Sounds like an access control failure here, leading to users being able to access other users' recorded consultations. Babylon claims that this is due to a new

Sounds like an access control failure here, leading to users being able to access other users' recorded consultations. Babylon claims that this is due to a new feature letting people switch between audio and video in the call, but this seems a somewhat strange claim. It sounds more to me like an access control/authentication failure - firstly on listing recordings that belong to another user, secondly on then giving access to those recordings when requested. And arguably also a failure in storing the recordings in an effective "plaintext" meaning they could be retrieved by a user that shouldn't have access - given this is about as sensitive health-related PII as you can get, I'd argue these recordings ought to be encrypted with a per-recording key available from a separate key management system? I guess this gives rise to a bigger question around whether online GP consultations should be recorded and preserved like this, given this kind of situation was/should be clearly in the threat model, and will be from now on? Edit to add: From Babylon's website, "All data is encrypted and stored securely to guarantee your privacy" - once again, "non end-to-end encryption" fails to save the day due to a failure of another component of the system, and becomes snake-oil marketing copy.