Sending Research Audio to an AI Transcription Service: The Ethics Questions

Why the tool choice is an ethics question

When a researcher typed transcripts by hand, the recording stayed on the researcher's own equipment. Professional transcribers changed that, and ethics boards developed expectations about confidentiality agreements. AI transcription services raise similar questions in a new form: the audio is sent to servers operated by a company, processed by software, and possibly retained, logged or used in ways the participant never imagined.

The questions are not only about data security. They include whether participants were told and agreed, whether the processing matches what your approval describes, whether the tool's errors could misrepresent participants, and whether the convenience justifies any added risk. These are judgments for you and your ethics board, informed by your institution's policies and the data protection law that applies to you, which varies by country. This article lays out the questions; it does not answer them for your study.

What a review board may ask

Ethics committees and institutional review boards differ, but questions like these come up often when a protocol mentions automatic transcription:

• Which service will be used, and who operates it?
• What exactly is sent: the full recording, the audio only, or segments?
• Where is the data processed and stored, and in which country or countries?
• How long does the service keep uploaded audio and the resulting text?
• Is any data used to train or improve the provider's models?
• Who at the provider can access the data, and under what conditions?
• Is the connection protected in transit, and how?
• Does the provider act under an agreement with your institution, or under its standard terms?
• What did participants agree to, and does this processing fall within it?
• How will transcript accuracy be checked before analysis?

Prepare answers before you submit. Vague statements such as "a secure AI service" tend to bring the application back with questions.

Consent wording about third-party processing

Participants should understand, in plain language, that their recording may be processed by an external service. Your ethics board may have template wording; use it if so. If you are drafting your own, it usually helps to cover:

• That recordings will be transcribed using automatic software operated by an external company.
• What is sent (for example, the audio only), and that it is sent over a protected connection.
• How long the company keeps the audio and text, if known.
• That the researcher will check and correct the transcript.
• Whether the recording itself is kept afterwards, and for how long.

An illustrative sentence, to adapt with your ethics board: "Your interview audio will be transcribed by automatic speech recognition software run by an external provider. The provider deletes the audio and the transcript shortly after processing. A member of the research team will check the transcript against the recording." Do not copy this as is; the details must match the service you actually use and what your institution requires.

If your study is already approved and consent forms did not mention third-party transcription, do not assume it is covered. Ask your ethics board whether an amendment or re-consent is needed.

Mapping the data flow

A simple data-flow map makes risks visible and gives the review board something concrete to assess. Draw or list every place the data goes, from recorder to archive:

1. Capture: recorder or phone, and where its files are stored.
2. Transfer to your computer or institutional storage.
3. Preparation: any editing, trimming or conversion before upload.
4. Upload: what leaves your device, to whom, over what kind of connection.
5. Processing: what the service does, which components handle the data.
6. Return: what comes back, and where you save it.
7. Retention at the provider: how long each part is kept.
8. Your copies: working transcripts, analysis files, backups, and when each is deleted.

For each step, note who can access the data and whether it is identifiable. Gaps in the map, such as "unknown" for where processing happens, are exactly what you should resolve with the provider or your institution before proceeding.

Risk assessment

Risk depends on your data and participants, not just the tool. A recording of professionals discussing workplace software carries different risks from a recording of undocumented migrants describing their journeys. Consider:

• Sensitivity of content: health, sexuality, criminal activity, immigration status, political views or abuse raise the stakes considerably.
• Identifiability: whether voices, names, places or stories could identify people.
• Vulnerability: children, people in care, people at risk of reprisal.
• Consequences of a breach for participants.
• Consequences of transcription errors: a misheard negation in a quote can attribute the opposite view to someone. The article on Whisper-style hallucinations describes how recognition models can produce text nobody said.
• Alternatives: transcribing yourself, an institutionally contracted transcriber, or software that runs entirely on your own computer.

Some projects reduce risk by trimming the consent preamble or identifying introductions from the file before upload, using pseudonyms during the interview itself, or transcribing only the least sensitive recordings automatically and the rest by hand. The comparison of AI and human transcription sets out other trade-offs, including confidentiality.

Documenting the tool

Methods sections and audit trails increasingly record transcription tools with the same care as analysis software. Record:

• The service name, and the speech recognition model if the provider states it.
• The date or period of use, since services change.
• Settings used, such as language selection.
• What was uploaded, and any pre-processing.
• How transcripts were checked: who listened, how much of each recording, what was corrected.
• Known limitations, such as no speaker labels or a tendency to drop fillers.

A sentence in the methods section might read: "Recordings were transcribed automatically using [service], then checked in full against the audio and corrected by the interviewer, who also added speaker labels and anonymized identifying details." Your audit trail can hold the detail. The article on managing research recordings covers where those records fit in a data management plan.

Risks of getting it wrong

• Uploading before approval, then discovering the consent form did not cover it.
• Relying on a provider's marketing summary instead of its privacy policy and terms.
• Treating automatic transcripts as accurate without checking, so errors enter quotes and findings.
• Using a personal account on a service your institution has not assessed.
• Forgetting copies: results emailed to yourself, downloaded files left in a shared folder.
• Assuming that because a tool is popular, it must be acceptable for sensitive research.

Facts about mydubly for your ethics application

If you are considering mydubly, these are its data-handling facts, stated without any claim that it satisfies a particular regulation, ethics standard or institutional policy. Only your ethics board and institution can decide that.

What stays on your device

The video picture of video files; the browser decodes audio locally

What is uploaded

Audio only, downmixed to mono, cut into chunks of roughly 30 seconds and compressed, sent over HTTPS

Speech recognition

Whisper large-v3-turbo in the default deployment (a deployment can use OpenAI's whisper-1 instead)

Translation, if requested

A translation engine configured in the deployment

Retention

Uploaded audio chunks and results deleted within 30 minutes of a job finishing; unfinished jobs expire after 24 hours

Training

The privacy policy states user data is not used for training

Outputs

Plain and timestamped transcripts, SRT and VTT files, downloaded to your device

Not provided

Speaker labels, storage of your files, any institutional agreement or certification

Questions this table does not answer, such as where servers are located or which sub-processors are involved, should be put to the provider and checked against the current privacy policy before you submit. The private video translation page explains the processing model, and the article on cloud speech processing privacy lists questions worth asking any provider. Transcription costs one credit per minute, minimum five credits.

Next step

Draft your data-flow map and the answers to the review board questions above for the specific service you want to use, then take them to your supervisor and ethics office before any participant audio is uploaded. If approval is granted, keep the documentation with your project records and follow the step-by-step guide to transcribing audio on a non-sensitive test recording first, so you know exactly what the tool produces.