Millions of people in the UK ask their smart speaker a health question every single day. “Alexa, what are the symptoms of a blood clot?” “Hey Siri, is it normal to feel dizzy when you stand up?” It feels casual, private even, like muttering to yourself. It is not. The moment those words leave your mouth, they enter a data pipeline that most users have never thought about, and UK law, for all its apparent rigour around health information, has significant blind spots here.
I want to be specific about what is actually happening, because the public conversation around voice assistant health data UK tends to land in one of two useless places: either breezy reassurance that “companies are regulated” or apocalyptic claims that Amazon is selling your cough to your insurer. The truth is more complicated and more instructive than either.
Who actually holds the data from your health queries
When you ask Amazon Echo, Apple HomePod, or Google Nest a health-related question, at minimum three things happen. The audio is recorded. It is transmitted to a remote server for processing. A response is generated and returned. The question is how long that audio and the derived text transcript are retained, who has access to them, and under what legal basis the company is processing what the ICO classifies as special category data, which health information explicitly is under UK GDPR.
Amazon’s privacy settings allow users to delete voice history manually or set automatic deletion after three or 18 months, but the default is indefinite retention unless you change it. Apple takes a different approach: Siri queries are anonymised with a random identifier rather than your Apple ID, and audio is not retained by default unless you opt in to help improve Siri. Google sits somewhere between the two. The key word in all of this is “default”. Most people never touch privacy settings, which means most people are operating under the most data-permissive option without realising it.
What UK GDPR and the ICO actually require
UK GDPR requires a lawful basis for processing personal data, and a stricter “explicit consent” basis for special category data like health information. The problem is definitional. Voice assistant providers generally argue they are processing the literal audio file, not a health record. Whether a transcribed query asking about chest pain constitutes “health data” under the regulation is genuinely contested, and the ICO has not issued clear guidance specific to voice-captured health queries.
Ofcom’s role here is more limited than many people assume. Ofcom regulates online safety and communications networks, but it is not the primary regulator for data protection, that is the ICO’s territory. The Online Safety Act 2023 introduced duties around harmful content and age verification, but it does not create specific obligations about the clinical accuracy of health information returned by a voice assistant. There is a gap. A GP is regulated by the GMC. A pharmacist is regulated by the General Pharmaceutical Council. An algorithm that tells you to “drink plenty of fluids” when you describe symptoms of sepsis answers to nobody in particular.
Is the health information voice assistants give you actually safe?
This is the question I find most concerning, and it receives the least attention. A 2019 study published in npj Digital Medicine tested nine voice assistants on 56 common health questions and found that fewer than half gave complete, accurate responses. The technology has improved since then, but the fundamental issue remains: none of these systems are classified as medical devices under MHRA regulations, so they are not required to demonstrate clinical safety before being deployed at scale.
The MHRA has been working to clarify how AI-powered tools that offer health information are classified, and their updated framework for AI as a medical device is worth following. But voice assistants that provide general health information have so far stayed out of that classification by positioning their responses as signposting rather than diagnosis. “I’m not a doctor, but…” followed by a confident-sounding answer is a legal and regulatory comfort blanket, not a clinical safety guarantee.
The impulse to broadcast health guidance to the masses at speed is not new, of course. Before digital infrastructure existed, communities relied on entirely different systems to get important information out quickly. If you want some historical context on how public information transmission has always involved trade-offs between reach and accuracy, there is a longer read on the town crier and the bellman: how england broadcast its news before the printed word, the parallels with today’s algorithmic information delivery are more interesting than they first appear.
What happens when your health query connects to NHS services
Amazon has NHS-integrated features on Alexa in the UK, allowing users to access certain NHS 111 information and book GP appointments in some areas. This sounds useful, and some of it genuinely is. But the data implications become more layered when a commercial platform connects to NHS infrastructure. The data you share with Amazon does not automatically become subject to NHS data governance standards simply because the response draws on NHS content. Your query sits on Amazon’s servers under Amazon’s retention policy. The NHS branding on the answer can create a false impression of clinical accountability.
I’d argue this is the most important thing for UK users to understand: the source of the answer and the custodian of the data can be entirely different entities, each operating under different legal frameworks. If you are concerned about how your health information is handled more broadly, including by apps rather than speakers, the overlap with what UK law says about health app data privacy and what it fails to prevent is direct and worth reading alongside this.
What you can actually do about it
The practical steps are more straightforward than the legal landscape. In your Alexa app, go to Settings, then Alexa Privacy, and set voice history to auto-delete after three months at most. On Apple devices, go to Settings, Siri and Search, and review what you have enabled. On Google Home, the My Activity dashboard lets you delete and restrict retention. None of this is hidden, it is just never surfaced proactively.
For anything beyond general health curiosity, do not rely on a voice assistant. The NHS 111 online tool and the 111 phone service exist for a reason. If you have been exploring your own symptoms in more depth and suspect something like insulin resistance or metabolic health concerns that have never been formally assessed, a GP appointment or a structured NHS health check is where to start, not a smart speaker.
Voice assistants are genuinely useful for setting timers and checking the weather. They are an unregulated, legally ambiguous, clinically unverified source of health information. Knowing the difference, and adjusting your settings accordingly, is the only practical response to a regulatory framework that has not yet caught up with the technology in your kitchen.
Frequently Asked Questions
Does asking Alexa or Siri about my health count as sharing medical data under UK law?
Health information is classed as special category data under UK GDPR, and a voice query describing symptoms likely qualifies. However, voice assistant providers typically argue they are processing audio files rather than health records, and the ICO has not issued specific guidance on this distinction, leaving the legal position genuinely unclear.
How long does Amazon keep my Alexa health questions?
By default, Amazon retains voice recordings indefinitely unless you change your settings. You can set automatic deletion after three or 18 months via the Alexa app under Settings, then Alexa Privacy. Most users are unaware the default is retention, not deletion.
Is the health information given by smart speakers regulated in the UK?
No. Voice assistants providing general health information are not currently classified as medical devices by the MHRA, so they are not required to demonstrate clinical accuracy or safety. Ofcom oversees communications networks but does not regulate the clinical quality of health responses from these platforms.
When Alexa gives me NHS information, is it covered by NHS data rules?
No. Even when Alexa draws on NHS content to answer your question, your query and the recorded audio remain stored on Amazon’s servers under Amazon’s own privacy policy and retention settings. NHS data governance standards apply to NHS systems, not to third-party commercial platforms that access NHS information.