Back to Legal Hub
Privacy & Data Protection

Privacy Policy

Updated:November 4, 2026
Version:2.7
Length:~6,700 words

Legal Document

This document constitutes part of your legal agreement with Scribeable. Please read it carefully.

Privacy Policy

Scribeable Medical Documentation Platform

Last Updated: November 4, 2026

Effective Date: November 28, 2026

Version 2.7 of this Privacy Policy takes effect on the Effective Date stated above (see Section 10.2). Until then, Version 2.6 of this Privacy Policy (effective October 28, 2026) continues to apply.

INTRODUCTION

Scribeable LLC ("Scribeable," "we," "us," or "our") is committed to protecting the privacy and security of your information. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our medical documentation platform, including our mobile applications, web portal, browser extension, and related services (collectively, the "Platform").

This Policy applies to:

  • Healthcare providers and clinicians who use our Platform
  • Practice staff and authorized users
  • Website visitors
  • Anyone who interacts with our services

Important Healthcare Privacy Notice: We are a "Business Associate" under the Health Insurance Portability and Accountability Act (HIPAA). When you use our Platform to process Protected Health Information (PHI), our collection and use of that information is governed by both this Privacy Policy and our Business Associate Agreement (BAA), which healthcare providers must execute before using the Platform for PHI.

By using our Platform, you agree to the collection and use of information in accordance with this Privacy Policy.

1. INFORMATION WE COLLECT

1.1 Information You Provide to Us

(a) Account Information: When you register for an account, we collect:

  • Full name
  • Email address
  • Professional credentials (medical license, NPI number)
  • Practice or facility name and address
  • Professional specialties
  • Phone number (optional)
  • Billing information (processed securely through Apple or payment processors)

(b) Profile Information:

  • Professional preferences and settings
  • AI model preferences
  • Transcription service preferences
  • Specialty-specific templates and configurations
  • Signature and attestation settings

(c) Protected Health Information (PHI):

  • Patient demographics (name, DOB, MRN, gender, etc.)
  • Clinical notes and consultation documentation
  • Voice recordings of clinical encounters
  • Medical histories and examination findings
  • Diagnoses, assessments, and treatment plans
  • Vital signs, lab results, and other clinical data
  • Any other health information you input into the Platform

(d) EHR Integration Data:

  • EHR system credentials (encrypted and stored securely)
  • Patient lists and appointment schedules
  • Clinical data synchronized from your EHR
  • Field mappings and configuration settings

(e) Support Communications:

  • Messages you send to our support team
  • Attachments and screenshots (which may contain PHI)
  • Feedback and feature requests
  • Error reports and bug submissions

(f) Payment Information:

  • For direct billing: Payment card information (processed by Apple or secure payment processors; we do not store full card numbers)
  • Billing address
  • Transaction history
  • Subscription plan and usage information

1.2 Information We Collect Automatically

(a) Device and Usage Information:

  • Device type, model, and operating system version
  • IP address and general location (city/state level)
  • Browser type and version
  • App version and build number
  • Screen resolution and device identifiers
  • Crash reports and performance data

(b) Platform Usage Data:

  • Features used and frequency of use
  • Time spent in the Platform
  • Navigation patterns and user flows
  • AI model usage and API calls
  • Transcription usage (duration, not content)
  • Number of patients, consultations, and summaries
  • Error logs and debugging information

(c) Browser Extension Data:

  • EHR system type and version detected
  • Field mappings and configurations
  • Patient context matching data
  • Insertion success/failure statistics
  • Browser and extension version information
  • Chart content from EHR websites where you turned on chart reading (see Section 1.6)

(d) Authentication and Security Data:

  • Login timestamps and locations
  • Authentication method used
  • Session duration and activity
  • Security events (failed login attempts, suspicious activity)
  • Access control logs

1.3 Information from Third Parties

(a) AI Service Providers:

  • Processing confirmations from Anthropic (Claude API)
  • Transcription metadata from Deepgram
  • Usage statistics and error reports

(b) EHR Systems:

  • Patient demographic data
  • Appointment schedules and patient lists
  • Clinical data (when you authorize synchronization)
  • System capabilities and version information

(c) Payment Processors:

  • Transaction confirmations
  • Subscription status
  • Payment success/failure notifications

(d) Analytics Services:

  • Aggregated usage statistics
  • Performance metrics
  • Error tracking data

(e) Biometric Data: We collect voice recordings during clinical encounters as part of the transcription process. Voice recordings may constitute biometric identifiers under certain state laws, including the Illinois Biometric Information Privacy Act (BIPA). We obtain your informed consent before collecting voice recordings. We keep voice recordings as follows:

