Research Ethics

If you transcribe research interviews with RiverScript, your ethics committee, institutional review board (IRB), or data protection officer will usually ask the same questions about the service. This page answers them briefly and links to the documents that contain our binding commitments. If anything here differs from our Privacy Policy or Data Processing Terms, those documents prevail.

Who provides the service

RiverScript is operated by Lex Valo (Business ID: 3617726-2), a business registered in Finland, in the European Union. You can reach us at [email protected].

Our role under GDPR

For the recordings and transcripts you process, you or your institution are the controller, and RiverScript is your processor. Our Data Processing Terms apply automatically to professional use, with nothing to sign. If your institution needs a signed copy, email us.

Where the data is stored and processed

Our database, which holds your transcripts, is hosted in the European Union (Helsinki, Finland). Audio files are held only temporarily by our storage provider.

Transcription and AI features are performed by subprocessors, some of which are located in the United States. These transfers take place under Standard Contractual Clauses or the EU-US Data Privacy Framework. The full list is on the Subprocessors page.

Is the data used to train AI models?

No. We do not use your audio, transcripts, or any output derived from them to train or fine-tune AI models. This is a binding commitment in our Data Processing Terms.

How long data is kept and how it is deleted

• Audio and video files are deleted automatically 7 days after upload.
• Transcripts, translations, summaries, and AI outputs stay in your account until you delete them.
• Deleting a transcript deletes it together with its audio and everything derived from it.
• Deleting your account deletes all of your data.
• Deleted data leaves our backups within the period stated in our Privacy Policy.

If your protocol requires a person to check each automatic transcript against the recording, plan that check within the 7 days, while the audio is still available.

Who can access the data

Only your account, and anyone you give access to yourself by creating a share link or an API key. We do not read or listen to your content, except in the narrow cases set out in our Privacy Policy. All communication with RiverScript is encrypted over HTTPS/TLS. More on the Security page.

How recording and transcription work

You record on your own device, in the Desktop client or in the browser, or you upload an existing file. To be transcribed, the recording is sent to RiverScript: transcription does not happen on your device.

Informing participants and obtaining their consent to being recorded is part of your study design. See Recording Responsibly.

Certifications and special requirements

If your institution needs additional certifications, a completed security questionnaire, or anything else, write to us and we will consider it.

At present we do not provide ISO 27001 or SOC 2 reports, and RiverScript is not intended for protected health information under HIPAA. If your recordings contain special categories of personal data, such as health data, you need your own basis for processing it under Article 9 GDPR. Part of the processing takes place in the United States, as described above.

Text you can adapt for your application

Ethics committees look for specific statements they can verify rather than general assurances. You can adapt the wording below to your institution's templates.

For the research protocol or data management plan:

Interview recordings will be transcribed with RiverScript, an automated transcription service operated by Lex Valo, a business registered in Finland (EU), which acts as a data processor under Article 28 GDPR. Transcripts are stored in RiverScript's database in the EU. Some processing is carried out by subprocessors located in the United States under Standard Contractual Clauses or the EU-US Data Privacy Framework, as listed in RiverScript's published subprocessor list. RiverScript does not use uploaded recordings or transcripts to train or fine-tune AI models. Audio files are deleted automatically 7 days after upload. Transcripts are kept only for as long as the study requires, and deleting a transcript also deletes its audio and all output derived from it. A member of the research team will check each transcript against its recording within those 7 days.

For the participant information sheet:

Your interview will be recorded and transcribed using RiverScript, an automated transcription service provided by a company based in Finland, in the EU. The service deletes the recording 7 days after it is uploaded. The written transcript is kept only as long as the research team needs it for this study. RiverScript does not use your recording to train artificial intelligence. Some processing may take place in the United States, under safeguards recognised by the European Commission.

Contact

For questions, a signed copy of the Data Processing Terms, or help with a security questionnaire, write to [email protected].