[JohnFen]

As a patient, this is an application that I would be extremely wary of, personally. I don't want the details of my conversations with my doctor to be sent to a third party in the first place, and I wouldn't trust the results of the transcription to be correct.

My doctor could vet it for accuracy, I suppose, but why? He's already putting his notes in my records anyway.

[1123581321]

Most people doing a video meeting with their doctor are already trusting their information to third parties in some way. I understand that you probably are in a different situation. Perhaps services like these are on the path to your more privacy-oriented doctor having a tool that helps them and is comfortable for knowledgeable patients.

[JohnFen]

Yes, if you're doing telehealth, you're already taking a risk in terms of privacy. But the service provider doesn't need to actually pay attention to what you and your doctor are talking about to provide the service.

This is different, in that this service requires that a third party pay attention to the content of your discussion in order to work. That's significantly more intrusive.

[l5t]

It takes 40% of your doctor time to put his notes in your medical records. We have been testing with doctors to reduce this time drastically so that they can spend more quality time with you. We also interviewed a lot of patients who take notes to be able to remember what’s been discussed during a consultation. So it could also benefit the patient

[Veen]

Your response completely ignores the concerns raised in the comment you are replying to. "It saves your doctor 40% of their time" is not a reasonable response to "I don't want my private medical details divulged to a third party".

[jeroenhd]

Perhaps avoiding commenting on patient privacy concerns may be a better answer than any evasive answer may ever be.

Their website's privacy policy doesn't say anything about their product. It's also incorrect (they seem to have switched tracking providers without updating their privacy policy). I would quote the sections that are incorrect, but their terms and conditions forbid copying any content from their site. Their T&C also forbids me from linking to their page or terms.

I very much doubt that using this product as advertised is even legal under the GDPR. The company is French and health data, even pseudonymized, is strictly regulated. The "demo" doesn't feature any explicit consent at the very least.

It looks like they're making all privacy risks and concerns the doctors' problems. After all, they're the ones violating the law when they use this product.

[avgDev]

At least in US this company would responsible for violating the law. Not only the physician.

I honestly have no idea how these products are even developed. Does nobody think about any laws at all? This is something I really hate about the current state of "hustle" development.

[l5t]

Thanks for looking into our legal documents. The ones related to the Nabla Copilot product are different from the website T&C and privacy policy, and can be found here: https://www.nabla.com/legal-documents/

Our product is GDPR compliant.

[sebastiennight]

I read the French legal documents and your notices regarding GDPR.

What I don't understand from those, and statements made by your team in this thread, is how some claims can be compatible.

- That the product is GDPR compliant.

- That you don't store the PII or health data.

- Yet all data is stored at Google servers.

- Also, you reserve the right to re-use said data. (Which, since this is for R&D purposes, should probably qualify you for the need to ask the CNIL for an authorization as "health data repository"? [0])

- That none of the data is sent outside the EU or to additional 3rd parties.

- Yet it uses a fine-tuned "GPT-3" (a term that to the best of my knowledge exclusively refers to Microsoft/OpenAI's US-based API service, not to on-prem GPT-like LLMs like GPT-J or GPT-NeoX).

All in all, I can feel the enthusiasm but it does feel like this thread would have been so much more reassuring with some proactive comments about the privacy/health data issues, rather than have everyone voice the obvious concern with no prepared answers.

[0] https://www.cnil.fr/fr/la-cnil-adopte-un-referentiel-sur-les...

[l5t]

You're absolutely right, we should have been much more upfront with the privacy/security aspect of the product and add this link to the post: https://www.nabla.com/blog/privacy-security/

I hope this link will clarify our position.

Here are additional answers related to your points. - We do use Google Cloud to host our backend in EU or in the US but also the data for the Care Platform product. For the Copilot product, we don't host any data. They are hosted locally on the practitioner browser. - Our T&C reserves the right to re-use data in the event we will store the data in future versions of Nabla Copilot. In any case, the reuse of data, even health data, is allowed by GDPR for the improvement of the service provided if the data controller (practitioner) authorizes us and if they have informed the patient. - We did not say that "none of the data is sent outside the EU". Actually we say the opposite in the Copilot APD Annexe 1. We specifically mention Google and OpenAI and we comply with GDPR with a data protection agreement with both these companies.

[burntcookie90]

> that they can spend more quality time with you

Maybe its just the doc offices i've been to, but i think this would actually just increase the patient churn in a hospital. There's no way a doc is going to increase their patient time by the 40% saved if the hospital can toss them in front of another patient.

[anhner]

It's definetly not just you... Tho that may still be a plus considering the shortage of doctors in a lot of countries. But the privacy concerns still remain.

[JohnFen]

I can absolutely see the benefits of this, that's not the question. The question is whether or not the benefit justifies the risk.

[mannyv]

Many practices today have a transcriber with every doc, and that person is their personal scribe. You trust them, right?

In any case HIPAA will protect you. Your provider will have a business associate contract with them, so they're subject to huge fines if they violate that.

This is a demo. In real life this'll be wrapped with a whole lot of legal contracts.

[c0m]

I trust a scribe because they are a person with years of specialised training and experience who can be held accountable.

> in any case, HIPAA will protect you

It protects you insofar as it disincentives honest actors from doing sketchy things with your data. It's punishment for orgs, not protection for patients, like how laws against murder punishes the murderer rather than protecting the victim.

The best thing a patient can do to protect their privacy is to be actively avoid of medical practitioners that, for example, use tools like this which send your private medical consultation transcripts to God-knows-where.

[manv1]

"I trust a scribe because they are a person with years of specialised training and experience who can be held accountable."

They can be held accountable, but it's unclear how much specialized training or experience they actually have. They could have had a 6-month course, an online course, etc.

And of course you're assuming their EMR is actually secure. In a small office you can usually find the passwords you need stuck to the monitor or under the keyboard.

[SkyPuncher]

> I don't want the details of my conversations with my doctor to be sent to a third party in the first place

Then you simply cannot use modern healthcare. Unless you're doctor is cash-pay, off the cuff, they're _legally_ using third-parties to perform their services.

----

If your doctor/healthcare provider is a covered entity, they're bound by HIPAA. That means they're free to establish relationships with Business Associates that are part of delivering healthcare. Those Business Associates must also be HIPAA compliant.