  • iPhone app (single visit): The recording stays on your iPhone until you delete the note or sign out. When you sign out, the app waits up to 30 seconds for unfinished uploads to finish and then deletes the recordings. If another person signs in on the same iPhone, or you sign out from the front-desk screen, recordings not yet sent or not yet filed to a patient are kept on the iPhone, hidden from other accounts, for up to 7 days so you can recover them by signing back in, and are then deleted. Our servers process the uploaded recording in memory for transcription and do not store it.
  • Web portal (single visit): Your browser keeps a backup copy on your computer for up to 2 hours so that an interrupted upload can be retried. Our servers process single-visit audio in memory and do not store it.
  • Browser extension: The browser extension does not record audio.
  • Rounding Mode (web portal and iPhone app): Audio is stored on our servers, encrypted, until it is transcribed, and is deleted within 24 hours after transcription. Audio that fails to transcribe is deleted after 7 days. Audio that arrives after a round and that you have not yet handled is kept for 7 days, and the audio of a round you discard is kept for 24 hours so that the discard can be undone. On the iPhone, Rounding audio not yet sent when you sign out is kept on the device, hidden from other accounts, for up to 7 days so you can send it after signing back in, and is then deleted. If a technical fault stops us reading a recording, we hold it, encrypted, until we can retry it or destroy it. Resolving the fault does not involve listening to the recording.
  • No saved recordings: There is no option to save a recording.
  • Account closure: When you close your account, recordings on our servers are destroyed at once.

Recordings stored on our servers are stored within the United States. We do not sell, lease, or trade biometric data. We implement reasonable security measures to protect biometric data consistent with our treatment of PHI.

1.4 Cookies and Tracking Technologies

We use the following technologies:

(a) Essential Cookies:

  • Authentication and session management
  • Security and fraud prevention
  • Platform functionality

(b) Functional Cookies:

  • User preferences and settings
  • Language and region preferences
  • Accessibility settings

(c) Analytics Cookies:

  • We use analytics services with privacy-preserving configurations
  • Usage patterns and feature adoption
  • Performance monitoring

(d) Marketing Cookies and Ad Tags (Marketing Website Only):

  • Google Ads, Meta Pixel, LinkedIn Insight Tag, X (Twitter) Pixel, and Microsoft Advertising (UET), plus Google Tag Manager for analytics
  • The Meta, LinkedIn, X and Microsoft tags load only after you allow marketing cookies. Google's tag runs in a restricted mode (Google Consent Mode) that sets no advertising cookies until you allow them
  • If your browser sends a Global Privacy Control (GPC) signal, we treat it as "no" even if you allowed marketing cookies: the Meta, LinkedIn, X and Microsoft tags do not load and Google's tag stays in its restricted mode
  • The Meta, LinkedIn, X and Microsoft tags are not loaded on our clinical reference pages (calculators, conditions, procedures, clinical tools) or on pages with a form (for example contact, demo booking, checkout)
  • Never present in the dashboard after sign-in, the mobile apps, the browser extension, or anything that holds patient information. The one exception is Google's conversion tag on the dashboard's sign-up page, before you sign in, which follows the same marketing-cookie choice and GPC rule
  • Used to measure our ad campaigns and to show our ads to people who visited our website (see Section 2.7)

(e) Ad Click Identifiers: When you reach our website from an ad, the link carries a click identifier added by the ad platform (for example Google's gclid, Meta's fbclid, LinkedIn's li_fat_id, Microsoft's msclkid or X's twclid) and campaign tags (utm_ parameters). We save these, with the page you landed on, in a first-party cookie on scribeable.ai for up to 90 days, whether or not you allow marketing cookies. This cookie is read only by us. We use it to learn which campaign brought you if you later create an account. We send a click identifier back to an ad platform only as described in Section 2.7, and only with your consent.

(f) Local Storage:

  • Browser extension field mappings
  • Offline data caching
  • Preferences and configurations

Cookie Management: You can change your cookie choices at any time from the cookie banner, from Your Privacy Choices, or through your browser settings. Note that disabling essential cookies may limit Platform functionality.

1.5 Sensitive Personal Information (CPRA)

Under the California Privacy Rights Act (CPRA), we may collect the following categories of sensitive personal information:

  • Health Data: Clinical notes, diagnoses, treatment plans, and other PHI processed through the Platform
  • Biometric Data: Voice recordings used for transcription (see Section 1.3(e))
  • Precise Geolocation: Device location data when you enable location services (used for session security and audit logging)
  • Financial Data: Payment card and billing information (processed by third-party payment processors)
  • Account Log-In Credentials: Email and password or authentication tokens used to access the Platform
  • Professional Information: Medical license numbers, NPI numbers, and professional credentials

We use sensitive personal information only as necessary to provide and improve our Platform services, for security and fraud prevention, and as otherwise permitted under applicable law. You have the right to limit our use of sensitive personal information to purposes authorized by the CPRA. To exercise this right, contact [email protected].

