record
• Improve patient safety and administrative efficiency

This supports our contractual obligations as an NHS GP practice.

What information is processed?

BetterLetter processes information contained within clinical correspondence relating to you. This may include:

• Name, date of birth, NHS number
• Clinical information contained in hospital or specialist letters
• Diagnoses, medications, investigations and treatment plans
• Other relevant health information included in correspondence

BetterLetter only processes letters that we upload or make available within our secure clinical systems.

Lawful basis for processing

We process your information under:

• UK GDPR Article 6(1)(e) – Public task
• UK GDPR Article 9(2)(h) – Provision of health care

BetterLetter acts as a data processor on behalf of the practice. St Andrews Medical Centre remains the data controller for your medical records.

How your data is protected

• All patient data is stored and processed within the UK.
• BetterLetter uses secure cloud infrastructure (Google Cloud).
• The provider holds recognised UK health data security certifications including:
  • DTAC (Digital Technology Assessment Criteria)
  • Cyber Essentials
  • DSPT (Data Security and Protection Toolkit)
• Staff involved in processing are UK-based and bound by confidentiality obligations.
• A Data Processing Agreement and Data Protection Impact Assessment (DPIA) are in place.

Access is restricted to authorised users only.

Automated processing

BetterLetter uses artificial intelligence to suggest clinical codes and workflow actions. However:

• The system does not make clinical decisions.
• All suggested codes are reviewed by trained staff.
• Clinical responsibility remains entirely with the practice.

How long information is kept

Your medical record, including processed letters, is retained in accordance with NHS Records Management Code of Practice requirements.

Your rights

You have the right to:

• Request access to your medical record
• Request correction of inaccurate information
• Raise concerns about how your information is used

If you have any questions about how we use BetterLetter or your personal data, please contact the practice directly.

You also have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how your data is handled.