Privacy Policy
6. Data, Privacy, and Protected Health Information
ScribeMine's complete data and privacy commitments are set out in this Section, which constitutes ScribeMine's privacy disclosure for US subscribers.
All PHI processed through the Platform is encrypted at rest (AES-256) and in transit (TLS 1.3).
ScribeMine processes patient data solely to provide the Platform services described in these Terms and the BAA. ScribeMine does not sell or license patient data, and does not disclose patient data to any third party for commercial purposes.
The AI companies that power ScribeMine never train their models on your data. USA law, which we strictly comply with, forbids it under HIPAA regulations: they may use your data only to provide our service, and nothing else. ScribeMine improves only from notes with names and personal details fully removed first. Your and your client’s personal health information is never used for training.
In respect of consent, clients answer three basic questions; recording, keeping the de-identified transcript, and sharing de-identified notes with a colleague or supervisor, and this policy is the legal instrument behind those same three things.
ScribeMine may derive anonymised, non-identifiable aggregate observations from platform-wide activity — such as intervention pattern trends and outcome trajectories across the user base — solely to maintain and improve the clinical quality of the Platform. These observations are not personal data under HIPAA, cannot identify any individual patient or practitioner, and are never sold, licensed, or shared with any third party.
US subscriber data does not leave US-based infrastructure without your explicit consent.
Upon account deletion, ScribeMine permanently purges all associated PHI and clinical data within the timeframe prescribed by applicable law, subject to any mandatory retention obligations.
You are responsible for ensuring that your patients have provided any consents required by applicable law before you use ScribeMine to process their information, and for maintaining any required patient consent documentation in your own practice records.
6.1 Privacy Disclosure
What we collect. ScribeMine collects and processes the following categories of information: client session audio (destroyed the moment the transcript is captured and verified — see Section 3.2); de-identified transcripts (retained for as long as the therapist and their client decide); practitioner voice notes (retention selectable by the practitioner — see Section 3.2); AI-generated clinical notes and session summaries; longitudinal session metadata and pattern data derived from multiple sessions; patient identifiers as entered by the practitioner; practitioner account and billing information; platform usage and audit data.
Why we collect it. Patient session data is collected and processed solely to provide AI-assisted clinical documentation services to the treating practitioner. Platform usage data is used to operate, secure, and improve the Platform.
Who sees it. Patient session data is accessible only to the treating practitioner. ScribeMine infrastructure accesses data only as required to deliver the service. No patient data is shared with or accessible by any third party except as required to fulfil the BAA or as compelled by applicable law. No patient data is ever sold.
Where it is stored. All patient data processed through the US instance of ScribeMine is stored within the United States on HIPAA-compliant infrastructure.
How long we keep it. Clinical records are retained for a minimum of 6 years from the date of last session contact, in compliance with HIPAA record retention requirements. Records relating to minor patients are retained until the patient reaches the age of majority in their state, or 6 years from last contact, whichever is later. Audit logs are retained for a minimum of 6 years.
When a practitioner closes their account, we hold their patient records in encrypted cold storage for 30 days. During that time the practitioner can still read them. After 30 days we permanently delete all patient data except the clinical notes, which must be kept for the legal retention period described above.
The identifiable session transcript is deleted shortly after the clinical note is approved; a de-identified transcript, with names and identifiers removed, is kept only where the practitioner and client choose, for the period they choose. Encrypted database backups expire within 30 days.
Security. ScribeMine uses SessionGuard, an encrypted session container architecture with role-based access controls and an immutable audit trail on every data access event. Multi-factor authentication is mandatory for all accounts. All platform access and data events are logged.
Breach notification. In the event of a security breach affecting PHI, ScribeMine will notify affected subscribers in accordance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414). Subscribers are responsible for notifying their patients where required by applicable law.
Your rights. As a practitioner subscriber, you may request access to your account data or request account deletion at any time through your account settings or by contacting inquiries@scribemine.com. Patient data subject rights requests must be handled by you as the Covered Entity. ScribeMine does not accept or process data access or deletion requests directly from patients.
Contact: inquiries@scribemine.com.
Updates. ScribeMine may update this disclosure to reflect changes in law or Platform features. Material changes will be communicated as set out in Section 13. Continued use of the Platform following notice of an update constitutes acceptance.
Read the full Terms of Service. Questions: inquiries@scribemine.com.