1.6 Browser Extension Chart Reading

Chart reading is a browser-extension feature that is off until you turn it on for a specific EHR website. It is available only when a Business Associate Agreement is on file for the covered entity: one signed by your practice or organization, or accepted in Scribeable if you practice on your own. Before it starts on a website, you accept a short statement for that website, including that the records belong to your own practice or that your organization has authorized you to use Scribeable with them. We record the version of the statement you accepted and when.

What is read. When you open a patient's chart on a website where chart reading is on, the extension reads the page you are looking at: the chart's banner and visible text, or, when the chart is drawn as a picture, a cropped image of the chart area. It also sends the website's origin (for example https://ehr.example.org), never the page address (URL). It never navigates, clicks, scrolls, types or opens anything in your EHR, and it does not read patient portals, pages that show more than one patient's chart, or restricted records (for example break-the-glass, 42 CFR Part 2 or psychotherapy notes), which are skipped in the browser and not sent.

How it is used. Chart content is sent to us encrypted. We match it to a patient on your own Scribeable list and keep the items found (problems, medications, allergies, labs and vitals, and prior-note excerpts, in the categories you approve), encrypted, for use in your notes. A chart that does not match one of your patients is not kept. The page text or image is discarded after it is read. On a clinic schedule or census page you can import the rows you choose; the names, dates of birth and MRNs on that list are used only to match them to your patients. This information is PHI, handled under our Business Associate Agreement and Section 4.2.

Your controls. You can pause chart reading, turn it off for a website, and remove anything it kept, per patient and category. Your practice administrator can turn it off for the whole practice, and we can switch it off for everyone.

2. HOW WE USE YOUR INFORMATION

2.1 Primary Uses

We use collected information to:

(a) Provide and Operate the Platform:

  • Authenticate users and manage accounts
  • Generate AI-powered clinical summaries
  • Transcribe voice recordings
  • Synchronize data with EHR systems
  • Store and retrieve clinical documentation
  • Process patient information and consultations
  • Provide clinical decision support
  • Enable secure web export of summaries

(b) AI Processing:

  • Send clinical text to Claude API for summary generation
  • Send audio to Deepgram for medical transcription
  • Generate structured data from unstructured notes
  • Provide diagnostic suggestions and ICD-10 codes
  • Generate treatment plans and recommendations
  • Analyze clinical completeness and safety

(c) EHR Integration:

  • Match patient context between Scribeable and your EHR
  • Detect and map EHR fields for documentation insertion
  • Synchronize patient lists and schedules
  • Pull clinical data from your EHR
  • Push clinical notes to your EHR
  • Maintain bidirectional data consistency

2.2 Service Improvement

We use information to:

  • Analyze usage patterns to improve features
  • Identify and fix bugs and technical issues
  • Optimize Platform performance and reliability
  • Improve transcription accuracy
  • Enhance EHR compatibility
  • Develop new features and functionality
  • Conduct internal research and development

2.3 Security and Compliance

We use information to:

  • Prevent fraud and unauthorized access
  • Detect and respond to security incidents
  • Monitor for abuse and policy violations
  • Conduct security audits and assessments
  • Maintain HIPAA audit trails
  • Comply with legal and regulatory requirements
  • Respond to law enforcement requests

2.4 Communications

We use information to:

  • Send service announcements and updates
  • Provide customer support responses
  • Send usage alerts and notifications
  • Notify you of security issues
  • Provide subscription and billing information
  • Send product updates and new features (with consent)

2.5 AI Model Training and AI Provider Retention

We do not use your clinical data, including transcriptions and notes, to train AI models. Our requests to Deepgram opt out of Deepgram's model improvement program. Our AI processing partners (Anthropic and Deepgram, and OpenAI, which is authorized but to which no task currently sends clinical data) process clinical data under Business Associate Agreements (BAAs) with us. Clinical data sent to AI services is processed to generate your requested output (e.g., clinical notes, transcriptions). Anthropic may retain requests and outputs under its terms; we have no zero-retention arrangement with Anthropic. OpenAI's Modified Retention terms apply to any data sent to it. Deepgram's retention of audio is governed by its terms and its BAA with us. Section 3.1 lists these providers, and our Subprocessor List at https://scribeable.ai/legal/subprocessors states how long each one keeps data.

2.6 Analytics and Business Operations

We use aggregated, de-identified information to:

  • Generate usage statistics and reports
  • Analyze market trends and opportunities
  • Evaluate product performance
  • Support business planning and development
  • Produce aggregated, de-identified operational and quality reporting (not used to train or improve AI or machine learning models)

Important: We do NOT use your PHI to:

  • Train AI models
  • Share with third parties for their marketing
  • Sell to data brokers or advertisers
  • Advertise to you or to anyone else
  • Create publicly available datasets
  • Use for any purpose other than providing you our services

2.7 Advertising and Conversion Measurement

We advertise Scribeable on Google, Meta (Facebook and Instagram), LinkedIn, X (Twitter), Microsoft and Doximity. This section explains what we share with those platforms and how to turn it off. None of it ever includes PHI, patient information, note content, recordings, or anything you do with patients in the Platform.

