Key takeaways
- Health data is special-category data under GDPR Article 9.
- On-prem gives you the most control; EU cloud is quicker to start.
- Diarisation and redaction matter as much as raw accuracy, and accuracy must be measured on your own recordings.
- Keep a human review step before notes enter the record.
What changes in healthcare
On-premises speech-to-text gives your clinic control over infrastructure and operations. EU cloud reduces the infrastructure you run, but adds a processor relationship and vendor checks. Choose using your data rules, audio volume, peak load and operating capacity. Both options need clinical accuracy tests, security controls and human review.
It also changes the vendor relationship. The provider is normally your processor, so you need an Article 28 agreement, a security review under Article 32 and, for most clinics beyond a single practitioner, a data protection impact assessment. Our guide to medical speech-to-text and the GDPR covers those duties. This article is about the engineering choice that sits on top of them.
Decision table
| Factor | On-prem | EU cloud |
|---|---|---|
| Data control | Highest | High, under DPA |
| Time to start | Weeks | Days |
| Upfront cost | Hardware / GPU | Low |
| Running cost | Hardware, power and staff time, roughly fixed | Usage-based, grows with audio volume |
| Scaling | Plan capacity | Elastic |
| Operations | You patch, monitor and upgrade | Provider operates it. You manage the contract |
| Network | Can run inside the hospital network | Needs a reliable connection to the provider |
How to test accuracy for your clinic
Vendor benchmarks are measured on other people's audio. What matters is how the system performs on your consultations, with your accents, your rooms and your terminology. Build a small test set from representative recordings, anonymised or used with the right permissions, and have a clinician correct the transcripts.
- Word error rate overall, and separately for drug names, doses, numbers and anatomical terms, where a single mistake matters most.
- Speaker separation: does the transcript tell clinician and patient apart reliably, including when they talk over each other?
- Languages and accents your patients actually use, including code-switching.
- Noise: waiting rooms, masks, fans and a phone on the desk.
- Formatting: punctuation, units and whether spoken numbers become digits.
Latency: live dictation or batch after the visit?
| Use | What it needs | Usual choice |
|---|---|---|
| Live captions or dictation while the clinician talks | Low-latency streaming and spare capacity at peak hours | On-prem GPU or a cloud region close to the clinic |
| A note drafted at the end of the consultation | Fast turnaround, not instant | Either, depending on volume |
| Batch transcription of recorded calls | Throughput and low cost per hour | Cloud, or scheduled on-prem jobs |
How to think about cost
Cloud is paid by the minute of audio, so the bill follows usage. On-prem is paid up front for hardware and then in power, maintenance and staff time, so the bill is mostly fixed. Which is cheaper depends on how many hours of audio you transcribe and how busy the hardware would be. Ask for both quotes with the same assumptions, include the time your own team spends on security and updates, and look at a year or more, not the first month.
Hybrid patterns that reduce risk
- Start in an EU cloud environment, with the pipeline built to be portable, and move inside your own network when volume or policy requires it.
- Transcribe on-prem, redact personal details, then use a cloud language model only on the redacted text for summaries.
- Keep audio on-prem for a short retention window and send only the text onward.
Keep a human in the loop either way. A clinician should review and sign every note before it enters the record, because a wrongly heard drug name is a patient-safety issue and not only a data-quality one.
How to choose
- Decide your data rules first: where audio may be processed and how long it may be kept.
- Estimate hours of audio per month and your peak load.
- Test two or three options on your own recordings.
- Compare a year of cost, including your own staff time.
- Check what happens to the audio and transcripts if you leave the vendor.
- Pick the option that meets the data rules at the lowest total effort, and keep the design portable.
Send us your monthly audio volume, peak usage and data-location requirements. We can compare on-premises and EU cloud transcription for your clinic.
Compare transcription deploymentsFAQ
Do patients need to consent to recording?
You need a lawful basis, and patients must be told. Many providers pair a clear notice with an opt-out.
Is an EU cloud enough for GDPR?
It can be, with a processor agreement, a security review and settings that exclude training on your data. For the most sensitive work or for public bodies, on-prem or a self-hosted environment gives more control.
Can we start in the cloud and move on-prem later?
Yes, if the pipeline is built to be portable from the start, with the same models, formats and workflow in both places.
Sources
- Regulation (EU) 2016/679 (GDPR), Articles 9, 28, 32 and 35
- Article 29 Working Party, Guidelines on Data Protection Impact Assessment (WP248 rev.01)
- ESADEX VitalGen case study
About the author
Artem Synytskyi · Co-founder · AI
Artem runs AI at ESADEX, building LLM, RAG and speech-to-text systems for regulated environments.
