Privacy notice and consent wording for AI in care
Published 28 September 2026 · 7 minute read · General information, not legal advice
If your staff use an AI service with anything about the people you support, those people have a right to know. This template gives you the wording: a clause for your care agreement or client information pack (or an addendum to attach to an existing one), a section for your privacy notice, a plain-English page for the people you support, and a letter to existing clients and families. It also explains where each piece goes if you already have these documents.
It is written for the most common setup in care: an AI service that removes personal details before any text is processed, used to help draft, summarise and check records. The full text is below, and as a Word file you can edit. It is general information, not legal advice.
Download the wording template
Editable .docx. Free, no sign-up.
Consent, or telling people clearly?
Many providers reach for a consent form. For care records, consent is usually the wrong legal basis. The ICO is direct about it:
“Consent will not usually be appropriate if there is a clear imbalance of power between you and the individual.”
“If you would still process the personal data on a different lawful basis even if consent were refused or withdrawn, then seeking consent from the individual is misleading and inherently unfair.”
Care providers keep records because they have to, so most rely on another basis: usually Article 6(1)(e) or 6(1)(f) of UK GDPR, with the Article 9(2)(h) condition for health and social care. What the law does require is that you tell people clearly what you do with their information. This template is written that way: it informs, and it offers a genuine choice to opt out of the AI service, without pretending consent is the legal basis. Confirm your own basis with your data protection officer or lead.
What you must tell people
The ICO’s guidance on the right to be informed says people must be told, among other things, your purposes for processing their personal data, your retention periods and who it will be shared with, and that the information must be:
“concise, transparent, intelligible, easily accessible, and it must use clear and plain language”
So the wording has to say specifically what the AI service is used for, who provides it, where it runs, how long information is kept and how to object. Vague lines such as "we may use AI" do not meet that standard. Many of the people you support are older or living with dementia, so keep the version they read short and plain; the formal detail belongs in the care agreement and privacy notice.
How to use this template
- Download the Word file and replace everything in [square brackets], including the name of the AI service and its provider.
- Confirm your lawful basis before you publish section 2, and complete a DPIA first; our DPIA template for AI in social care is pre-filled for this.
- Get a written data processing agreement from the AI service provider. If a provider cannot offer one, do not use the service with personal data.
- Add section 1 to your care agreement or client information pack, and section 2 to your privacy notice.
- Send section 4 with section 3 to existing clients and families, and keep a record of anyone who asks you not to use the service with their records.
- Pair it with an AI acceptable use policy so staff know which AI service is approved and how to use it.
Adding this to documents you already have
Most providers already have a privacy notice and a care agreement. You do not need to start again; add to what you have:
- Privacy notice: add section 2 under the part that lists who you share information with, or your processors. Update the version number and date at the top, and keep the previous version.
- Record of processing activities: add the AI service provider as a processor, with the purposes, the data involved and where it is processed.
- Care agreement or client information pack: add section 1 as a new numbered clause, or attach section 5 as an addendum if you would rather not reissue the whole agreement.
- Tell existing clients and families: send section 4 with section 3 before you start. People do not need to re-sign for you to use a processor under the legal bases above, but they must be told, and anyone who objects should be recorded and respected.
- DPIA, AI policy and training: record the service in your DPIA, list it as an approved tool in your AI policy, and brief staff before they use it.
- Keep evidence: the date the letter went out, who received it, and any objections. It is what an inspector or the ICO would ask to see.
The template
The full wording, as it appears in the Word download. Fill in the [highlighted fields]; example answers are shown in boxes.
1. Clause for your care agreement or client information pack
Use of an AI service with care records
1.1 [Organisation name] (“we”) uses [name of the AI service], a service provided by [name of the provider] (“the Processor”), to help our staff with written records. This may include drafting and rewriting documents and reports, summarising records, and reviewing visit and daily records to check they are complete and accurate.
Example answer
Caredact, a service provided by PixelArc Ventures LTD.
1.2 Before any text is processed by artificial intelligence (AI), the Processor’s system removes names and other information that could identify you and replaces it with coded labels. A member of our staff checks this before anything is sent.
1.3 The text, with identifying information removed, is then processed by an AI language model operated in the United Kingdom on the Processor’s behalf. It is not a publicly available AI service, it does not receive information that identifies you, and no information is used to train it.
1.4 The AI service does not make decisions about your care. Our staff check everything it produces, and remain responsible for your records and your care.
1.5 All processing takes place in the United Kingdom. The Processor acts only on our written instructions under a data processing agreement. The encrypted link between the coded labels and your information is permanently deleted within [30] days.