(a) Ads shown to website visitors (retargeting): If you allow marketing cookies on scribeable.ai, the ad platforms' tags (Section 1.4(d)) record that your browser visited our website and which pages, so the platform can show our ads to you later and tell us whether an ad led to a visit. The platforms can also show our ads to people who watched or engaged with our ads or posts on that platform.

(b) Similar audiences (lookalikes): We may ask an ad platform to find people similar to our website visitors or to people who signed up after allowing marketing cookies. The platform does the matching inside its own systems. We receive only totals, never a list of people.

(c) Conversion events sent from our servers: When you create an account and later reach a milestone (for example starting a trial, using the Platform on several days, or subscribing), we may send the ad platform that brought you:

  • the click identifier from your ad click (Section 1.4(e)),
  • the name of the milestone, its time, and a value in dollars (for example the subscription price).

For accounts you create yourself, we may also send a hashed (SHA-256) copy of your email address so the platform can match the event to its own user. We never do this for clinicians invited by their practice. We send nothing to a platform you did not come from, except the hashed email used for a similar audience under (b).

We send these events only if you allowed marketing cookies on our website and your browser did not send GPC when you signed up, and you have not opted out since. Accounts created in the iOS app send none, because the app has no marketing-cookie choice.

(d) What we do not do: We do not buy lists of people or use data brokers to target ads. We do not upload anyone else's contact list as an ad audience. We do not try to identify people from their likes, comments or other engagement with our ads. We do not exclude people from our ads by age, sex, race or any other protected characteristic.

(e) How to opt out:

  • Use Your Privacy Choices to opt out in your browser. If you then open the Scribeable dashboard in that browser, your account is marked as opted out and we stop sending conversion events for it. (Some browsers, such as Safari, keep this website setting for only 7 days, so open the dashboard soon after, or email us.)
  • Turn on Global Privacy Control in your browser. We treat it as an opt-out: the Meta, LinkedIn, X and Microsoft tags do not load, Google's tag stays in its restricted mode, and the dashboard marks your account as opted out the same way.
  • Email [email protected] and we will opt out your account.
  • Each ad platform also offers its own ad settings where you can limit ads based on activity elsewhere.

Opting out does not affect your account or the Platform in any way.

3. HOW WE SHARE YOUR INFORMATION

3.1 Service Providers (Subprocessors)

We share information with trusted service providers who assist in operating the Platform:

(a) AI and Machine Learning:

  • Anthropic PBC - Claude API for clinical documentation (BAA in place)
  • OpenAI, L.L.C. - OpenAI API, authorized for extracting suggested orders and classifying patient status (BAA in place). As of the Last Updated date of this Policy, no task sends clinical data to OpenAI; both tasks run on Anthropic's Claude

(b) Transcription Services:

  • Deepgram, Inc. - Medical voice transcription (BAA in place)

(c) Cloud Infrastructure:

  • Google LLC - Firebase Authentication, Firestore, Cloud Storage, Cloud KMS (BAA in place)
  • OVH US Corporation - OVH Public Cloud hosting for our application servers, PostgreSQL database and job queue (BAA in place)
  • Backblaze, Inc. - Encrypted database backups and encrypted storage of rounding audio (BAA in place)
  • Cloudflare, Inc. - Content delivery, web application firewall and DDoS protection. Cloudflare passes traffic through and does not store PHI (HIPAA conduit; no BAA)

(d) Payment Processing:

  • Apple Inc. - In-App Purchase processing (for iOS subscriptions)
  • Stripe, Inc. - Payment processing (for web subscriptions; no PHI processed)

(e) Analytics and Monitoring:

  • Google Analytics - Anonymized usage analytics

(f) Marketing and Advertising:

  • Google Tag Manager - Tag management and analytics orchestration (marketing site only; no PHI)
  • Google Ads - Advertising, retargeting and conversion measurement (no PHI)
  • Meta (Facebook and Instagram) - Advertising, retargeting and conversion measurement (no PHI)
  • LinkedIn - Advertising, retargeting and conversion measurement (no PHI)
  • X (Twitter) - Advertising, retargeting and conversion measurement (no PHI)
  • Microsoft Advertising - Advertising and conversion measurement (no PHI)
  • Doximity - Advertising to verified clinicians (no PHI)

Their tags run only on the public marketing website (scribeable.ai) and, for Google, the dashboard's sign-up page; they follow your marketing-cookie choice and GPC, and never run in the signed-in dashboard, the apps or the browser extension (Section 1.4(d)). From our servers we send these platforms only what Section 2.7 lists: a click identifier, a milestone name, its time and a value, and for self-created accounts a hashed email address, and only for accounts with marketing consent. We never send PHI, clinical data, or anything about your patients or your use of the Platform beyond those milestones.

