What gets sent, and what doesn't
The AI tools are the main route by which clinical content leaves your device, so this page is deliberately precise rather than reassuring. If you are assessing MedJot for an organisation, read this alongside Data flows.
Nothing is sent until you run a tool
Autosave writes to the device only. Opening MedJot, building a report and exporting it involve no transmission of clinical content at all. The transmission happens when you press the button on an AI tool, and only then.
What is sent
A summary built from your structured findings — the findings you tapped, the scores you completed, the observation sets you recorded, the ingestions you logged, and the free text you typed in the relevant sections.
The request is assembled from MedJot's internal state, not from the report text in the preview panel. This is a meaningful distinction: it means the content sent is a known, enumerable set of fields rather than whatever happens to be on screen.
Observation sets are sent under their own separate structure, and every set is included — the include-in-report toggle governs the ePRF only.
What is stripped before sending
Automated redaction runs on both the device and the server before anything reaches the model. It removes:
- Names introduced by a relationship word ("her son Michael")
- NHS numbers
- Phone numbers
- Postcodes
- Other structured identifiers
The patient is referred to only as "Pt", never by a constructed name.
Redaction is a safety net, not a guarantee. It is a best-effort heuristic against patterns it recognises. It cannot reliably catch a name written into free text with no surrounding cue. This is why the standing instruction is to keep patient-identifiable information out of MedJot in the first place — initials, ages and de-identified descriptions.
The safeguarding tool applies the strictest handling and never outputs a full name.
What is not sent, ever
- Your notepad — it is not part of the report and reaches nothing
- Your saved templates
- Your patient's identity, insofar as the guidance above is followed
- The overdose calculator's threshold comparison — that stays on screen
- Anything from a report other than the one you are working on
What is kept afterwards
| Kept | Not kept |
|---|---|
| Which feature you ran | The text you sent |
| Token counts and cost | The response you got back |
| When it ran, against your account |
The usage log exists for billing and abuse prevention. It contains no clinical content because none is written to it.
Where it goes
To Google Gemini, via MedJot's server. The server checks your entitlement, applies redaction a second time, and forwards the request. Google may process it outside the UK and EEA under their own data protection commitments — see Subprocessors.
Queued requests
If a request fails for lack of signal and you choose to queue it, the payload is stored on your device, already redacted — so a queued job holds nothing the network would not have seen. No credential is stored with it; a fresh token is minted when it actually runs, and if a different user has signed in by then the job is discarded rather than run. See Queued AI requests.
The one-line version
Running an AI tool sends a redacted summary of your structured findings to Google Gemini. The content is not stored by us. Everything else about the report stays on the device.