Privacy Notice

• Account and organisation data: name, email address, account status, membership, role, sign-in and administration events.
• Client data: client name, contact details, notes and organisation association.
• Engagement content: audio you record or upload, transcripts, speaker labels and names, summaries, Engagement Results, actions, risks, planning, follow-up information, evidence, references and incident details.
• Engagement details: reference, type, date, practitioner, consent record, review and confirmation information, document state and generated output.
• Product administration data: organisation branding, document templates, processing-job status and validation or readiness records.

Each organisation records its chosen lawful basis, privacy notice, privacy contact and objection rule. Before each recording or upload, the practitioner confirms that the organisation's recording authority, participant notice and privacy-information process was followed, and records how the notice was given and any objection outcome. This is stored as a versioned, auditable record with the engagement. It records the practitioner's confirmation; it is not proof that each participant individually consented.

The customer organisation is responsible for identifying and documenting the lawful basis that applies to each use, including any additional condition required for health or other special-category information under applicable law. The product's consent confirmation supports that process but does not replace the organisation's legal assessment or participant notice.

• Audio is divided into parts and uploaded to private processing storage. It is sent through the AI service for transcription and speaker separation. By default, source audio is deleted from active platform storage once transcription succeeds, and the deletion is verified and recorded against the engagement. An organisation may choose to retain audio for 7, 30 or 90 days, or until the engagement is deleted, with a recorded justification. If processing fails, audio is kept for up to 7 days so it can be retried, then deleted. Copies in infrastructure backups expire on the hosting provider's backup cycle.
• Transcript text is sent through the AI service to produce structured, AI-assisted Engagement Results. AI output can be reviewed, corrected, confirmed and re-analysed by authorised users.
• Accounts, organisations, clients, engagements, transcripts, Engagement Results, actions, risks, templates and administration records are stored in the managed cloud service. Access rules scope customer information to authorised members of the relevant organisation.
• Organisation logos, document templates and temporary audio files are held in private storage. Exported Word, PDF, JSON or transcript files are saved to the user's device and then fall under the user's and organisation's control.

Engagement records are subject to the product's current 30-day retention window. An authorised user can delete an individual engagement at any time, and a user can delete all engagements owned by their account from the Account & Data page. Deletion also removes associated temporary audio and processing records available to that operation.

Client registers, account and organisation records, actions, risks, audit events, templates and validation records have separate operational lifecycles and are not covered by the engagement's 30-day window. Where law or contract requires a different period, the customer organisation must agree that requirement with AxisBeam Labs before processing information. Copies already exported to a user's device are not deleted by an in-product deletion.

Engagement content is disclosed only as needed to operate the product, including to the hosting, authentication, storage and AI services listed on our subprocessors page. We do not sell engagement information or use it to train models owned by AxisBeam Labs. Provider-specific retention, training and processing-location terms are governed by the applicable provider arrangements and should be confirmed in the customer's contract before processing regulated or special-category information.

AI-generated content can be incomplete or inaccurate. The product supports human review, correction, confirmation, completeness guidance and Draft/Final controls. Authorised users remain responsible for reviewing outputs before relying on or sharing them.

Depending on the law that applies, individuals may have rights of access, correction, deletion, restriction, objection and portability. Requests should normally be made first to the customer organisation responsible for the engagement. Authorised users can review, correct, export and delete individual engagements, but the product does not currently provide an automated search and redaction workflow covering one person across every engagement.

For assistance with a privacy request, account deletion or questions about this notice, contact legal@axisbeamlabs.com.

• Consultation Kelly is not a substitute for an organisation's privacy, records-management, clinical, legal or regulatory processes.
• Configurable retention, per-person data-request tooling and pre-AI pseudonymisation are not currently available in the product.
• Review the current security practices and subprocessor information before using the product for regulated or special-category information.