(g) Communication Services:

  • SendGrid - Transactional email delivery

All service providers:

  • Are contractually obligated to protect your data
  • Have executed Business Associate Agreements (where required for PHI)
  • Are prohibited from using your data for their own purposes
  • Must comply with HIPAA, GDPR, and other applicable laws

Our Subprocessor List at https://scribeable.ai/legal/subprocessors is the complete, current list of Subprocessors. It states what each one processes, where, and whether it has a BAA with us.

3.2 Business Transfers

If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

3.3 Legal Requirements

We may disclose information when required to:

  • Comply with applicable laws, regulations, or legal processes
  • Respond to valid subpoenas, court orders, or government requests
  • Enforce our Terms of Use and other agreements
  • Protect our rights, property, or safety
  • Protect the rights, property, or safety of our users or others
  • Prevent fraud, security breaches, or illegal activity
  • Respond to emergencies involving danger of death or serious physical injury

3.4 With Your Consent

We may share information with third parties when you explicitly authorize us to do so, such as:

  • Exporting summaries to your institutional computer
  • Integrating with third-party services you select
  • Sharing specific data with colleagues or consultants
  • Participating in research studies (with de-identified data)

3.5 Aggregated or De-Identified Information

We may share aggregated, de-identified, or anonymized information that cannot reasonably be used to identify you or your patients. Such information is not subject to this Privacy Policy.

3.6 We Do Not Sell Personal Information

We do not sell, rent, or trade your personal information or PHI to third parties for monetary consideration or any other benefit. Under some state laws, the advertising described in Section 2.7 counts as "sharing" personal information for cross-context behavioral advertising. We do it only with your consent, and you can opt out at any time (Section 2.7(e)).

3.7 Royalty Reporting to the American Medical Association

The Platform uses Current Procedural Terminology (CPT) content that we license from the American Medical Association (AMA). Our license requires us to report to the AMA the information used to calculate the royalties we pay, and Section 17.8 of our Platform Terms of Use requires your consent to that release. We disclose to the AMA your name (or your organization's name); your city, state, and country; the name of your parent organization, if any; and, for ambulatory settings, the number of Billing Providers (as defined in the Platform Terms of Use) using the Platform. We may also provide additional information the AMA reasonably requests to verify these reports. We do not disclose PHI or Clinical Content to the AMA. The AMA has agreed to keep our royalty reports and customer list confidential.

4. DATA SECURITY AND PROTECTION

4.1 Security Measures

We implement comprehensive security safeguards including:

(a) Encryption:

  • In Transit: TLS 1.3 for all data transmission
  • At Rest: AES-256 encryption for stored data
  • Client-Side: PHI is encrypted on your device before it is sent, on our enforced channels; our servers hold the encryption keys and decrypt PHI in memory to process it
  • Database: Encrypted database connections and storage

(b) Access Controls:

  • Role-based access control (RBAC)
  • Multi-factor authentication (MFA): available to every user, per-user opt-in; enrolled users complete a second factor at sign-in
  • Unique user identifiers
  • Least privilege access principles
  • Bounded session lifetime (14-day maximum) with per-device revocation and explicit sign-out
  • Strong password requirements

(c) Network Security:

  • Web Application Firewall (WAF)
  • DDoS protection
  • Intrusion Detection Systems (IDS)
  • Intrusion Prevention Systems (IPS)
  • Regular vulnerability scanning
  • Annual penetration testing

(d) Audit and Monitoring:

  • Comprehensive audit logging
  • Real-time security monitoring
  • Automated threat detection
  • SIEM integration
  • 24/7 security operations

(e) Data Integrity:

  • Checksums and validation
  • Version control
  • Regular backups (encrypted)
  • Disaster recovery procedures
  • Business continuity planning

(f) Physical Security:

  • Data centers with physical access controls
  • 24/7 surveillance and monitoring
  • Environmental controls
  • Redundant power and connectivity

(g) Workforce Security:

  • Background checks for employees with PHI access
  • Regular security training
  • Confidentiality agreements
  • Termination procedures
  • Incident response training

4.2 HIPAA Compliance

Our security program is designed to meet HIPAA Security Rule requirements including:

  • Administrative Safeguards (45 C.F.R. § 164.308)
  • Physical Safeguards (45 C.F.R. § 164.310)
  • Technical Safeguards (45 C.F.R. § 164.312)
  • Organizational Requirements (45 C.F.R. § 164.314)
  • Policies and Procedures (45 C.F.R. § 164.316)

4.3 Breach Notification

In the event of a breach of unsecured PHI:

  • We will investigate and contain the breach
  • We will notify affected covered entities without unreasonable delay
  • We will provide information required for breach notification
  • We will cooperate fully with breach response activities
  • We will take steps to prevent future breaches

4.4 Data Minimization

We implement data minimization principles:

  • Collect only necessary information
  • Limit PHI to minimum necessary for services
  • Encourage de-identification where appropriate
  • Regular review and purging of unnecessary data
  • Shortest feasible retention periods