1.6 You may ask us at any time not to use this service with your records. This will not affect your care.
- [ ] I have read and understood the above.
- [ ] I would prefer this service is not used with my records.
2. Section for your privacy notice
Using an AI service with your records
What we do: Our staff use [name of the AI service] to help draft, rewrite and summarise documents and reports, and to review visit and daily records to check that they are complete and meet the standards expected of us, including those of the Care Quality Commission.
Who processes your information: [Name of the provider], acting as our data processor under a written data processing agreement. It may use your information only on our instructions and only for these purposes.
How: Names and other identifying information are removed and replaced with coded labels before any text is processed by artificial intelligence (AI). The AI language model is operated in the United Kingdom on the processor’s behalf and receives only text with identifying information removed. It is not a publicly available AI service and no information is used to train it. Our staff check everything it produces.
Lawful basis: [Confirm with your data protection officer. For care providers this is usually UK GDPR Article 6(1)(e) or 6(1)(f), with Article 9(2)(h), the provision of health or social care, rather than consent.]
Example answer
We use your information in this way to provide safe, well-recorded care under UK GDPR Article 6(1)(f) (legitimate interests) and Article 9(2)(h) (provision of health or social care).
Where: All processing takes place in the United Kingdom.
How long: The encrypted link between the coded labels and your information is permanently deleted within [30] days. Text with identifying information removed is kept for [period] and then deleted.
Your rights: You may object to this use of your information and ask us not to use the service with your records. You also have the right to access your information and to complain to the Information Commissioner’s Office (ico.org.uk). Contact [name, email, phone].
3. Plain-English page for the people you support
How we use AI to help with your records
Our staff write records about your care every day. To help them write clear, complete records and to check nothing important has been missed, we use a secure service called [name of the AI service].
How your information is protected:
- Your name and other personal details are removed before anything is processed by AI, and replaced with labels such as [PERSON_1]. A member of our staff checks this first.
- The AI never sees who you are. It is not a public AI service, and your information is never used to train AI.
- Everything stays in the United Kingdom.
- The AI does not make decisions about your care. Our staff check everything and remain responsible for your care.
- The link back to your details is locked (encrypted) and permanently deleted within [30] days.
Your choice: If you would rather we did not use this service with your records, tell us and we will not. It will not affect your care in any way. You can change your mind at any time.
Questions: Please speak to [name] on [phone number] or email [email address].
4. Letter to existing clients and families
Dear [name],
We are making a change to how our staff write and check care records, and we want you to know about it.
We will be using a secure service called [name of the AI service] to help our staff write clear records and check that nothing important has been missed. Your name and personal details are removed before anything is processed by AI, everything stays in the United Kingdom, and our staff remain responsible for your records and your care.
The enclosed page explains how it works. If you would prefer we did not use this service with your records, please let us know on [phone number] or reply to this letter. It will not affect your care in any way.
Kind regards,
[Name], [Role]
[Organisation name]
5. Addendum to an existing care agreement
Addendum to the [name of your care agreement or terms of service] dated [date of the original document]
This addendum takes effect on [date]. It adds the clause below to the agreement. Everything else in the agreement stays the same.
Use of an AI service with care records
[Paste clauses 1.1 to 1.6 from section 1 here, renumbered to follow on from the last clause of your agreement.]
Example answer
If your agreement ends at clause 14, number these 15.1 to 15.6.
We have written to you about this change. If you would prefer this service is not used with your records, please tell us on [phone number] or at [email address]. It will not affect your care.
Signed on behalf of [Organisation name]: ____________________ Date: __________
Acknowledged by the person receiving care or their representative (optional): ____________________ Date: __________
Download the wording template (Word)
Questions
Do we need consent to use AI with care records?
Usually not as the legal basis. Most care providers process care records under Article 6(1)(e) or 6(1)(f) of UK GDPR with the Article 9(2)(h) condition for health and social care. What you do need is to tell people clearly, in your privacy notice and in plain language, and to respect objections. Check your basis with your data protection officer.
Should we name the AI company in our privacy notice?
Name the service and the provider you contract with, because people have a right to know who their information is shared with. Describe the AI plainly: what it does, where it runs, and that it only receives text with identifying details removed.
What if someone says no?
Do not use the service with their records, and note the objection so staff know. Their care should not change in any way.
Does this work for any AI tool?
It is written for a service that removes personal details before any text reaches the AI, runs in the UK, and does not train on your data. If a tool does not meet those conditions, the wording will not be accurate, and you should reconsider the tool.