Conversation redaction is the removal of personal detail from the chats a health bot records. There is no single UK statute for AI: the 2023 pro-innovation white paper left the job to existing regulators. Two rules do bite directly. UK GDPR Art. 22 restricts decisions taken solely by automated means that have a legal or similarly significant effect, and Art. 13(2)(f) requires you to tell users when that is happening. A bot built as a health IT product also needs a DCB0129 clinical risk file. anonym.plus swaps the identifiers on your device.
When this applies
Bot chats hold what users typed, often with a name, an email, or a symptom detail. Improving the bot from real conversations is a secondary use. Strip the identifying turns first, and keep a note of which turns were automated for your Art. 22 assessment.
How anonym.plus handles it
- Open the saved chat in anonym.plus on your device.
- It marks names, emails, numbers, IPs, and dates.
- Each speaker gets a steady role across the dialogue.
- Review the flags, then swap or hide them.
- Save the cleaned chat locally with no upload.
What you need to provide
- The chat (TXT, JSON, CSV, or pasted turns).
- An operator: Replace keeps the dialogue readable.
- Optional role map for [USER] and [BOT] turns.
Patient data entity types detected
| Category | anonym.plus entity type | Example |
|---|---|---|
| Names | PERSON | “I'm Marco” → [USER] |
| Contact | EMAIL_ADDRESS | marco@example.co.uk → [EMAIL] |
| Network | IP_ADDRESS | client IP → [IP] |
| Dates | DATE_TIME | “last night” → [DATE] |
| Contact | PHONE_NUMBER | +44 20 7946 0173 → [PHONE] |
| Identifiers | ID | session id → [ID] |
Compliance achieved
- Meets the DPA 2018 and the NHS Confidentiality Code of Practice expectation for secondary reuse.
- Keeps the audit trail a UK GDPR Art. 22 assessment of solely automated decisions depends on.
- Supports the transparency duty in UK GDPR Art. 13(2)(f) for automated decision-making.
- Fits the clinical risk file a health IT manufacturer keeps under DCB0129.
- Reflects that the UK has no dedicated AI statute — the 2023 pro-innovation AI white paper left enforcement to existing regulators.
- IP addresses and session identifiers are caught alongside names and contacts.
Anonymise chatbot conversation logs offline — see plans & start free →
Limitations & cautions
Free-form chat is messy, with typos and half-typed names. A bare first name can still slip by. Check the flags before export. Loose grammar gives the tool fewer cues than a formal clinical record.
Frequently asked questions
Which UK law governs a health chatbot?
No single one. The UK has not passed an AI act; the 2023 pro-innovation white paper set out principles for existing regulators to apply in their own fields. So a health bot is governed by UK GDPR and DPA 2018 for the personal data, by the MHRA regime if the software has a medical purpose, and by clinical safety standards such as DCB0129 if it is health IT.
What does UK GDPR Art. 22 mean for a triage bot?
Art. 22 restricts decisions based solely on automated processing that produce legal effects or similarly significant ones. A bot that routes a user to advice, with a clinician in the loop, is different from one that closes a case by itself. The distinction drives the safeguards you need, so keep the logs that show which path was taken.
Does the dialogue still make sense after redaction?
Yes. Steady role labels keep the user-and-bot flow clear, so the transcript reads naturally and remains usable for prompt or intent tuning.