4.5 Security Limitations

While we implement strong security measures, you acknowledge that:

  • No system is 100% secure
  • Internet transmission carries inherent risks
  • You are responsible for your account security
  • You must use strong passwords and protect your devices
  • You should report suspicious activity immediately

5. DATA RETENTION AND DELETION

5.1 Retention Periods

We retain information for the following periods:

(a) Active Account Data:

  • PHI/Clinical Data: Kept until you delete it. An archived patient can be restored for 30 days and is then permanently deleted; a patient you delete permanently is deleted at once
  • Account Information: Retained while your account is active
  • Usage Logs: 6 years (HIPAA audit requirement)
  • Security Logs: 6 years minimum

(b) After Account Termination:

  • PHI, individual accounts that chose destruction at closure: Destroyed from our live systems on or after the 30th day after closure; backup copies expire within 28 days after that
  • PHI, all other accounts: Kept after account closure, with no fixed end date. You can contact support for a copy or to have it destroyed (Section 5.2). For accounts that belonged to a practice, the practice controls the records
  • Non-PHI Personal Data: Deleted within 30 days of a verified deletion request
  • Billing Records: 7 years (IRS requirement)
  • Audit Logs: 6 years minimum (HIPAA requirement)
  • De-identified Data: May be retained indefinitely

(c) Specific Data Types:

  • Voice Recordings: As described in Section 1.3(e)
  • Web Export Tokens: Deleted after use or 1 hour expiration
  • Backup Data: Backup copies expire within 28 days of the applicable deletion event
  • Cache Data: Automatically deleted after 24 hours

5.2 Account Deletion

When you delete your account:

  • Voice recordings, rounding data and cached EHR data are destroyed immediately
  • We will delete or de-identify your other personal information
  • If you have an individual account, you can choose to have your patient records destroyed. We destroy them from our live systems on or after the 30th day after closure, backup copies expire within 28 days after that, and we email you a certificate listing what was destroyed and what was kept. The 30 days cannot be used to recover your account, so request a copy of your records before you close it
  • If you do not choose destruction, we keep your patient records for the retention period in §5.1. You can contact support for a copy or to have them destroyed
  • If your account belongs to a practice, the practice keeps the patient records and we notify the practice owner
  • We keep audit logs, consent records, billing records, security alerts and a record of what documents were sent and when (with patient contact details removed), as required by law
  • De-identified data may be retained for aggregated analytics and operational reporting (not used to train or improve AI or machine learning models)

5.3 Individual Data Deletion

You may request deletion of specific data subject to:

  • Legal and regulatory retention requirements
  • Ongoing legal obligations or disputes
  • Fraud prevention and security needs
  • Technical limitations

We will respond to deletion requests within 30 days and complete deletion within 90 days when legally permitted.

5.4 Data Portability

Upon request, we will provide:

  • Your account information in machine-readable format
  • Your clinical documentation and data
  • Data needed to transfer to another service
  • Export in common formats (PDF, JSON, CSV)

6. YOUR RIGHTS AND CHOICES

6.1 Access Rights

You have the right to:

  • Access your personal information
  • Receive a copy of your data
  • Review your account information
  • Request an accounting of disclosures

How to exercise: Email [email protected] or use in-app export features.

6.2 Correction Rights

You have the right to:

  • Correct inaccurate personal information
  • Update your account details
  • Amend PHI (subject to medical record requirements)
  • Request corrections to your data

How to exercise: Update through app settings or email [email protected].

6.3 Deletion Rights

You have the right to:

  • Request deletion of your personal information
  • Delete your account
  • Request deletion of specific data

Limitations: We may retain data required by law or for legitimate business purposes.

How to exercise: Account Settings > Delete Account, or email [email protected].

6.4 Restriction Rights

You have the right to:

  • Restrict processing of your data
  • Object to certain uses
  • Limit sharing with specific service providers
  • Opt out of optional features

How to exercise: Account Settings or email [email protected].

6.5 Portability Rights

You have the right to:

  • Receive your data in structured, machine-readable format
  • Transmit your data to another service
  • Export clinical documentation and records

How to exercise: Use in-app export features or email [email protected].

6.6 Objection Rights

You have the right to object to:

  • Processing based on legitimate interests
  • Direct marketing communications
  • Automated decision-making
  • Profiling

How to exercise: Email [email protected] or use opt-out links in communications.

6.7 Communication Preferences

You can control:

  • Marketing emails (opt-out available)
  • Product updates and newsletters
  • Educational content
  • Non-essential notifications

Note: You cannot opt out of essential service communications (security alerts, billing notices, Terms updates).

