Privacy Policy

Last updated: 2026-09-17

Who we are

Sard is clinical documentation software for clinicians in Jordan. Contact us at [email protected] for anything in this policy.

Our role depends on who you are

If you are a clinician using Sard, the account we hold is ours to answer for. If you are a patient, the clinician or clinic treating you decides what goes in your record and how long it is kept; Sard processes it on their instructions. Ask them first — and ask us if they cannot answer.

What we collect

From a clinician holding an account:

• Your email address, and, if you set one, a password we never see in readable form — Google hashes it. An account created with Continue with Google has no password with us at all.
• If you sign in with Google: your name and profile photo, from that account.
• Your full name as it should appear on a note you sign, your profession and your professional registration number — and, if you give them, your specialty, where you practise and your phone number.
• Which clinics you belong to, and whether your account has been granted clinical access.
• Which version of these documents you accepted, and when — recorded only if you signed up with an email address and a password. The Continue with Google route reads no acceptance and writes none, and an account created that way cannot acquire one afterwards.

We also hold records of your use of the service that you cannot see anywhere in the app: one entry for every model call, carrying your account id, the consultation it belonged to, the model, the token counts, the cost and how long it took; a daily spend counter; an administrative audit trail recording a clinician's email address against every change to their access; the upload handle for each recording, which is never deleted; and, while an email verification code is outstanding, your email address in plain text beside a one-way hash of the code. None of them has a retention period, and the database shows you none of them.

From a consultation, once a patient has agreed to it being recorded:

• The audio of the consultation.
• The transcript, and the clinical note drafted from it.
• The timed segments of that transcript, kept as a set per transcription — re-transcribing a consultation adds a new set and removes nothing.
• The patient's name, national ID, and age and gender where the clinician recorded them.
• A record that consent was obtained: when, how, and the exact wording used.
• The provisional impressions Sard inferred that the clinician did not state. These are written onto the consultation as soon as a draft is produced — beside the note rather than in it, and not part of what the clinician signs — whether or not anyone has looked at them yet.
• Any amendment a clinician makes to a note after signing it.

Feedback you send us. If you rate a note, send feedback or report a problem, we store what you wrote, your rating, the time, your interface language, your device type and your browser, linked to your account. The Sard team reads it and may reply in the app. If you chose to hide your name, the team sees the text without your name or account. When an item is urgent — a problem that stops your work, or a rating of 2 or below — a short summary is emailed to the team through Resend, our email provider. You can delete any item from your account page. When we close your account at your request, we delete all of it from Sard; an alert email already sent to our team is not recalled. Please don't include patient names or details. If you record your feedback instead of typing it, the recording is transcribed by the same Google model that transcribes consultations, and kept for 30 days so the team can listen to it, then deleted. If you hide your name, the recording is deleted as soon as you send.

We do not collect analytics, we do not use advertising trackers, and we do not sell anything to anyone. Two Google services do see technical details of your connection when you use Sard: reCAPTCHA Enterprise, which reads device and browser signals to score how likely a request is to have come from our app, and Google Fonts, which serves the typeface and receives your IP address, your browser and the name of the site asking for the font. Neither of them receives clinical content — but reCAPTCHA runs inside the page rather than alongside it, so it can read the address of the page you are on, and the address of a consultation screen carries that record's identifier.

Nothing is recorded without consent

Recording cannot start until the clinician has confirmed the patient agreed to it, and that confirmation is stored with the consultation. This is enforced in three places in our software, not just asked for — a recording with no consent record behind it cannot be uploaded at all.

Where it is stored

Google Cloud has no region in Jordan — read off the list of locations Google offered us when our database was created, which is the only record of it we hold. We use the closest available, which means your data leaves the country:

• Notes, transcripts and patient records: Dammam, Saudi Arabia.
• Consultation audio: Doha, Qatar — a storage bucket could not be created in Dammam on this project, so the audio went to the next region out. That is what happened to us, and we are not going to present it to you as a fact about Google's platform.
• Transcription and note drafting run on Google's Vertex AI through its global endpoint. That is our own configuration, not Google declining to say: it means Google may run the model in any of its regions, not only the two named above.

We say this plainly because it is the part a Jordanian clinic should ask about. The two storage regions are set in a Google console rather than in our own code, and nothing in the software reads one back and checks it — so this is what we believe the project is configured to do, not something we can show you from the code. Whether Jordan's Personal Data Protection Law No. 24 of 2023 permits this transfer, and on what basis, is a question we are taking legal advice on before any real patient consultation is recorded.

