Security
Built on trust.
Secure by design.
CE marked
Class I medical device
Certified under EU MDR 2017/745 as Class I medical software. Quality management, risk assessment and clinical evaluation.
GDPR
Documented compliance
Technical and organisational measures. All data processed within the EU/EEA.
Security tested
Against OWASP ASVS
Journalia has continuous security and penetration testing, carried out by Heist Security.
HOW WE PROTECT YOUR DATA
Encryption, access control and deletion,
built in from the start.
No audio retention
- Audio is not stored. It is transcribed in real time, then immediately discarded
- Transcription data is automatically deleted after processing
- Patient data is not used to train AI models
- Configurable retention policies for your organisation
Encryption in transit and at rest
- AES-256 encryption at rest, TLS 1.3 in transit
- User-level encryption, so only you can access your patients' data
- Data is processed and stored within the EU/EEA
SAML & SSO
- SSO for organisations via SAML 2.0 and OpenID Connect
- Multi-factor authentication enforced for all accounts
- Role-based access control and audit logging
CE MARKING
What does the CE marking mean?
Journalia AI Scribe is CE-marked as a Class I medical device under the EU MDR (Regulation (EU) 2017/745). This means the product meets EU requirements for safety, performance and quality for medical devices.
As a CE Class I device, Journalia is a pure documentation tool without clinical decision support. The system automates note-writing, but the treating clinician retains full responsibility for the clinical content.
PRIVACY
How does Journalia protect privacy?
Journalia is built with a strong focus on European privacy law. We comply with the GDPR and applicable health-sector information-security standards.
Transcription happens in real time, and no audio recordings are stored. Only the treating healthcare professional can access the generated note, which is deleted automatically within 48 hours by default.
We limit usage to transcription and documentation without clinical decision support.
Key safeguards
- Real-time transcription without storing audio
- Access limited to the treating healthcare professional
- Automatic deletion of all data within 48 hours
- Use scoped to documentation, not clinical decision support
RESPONSIBLE USE
How do you put responsible use into practice?
Patients should be told when an AI tool is used to support documentation during the consultation. Journalia recommends informing patients verbally and through an information poster in the waiting room.
Suggested wording
“I'm going to use a transcription tool that writes a summary of our session afterwards. That means I can update your record faster and in more detail. Everything is handled in accordance with the GDPR, and access is limited to me as your clinician. Audio is not stored, and the written summary is permanently deleted within 48 hours.”
Download patient information posters
COMPLIANCE DOCUMENTS
Transparency by default.
We are open about our security practices. Compliance documentation is shared for review on request, with no NDA.
FAQ
Frequently asked questions
No. Journalia does not store audio recordings. Audio is streamed and transcribed in real time during the consultation; the audio stream is immediately discarded and never saved on any server or device. Only the text transcript and generated note are temporarily stored, and these are permanently deleted within 48 hours.
No. Patient data is not used to train or improve AI models. This is a firm commitment. All clinical data is permanently deleted within 48 hours and is not accessed, analysed or used for any purpose beyond generating your clinical note. Our AI models are trained using separate, anonymised datasets. The prohibition is written into our data processing agreement and into the agreements with our sub-processors, not just an internal policy.
We have a documented incident response plan. For notifiable incidents we inform affected customers without undue delay and within 72 hours, as required by the GDPR. We have a named DPO as a single point of contact for both customers and supervisory authorities.
No. All processing takes place at sub-processors within the EU/EEA. We maintain a publicly available list of all sub-processors.
CE marking under the EU Medical Device Regulation (MDR) means Journalia AI Scribe has been evaluated and meets European standards for safety, quality and clinical performance as medical software. Unlike general AI tools, CE-marked medical devices are subject to rigorous requirements including clinical evaluation, risk management, quality management systems and ongoing post-market surveillance. This gives you confidence that the tool has been validated for clinical use.
Journalia AI Scribe holds CE marking as a Class I medical device under the EU MDR, and Journalia complies with the GDPR. Security is tested continuously through automated code analysis (SAST), dependency scanning and full audit logging of access and changes. Penetration testing is carried out as part of our ongoing ISO 27001 work, and we share a redacted summary on request.
Yes. We provide ready-made data-protection impact assessment (DPIA) templates tailored to using Journalia and review them together with your data protection officer. This is included in institutional and municipal packages. We also supply the documentation the assessment needs: a data flow diagram, an overview of encryption mechanisms, a transfer impact assessment (TIA) summary, and a list of sub-processors with processing region and transfer basis.
Questions about security?
Our team is happy to walk you through our security architecture, compliance certifications and data-protection measures.