6.8 Cookie Preferences

You can manage cookies through:

  • The cookie banner and Your Privacy Choices on our website
  • Global Privacy Control, which we honor as an opt-out (Section 2.7(e))
  • Browser settings (block/delete cookies)
  • Extension settings (disable telemetry)
  • Opt-out tools for analytics services

6.9 HIPAA Rights

As a Business Associate, we support the following rights that covered entities must honor under HIPAA:

  • Right of Access: You may request access to PHI we maintain on behalf of your covered entity
  • Right to Amend: You may request amendments to PHI
  • Right to an Accounting of Disclosures: You may request an accounting of disclosures of your PHI
  • Right to Request Restrictions: You may request restrictions on certain uses and disclosures
  • Right to Confidential Communications: You may request alternative means of receiving communications
  • Right to a Copy of the Notice: You may request a paper copy of the applicable Notice of Privacy Practices

If you believe your HIPAA privacy rights have been violated, you may file a complaint with:

You will not be retaliated against for filing a complaint.

7. INTERNATIONAL DATA TRANSFERS

7.1 Data Location

Your data is primarily stored and processed in the United States. Protected Health Information and clinical content are stored and processed solely within the United States; any processing of data outside the United States is limited to non-clinical data (such as account, billing, or product-analytics data). By using our Platform, you consent to the transfer of your information to the United States.

7.2 Transfers from the EEA/UK

For users in the European Economic Area (EEA) or United Kingdom:

  • We rely on Standard Contractual Clauses (SCCs) approved by the European Commission
  • We implement supplementary measures to protect data
  • We conduct transfer impact assessments
  • We maintain compliance with GDPR requirements

7.3 Transfers from Other Jurisdictions

We comply with applicable cross-border transfer requirements, including:

  • Canadian PIPEDA requirements
  • Australian Privacy Principles
  • Other national privacy laws

7.4 Third-Country Processing

Some of our service providers may process non-clinical data outside the United States. We do not process Protected Health Information or clinical content outside the United States. For any non-clinical data processed abroad, we ensure appropriate safeguards through:

  • SCCs or equivalent transfer mechanisms
  • Data Processing Addenda
  • Privacy Shield successor frameworks (when available)
  • Adequacy decisions (where applicable)

7.5 Substance Abuse Records (42 CFR Part 2)

If the Platform is used in connection with a federally assisted substance use disorder treatment program, records of the identity, diagnosis, prognosis, or treatment of any patient maintained in connection with the performance of any program or activity relating to substance use disorder education, prevention, training, treatment, rehabilitation, or research that is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States are protected by 42 CFR Part 2. Such records may only be disclosed with the written consent of the patient or as otherwise permitted by 42 CFR Part 2. A general authorization for the release of medical or other information is NOT sufficient for this purpose. Violations of 42 CFR Part 2 are subject to criminal penalties.

8. CHILDREN'S PRIVACY

8.1 Age Restrictions

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 13 (or 16 in the EEA).

8.2 Patient Data

While the Platform may be used to document care for pediatric patients, such information:

  • Is entered by licensed healthcare providers
  • Is part of the provider's medical documentation
  • Is not "collected from children" within the meaning of COPPA
  • Is subject to HIPAA, not COPPA

8.3 Inadvertent Collection

If we learn we have collected information from a child under 13 without parental consent, we will delete it promptly.

8.4 Parental Rights

Parents or legal guardians who believe their child's information has been collected may contact [email protected] to request access or deletion.

8.5 Data Protection Impact Assessments (DPIAs)

Scribeable conducts Data Protection Impact Assessments as required under GDPR Article 35 and as a best practice for high-risk data processing activities. DPIAs are performed when we introduce new processing activities involving PHI, biometric data, or large-scale profiling, or when processing is likely to result in a high risk to individuals' rights and freedoms. DPIA results inform our data protection measures and are reviewed and updated regularly. Summaries of relevant DPIA findings are available upon request to [email protected].

9. REGIONAL PRIVACY RIGHTS

9.1 California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

(a) Right to Know:

  • Categories of personal information collected
  • Sources of personal information
  • Business purposes for collection
  • Categories of third parties with whom we share
  • Specific pieces of personal information we hold

(b) Right to Delete:

  • Request deletion of your personal information
  • Subject to exceptions for legal obligations

(c) Right to Opt-Out of Sale or Sharing:

  • We do not sell personal information
  • With your consent, we share limited information with ad platforms for cross-context behavioral advertising (Section 2.7). You can opt out at Your Privacy Choices, with Global Privacy Control, or by emailing [email protected]

(d) Right to Non-Discrimination:

  • We will not discriminate against you for exercising your rights

(e) Right to Limit Use of Sensitive Personal Information:

  • Sensitive information is used only for providing services
  • You can request limitations on uses beyond service provision

(f) Authorized Agents:

  • You may designate an authorized agent to make requests on your behalf

How to exercise California rights: Email [email protected]. We will establish a toll-free number for California residents. In the interim, you may submit requests via email or our online portal at https://scribeable.ai/privacy-request.

Verification: We will verify your identity before responding to requests.