Who else processes it

• Google Cloud — databases, file storage, sign-in, hosting, and the AI models.
• Cloudflare — our domain and email routing. Mail sent to an address at sardscribe.com is forwarded on in full, body included, to a mailbox we hold elsewhere. We ask that clinical detail is not emailed to us, and nothing stops it being.
• Resend — the account emails we send you, and a short alert to our team when you send urgent feedback. Never a note or a transcript.
• Google reCAPTCHA Enterprise — scores whether a request came from our app. Device and browser signals, on every screen of the clinician app and the admin panel — not on this site — including the ones that show patient records. And our server does not yet turn a bad score away: the signals go to Google, the check is not enforced, so today it costs you the signals without buying the protection.
• Google Fonts — serves the typeface. Your IP address, your browser, and the name of the site asking for the font.

The table is here — what each one does, what it processes and where. We will update it before adding to it.

How long we keep it

We have not set a retention period yet, and we are not going to pretend otherwise. Recordings and notes are currently kept indefinitely so that a clinician can review them. Setting a proper period — and separate periods for signed notes and abandoned drafts — is work we are doing with legal advice before real patient data is recorded. Ask us in the meantime and we will delete what we lawfully can — but a consultation a clinician has signed is a clinical record and we will not delete it on request.

Note also that nothing inside Sard deletes a recording, a note or a patient record today. There is no delete control, and nothing in our software expires anything. Whether a rule set on the storage bucket itself expires a recording is configured in Google's console, which nothing in our code reads back — so we can no more tell you there is one than tell you there is not. The same holds for what follows a deletion: a deleted object stays recoverable on Google's side for a window set on that bucket, and we publish no number for it.

Your rights

These are the rights we will honour. How Jordan's Personal Data Protection Law No. 24 of 2023 enumerates them is a question we have put to our lawyers and have not had answered, so we are not going to give you a count of our own. Write to [email protected] for any of them and we will answer within 30 days. If you are a patient, we may need to pass your request to your clinician, because the record is theirs — we will tell you if we do. Your clinician can produce your notes from inside Sard: there is a control on the screen for your consultations that exports the notes they have signed for you, and nobody else's. It is the notes only — not the recording, not the transcript, not the consent record. Those we would have to produce by hand.

• Know what we hold about you and why.
• Correct anything that is wrong.
• Delete it, except where a signed clinical record must be kept.
• Withdraw consent at any time, without giving a reason. We act on it by hand, and it stops anything further being recorded rather than removing what already was — the consent record itself is written once and cannot be edited or marked withdrawn.
• Restrict how we process it while a dispute is being settled.
• Object to processing you did not ask for.
• Take it with you — a copy, in a format another system can read.
• Be told if your data is ever exposed in a breach.

No clinical decision about you is made automatically. Sard drafts a note; a clinician reads it, corrects it and signs it. No output reaches a patient record without a person having done that.

A clinician cannot un-sign a note. Once signed it is fixed, and a correction is recorded as an amendment alongside it rather than replacing it. That is deliberate: a medical record that can be quietly rewritten is not a medical record.

How we protect it

• Your email address must be verified before your account can open any patient record.
• Clinical access is granted per account, by hand. Signing up is not enough.
• A clinician sees only their own consultations — not a colleague's, not an administrator's. The patient's identity record is shared with the other clinicians in that clinic, because cover and handover are real: they can read it and they can change it, so a misspelled name is fixable by any of them. The national ID cannot be altered by anyone once written. The encounter is not shared.
• No browser can read a recording or even list one — that is what our storage rule says, and seven automated tests hold it to it. The caveat we would rather you heard from us: the project configuration that deploys that rule names no bucket, which points it at the project's default bucket, and the recordings live in a different one. Nothing in our code reads back which bucket the rule landed on, so we can show you the rule and not its deployment. The rest of this we can show: the app can write only the single object our server authorised it to write, and nothing can fetch it back. Our server never downloads it either — it passes Google's model a reference, and the model reads the recording from storage itself.
• Data is encrypted in transit and at rest. Both are Google platform defaults rather than controls we configure.
• Not a protection, said here because it belongs in this list: people at Sard holding the project's own credentials can reach the database and the storage bucket. Nothing in the software restricts that, and whether every such read is logged is a console setting we cannot check from our own code.

Children

Sard is used by clinicians, not by patients, and is intended for adult care. That is an intention rather than a control: nothing in the product checks a patient's age or requires a guardian. The consent record can be marked as a guardian's, and a written reason is required when it is — but a clinician recording a child can equally mark it as ordinary verbal consent, and nothing in the software objects.

Changes

If we change this policy we will change the date at the top. If a change affects what we do with consultation data we will tell clinics directly rather than relying on anyone re-reading this page.

Complaints

Write to [email protected] first. You can also complain to the unit responsible for personal data protection at Jordan's Ministry of Digital Economy and Entrepreneurship — the body Law No. 24 of 2023 calls "the Unit", which works alongside the Personal Data Protection Council. You do not need to come to us first to do so.