Private dictation
A plain-English confidentiality guide for professionals · Last updated: 1 August 2026
If you're a doctor, solicitor, barrister, accountant, or anyone else with professional secrecy obligations, you need to know exactly where your dictation goes before you speak a patient's or client's details near it. This page is that answer — plainly, completely, and without marketing gloss.
Where your dictation actually goes
That's the whole journey. There is no UtterKey server in the middle: we never receive, store, or see your audio or your text — ever.
What UtterKey (the company) can see
- Your purchase: name, email, and licence details from the payment processor
- Licence checks: your licence key and an anonymous device identifier, checked periodically so your licence works
- Nothing else. No analytics, no tracking, no dictation content, no audio — there's no infrastructure that could receive it even by accident
What the AI provider sees
The provider you choose (Groq or OpenAI) processes your audio to produce the transcript, and the transcript to produce the cleaned text — on your own account, under your own agreement with them. Both providers state that data submitted through their APIs is not used to train their models. Their retention windows and enterprise options change over time, so verify the current terms directly — that's part of your professional due diligence, and it takes five minutes:
- OpenAI: their API data-usage policy (at the time of writing: no training on API data; limited-time retention for abuse monitoring; zero-data-retention arrangements exist for eligible organisations — ask them)
- Groq: their data and privacy policy (states API data is not used for training; check current retention terms)
What stays on your machine
- Your API key and licence key — in the operating system's secure keychain, never in a plain file
- Your templates, snippets, and vocabulary — local files on your computer
- Your settings backup, if you export one — and it deliberately never contains your keys
Setting up for maximum confidentiality
1. You remain the data controller
Dictating patient or client information means you're processing personal data — same as typing it into the same system. UtterKey changes the input method, not your obligations under UK GDPR or your professional rules. Your organisation's usual policies about cloud services apply to your choice of AI provider.
2. Choose the provider deliberately
Review your chosen provider's current API terms (not their consumer-app terms — API terms are typically stricter in your favour). Larger organisations can often sign data-processing agreements or zero-retention arrangements directly with the provider.
3. Minimise identifiers where practical
Long-standing dictation practice applies unchanged: many clinicians dictate "the patient" and let the letter template carry the demographics. UtterKey's templates make this easy — the identifying fields live in your document; your voice fills the clinical content.
4. Use your own hardware discipline
UtterKey activates per device (up to 3). Keep it on machines you control, with the OS-level protections your profession already requires — disk encryption, screen lock, managed accounts.
What about fully-local AI?
Some organisations want dictation where the audio never leaves the building at all. We're actively exploring support for locally-run AI engines for exactly this audience. No promises and no dates on this page — if it matters to your organisation, email hello@utterkey.com and tell us; interest genuinely shapes the roadmap.
This guide is a factual description of how UtterKey works, not legal advice. For your specific obligations, consult your organisation's data-protection officer or professional body.
UtterKey for doctors → · for solicitors & barristers → · for professionals →