9.2 European Privacy Rights (GDPR)

If you are in the EEA or UK, you have rights under the General Data Protection Regulation:

(a) Legal Bases for Processing: We process your information based on:

  • Contract Performance: To provide services under our Terms
  • Legitimate Interests: Security, fraud prevention, improvement
  • Legal Obligation: Compliance with laws and regulations
  • Consent: For optional features and communications (withdrawn at any time)

(b) Data Controller: For Platform services, Scribeable is the data controller. For PHI processing, we are typically a data processor on behalf of the covered entity.

(c) EU Representative and Scope: We do not currently offer services specifically targeted to EU/EEA residents. If you are in the EU/EEA and use our services, contact [email protected] for data protection inquiries. An EU representative will be designated if required based on processing volume and scope of activities.

(d) Data Protection Officer: Email: [email protected]

(e) Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

(f) Additional Rights:

  • Right to object to processing
  • Right to restrict processing
  • Right to data portability
  • Right to withdraw consent
  • Right not to be subject to automated decision-making

9.3 Other U.S. State Privacy Laws

We comply with privacy laws in states including:

  • Virginia (VCDPA)
  • Colorado (CPA)
  • Connecticut (CTDPA)
  • Utah (UCPA)

Residents of these states have rights similar to California residents, including the right to opt out of targeted advertising (Section 2.7(e)). Contact [email protected] to exercise your rights.

9.4 Health Privacy Laws

In addition to HIPAA, we comply with state health privacy laws, including:

  • State medical records laws
  • State breach notification laws
  • State consent requirements
  • Professional licensing board requirements

10. CHANGES TO THIS PRIVACY POLICY

10.1 Updates

We may update this Privacy Policy to reflect:

  • Changes in our practices
  • Legal or regulatory requirements
  • New features or services
  • Security improvements
  • User feedback

10.2 Notification

We will notify you of material changes by:

  • Posting the updated policy on our website with a new "Last Updated" date
  • Sending email notification to your registered email address
  • Displaying an in-app notification
  • Providing at least 30 days' notice before material changes take effect

10.3 Continued Use

Your continued use of the Platform after the effective date of changes constitutes acceptance of the updated Privacy Policy.

10.4 Objection to Changes

If you do not agree to changes, you may:

  • Stop using the Platform
  • Terminate your account
  • Request deletion of your data (subject to retention requirements)

11. CONTACT US

11.1 Privacy Questions

For questions about this Privacy Policy or our privacy practices:

Email: [email protected] Mail: Scribeable LLC Attention: Privacy Officer 600 Boulevard South SW Suite 104J Huntsville, AL 35802

11.2 Rights Requests

To exercise your privacy rights:

Email: [email protected] Subject Line: "Privacy Rights Request - [Your Name]"

Include in your request:

  • Your full name and account email
  • The specific right you wish to exercise
  • Sufficient information to verify your identity
  • Preferred method of response

Response Time: We will respond within 30 days (or as required by applicable law).

11.3 HIPAA/BAA Questions

For HIPAA-related questions or BAA requests:

Email: [email protected] Include: Your organization name, contact information, and description of your needs

11.4 Security Incidents

To report security issues or suspected breaches:

Email: [email protected]

Available: 24/7 email-based monitoring. Our security team monitors [email protected] around the clock. All reports are triaged and acknowledged within 1 hour.

11.5 Data Protection Officer

For GDPR-related inquiries:

Email: [email protected]

12. ADDITIONAL INFORMATION

12.1 Third-Party Links

The Platform may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

12.2 Do Not Track and Global Privacy Control

Our Platform does not respond to Do Not Track (DNT) signals because there is no accepted DNT standard. We do honor Global Privacy Control (GPC) as an opt-out of the sale or sharing of personal information for advertising (Section 2.7(e)).

12.3 Accessibility

We are committed to making this Privacy Policy accessible. If you need this policy in an alternative format, please contact [email protected].

12.4 Language

This Privacy Policy is provided in English. Translations may be available, but the English version controls in case of conflict.

SUMMARY OF KEY POINTS

What information do we collect? Account information, PHI, usage data, device information

How do we use it? To provide Platform services, generate AI summaries, transcribe audio, integrate with EHRs, and improve our services

Do we share it? Only with service providers under BAAs, as required by law, or with your consent. We never sell your data. With your consent, we share ad-click identifiers and signup milestones (never PHI) with the ad platform that brought you; you can opt out at any time (Section 2.7).

How do we protect it? TLS 1.3, AES-256 encryption, access controls, audit logging, HIPAA-compliant security measures

How long do we keep it? PHI until you delete it (Section 5.1), 6 years for audit logs, shorter for other data

What are your rights? Access, correction, deletion, portability, restriction, and objection rights

How do you contact us? [email protected] for all privacy questions

Last Updated: November 4, 2026 Effective Date: November 28, 2026 Version: 2.7

© 2026 Scribeable LLC All rights reserved.

Questions?

Our legal team is available to help clarify any terms.