What happens to the audio from a consult?

Audio is deleted by default. On Free, Small Mercy’s copy is deleted when the first draft arrives, with no listen-back. On paid plans, it is kept encrypted while you review and deleted on confirmation by default; a practice can instead set immediate deletion after processing, or a short fixed retention window, and a hard 7-day ceiling applies in every mode. Paid listen-back exists to help you check flagged moments before confirmation. Free flags lines to re-read instead.

The audio’s whole life

1. Consent. Recording starts only after consent is confirmed in the product, and Small Mercy asks again when someone new can hear the conversation.
2. Recorded. Capture starts only in a consented session. Where the audio goes first depends on your profile: on AU Sovereign capture reaches Small Mercy’s private Australian cloud in Sydney; on the UK Sovereign region, into Small Mercy’s private United Kingdom cloud in London; on Global, audio and transcripts are processed by vetted global providers under your organisation’s consent.
3. Encrypted. Small Mercy-held audio is AES-256-encrypted. Free processes it after capture stops; paid plans can show a live transcript and retain audio for listen-back during review.
4. Deleted. Free deletes Small Mercy-held audio when the first draft arrives. Paid deletes it on confirmation by default; on a fixed-window practice policy, at that deadline, within 7 days at most.
5. Receipt. A QR deletion receipt — login-free, PHI-free — flips to “Verified” when that deletion has actually happened, and the patient can re-scan it any time.

Where audio is processed depends on your organisation’s region. Your clinical record is stored in Australia (Sydney) on the AU Sovereign and Global profiles — the UK Sovereign region stores in the United Kingdom — and processing follows the profile your organisation chose at sign-up — see where data is stored and processed.

What the receipt does and doesn’t evidence

It evidences Small Mercy-held audio. The receipt is checked against the running system, so “Verified” means Small Mercy’s own copy is gone rather than that a policy says it should be.

It does not yet evidence a provider’s copy. That matters on the Global profile and on UK Sovereign, whose transcription and drafting providers process in the UK or EU — see where data is stored and processed. Small Mercy does not yet collect independent deletion or purge proof from those providers, so the receipt does not speak for them. We’d rather draw that line than let a green tick imply more than we can show. It is on the roadmap, and this page will say so plainly when it lands.

On AU Sovereign, audio is transcribed and the note drafted on vetted Australian services, over private links and under no-training terms. Small Mercy does not yet collect independent deletion proof from these providers — the same honest limitation noted for Global above — and audio held by Small Mercy itself follows the deletion timeline above.

If a draft is never confirmed

Any Small Mercy-held audio still awaiting its deletion trigger is removed by an automatic sweep within 7 days — a hard ceiling enforced by the system, not a setting someone can forget. An interrupted afternoon doesn’t leave audio sitting anywhere indefinitely.

What is kept

The written record is what remains: the note, and any letters or tasks you confirmed. Your clinical record is stored in Small Mercy’s Australian cloud (Sydney) on the AU Sovereign and Global profiles — in the United Kingdom (London) on the UK Sovereign region — encrypted at rest with AES-256, and kept while your account is active. Nothing reaches that record without you — every draft requires your explicit review and confirmation before it is saved or exported, because Small Mercy is a documentation aid, not a diagnostic device.

You remain responsible for your own record-keeping obligations, so export anything you must keep before deleting an account. Small Mercy doesn’t yet hold formal certifications — they’re on the roadmap, and we’d rather say that plainly than imply otherwise.

The full lifecycle, including the live checks a patient can watch in the room, is on privacy by design. The retention rules are also set out in the privacy notice for your region.

Next: what the deletion receipt is.