Alexa, what is hidden behind your contract with the NHS?

Following a series of FOI requests from Privacy International and other organisations, the Department of Health and Social Care has now released its contract with Amazon, regarding the use of NHS content by Alexa, Amazon’s virtual assistant. The content of the contract is to a big extent redacted, and we contest the Department of Health’s take on the notion of public interest.

Remember when in July this year the UK government announced a partnership with Amazon so that people would now be able to have their medical questions answered by Alexa? The government hoped the move would reduce pressure on the NHS, as people would turn to Alexa instead of calling the hotline.

At the time, we had called for more transparency and demanded that the Department of Health and Social Care tell the public what the true nature of the partnership was. The NHS had published a piece mentioning their “close partnership with Amazon” but no detail of the precise nature of said partnership was ever given.

This is why we decided to submit a request, under Freedom of Information laws, to the Department of Health asking them about their contract with Amazon. We also requested all email communications with Amazon pertaining to this collaboration.

On October 16th, following Privacy International’s FOI request, the Department of Health published their contract with Amazon. The contract is now available here. This report will walk you through what we found… and did not find in this contract.

So... What is in the contract?

The contract is divided into two sections. The first section is a general contract with Amazon – the Master Content License Agreement – which describes the general terms of the relationship between Amazon and the Secretary of State for Health and Social Care (how payments will be processed, how and where taxes will be paid, etc…).

This first section specifies that the nature of the work to be executed by each party will be defined in “Statements of Work.” It also states that there may be more statements of work in the future than the one published now.

Thus, the second section is Statement of Work #1. It is in this section that the agreement regarding the use of NHS content on Alexa devices is specifically laid out.

In terms of the content, it is worth noticing that various sections of the contract are redacted. In the “Term; Termination and Survival” (first section) we find the first redacted information, which include the length of the notice period requested to terminate the contract. But most of the redactions are in the Statement of Work #1. The sub-section “Additional Terms and Conditions” has three entire paragraphs redacted.

The lines describing the consequences for Amazon if they were to fail to meet the terms of the agreement have been redacted. This accordingly raises questions as to whether a company recently surrounded by “privacy concerns about its use of manual human reviews of Alexa AI voice assistant recordings” could have been granted any potentially “privileged” status under the agreement. And, if not, why would this have to be hidden from the public?

The sub-section “Licensor API” also has an entire paragraph redacted. We will explain later on the particular relevance of this sub-section.

Amazon’s commercial interest vs the public Interest

When they replied to our FOI request, the Department of Health made sure to explain to us why so much of the contract was redacted.

In this case, we consider that the release of the redacted clauses would be likely to prejudice the commercial interests of Amazon on the basis that it would make public the non-standard terms that Amazon has been willing to enter into in respect of this agreement. We consider that this would harm Amazon’s negotiating position [emphasis added] when entering into agreements with other parties in the future, which in turn would be likely to prejudice their commercial interests. [emphasis added]

Additionally, disclosure of the redacted clauses is likely to prejudice existing agreements between Amazon and other parties, which could result in other parties challenging Amazon over the terms and conditions of their agreements. […] In the case of this agreement, there is a general public interest in protecting the commercially sensitive information from disclosure. We consider that disclosure would be likely to cause third parties to be reluctant to enter into agreements with public authorities if they knew that commercially sensitive information contained within agreements could be disclosed and therefore prejudice their commercial position.

The public interest in the disclosure of the agreement with Amazon is largely focussed on the issue of sharing personal data. The redacted clauses in the agreement cover unrelated commercial issues and therefore do not advance the public understanding of the issue of sharing personal data.

Although there is public interest in understanding the arrangements between the DHSC and Amazon, we determine that this will have been achieved by the unredacted information about the agreement that has been published, because of the reasons set out above.

In other words, Amazon’s commercial interest is superseding public interest. The Department of Health rightly points to the public interest in understanding the arrangement between them and Amazon. We hope we will be able to convince them that when they enter an agreement with one of the largest tech companies, the public should have the right to expect complete transparency, not a heavily redacted contract that leaves us wondering how much time the Department of Health can possibly be requested to give to terminate the contract, or why it was deemed necessary to redact it.

Beyond the black bars, what does the contract say?

When the NHS launched the partnership, they spoke of “a mutually beneficial partnership.” What seems to be now clear from the Statement of Work #1 is that this partnership was not a financial one. Amazon did not pay the NHS for access to its content. However, it is worth noticing that in the first section of the contract, the Department of Health and Amazon agree to a procedure for Fees and Payment if Amazon were to pay the Department of Health.

The partnership was described in the media as Amazon using the content of the NHS website but there is more to it than that, when one reads the contract. In addition to the content of the NHS website (“All of Licensor’s healthcare information, including without limitation symptoms, causes, and definitions, and all related copyrightable content, data, information and other materials Licensor makes available to Amazon”) and the right to use the NHS logo, they are also granting Amazon access to their Application Programming Interface (API).

Here is the small print of what the NHS is handing over: 

Licensor hereby grants to Amazon and its Affiliates, a non-exclusive, worldwide, perpetual, irrevocable and royalty-free license to (a) access and use Licensor’s application program interfaces, which will enable Amazon to obtain Licensor Content (the “Licensor API”), (b) access and use any systems, programs or software made available through Licensor APIs, and (c) use, copy, cache, store and make backup and archival copies of all tools and documentation related to the Licensor API, in each case to do any of the following, directly or through third parties:

i. design, develop, evaluate, port, test and configure, products, applications, cloud-based services and/or distributed software that provide end users to access Licensor Content (“Solutions”);

ii. provide support and maintenance for Solutions; and

iii. enable end users to use and access products, services, software and websites Amazon or its Affiliates make available (“Amazon Products”), and products, services, software and websites that third-parties implementing the Alexa Voice Service make available (“AVS Products”), that use a Solution.

Additionally, Licensor hereby grants Amazon and its Affiliates a non-exclusive, worldwide, perpetual, irrevocable and royalty-free license to make, have made, promote, market, advertise, publicize, distribute, offer for sale and sell Solutions and any products or services that use a Solution and the right to sublicense the foregoing rights to manufacturers of AVS Products and Amazon Associated Properties. The license grants set forth in this Section 3 include a license under any current and future intellectual property rights of Licensor and its Affiliates to the extent necessary: (a) to exercise any license right granted under this Agreement or SOW; and (b) to combine a Solution with any hardware and software.

As we mentioned previously, there is more in this sub-section, but the content has been redacted. An entire paragraph is missing, which means that we do not have a full and precise overview of what exactly the NHS is granting Amazon.

What is the NHS getting in return?

Another interesting element in the contract is that Amazon is not making the NHS any promise, beyond guaranteeing it will give an attribution to the NHS when the NHS content is being quoted. They do not actually guarantee that when their users will ask health related questions they will always use the NHS content.

Earlier this year, Privacy International’s staff tested the Alexa device to find out the kind of answers that would be given to health questions. For many of those, Alexa did not have an answer at all (in particular with regard to issues surrounding mental health, sexual health and gender dysphoria), even though the NHS website would have had the answers. For some questions, such as, “Alexa, my period is late what should I do?” or other women’s health related questions, Alexa would often give answers that did not come from the NHS website. The Mayo Clinic was one of the alternative sources of information Alexa relied on, for example. This raises further questions about the nature and relevance of this contract if Amazon could choose to prioritise content from an American clinic over NHS content.