Scribing.io
Privacy Policy

Effective Date: August 24, 2026
Last Updated: August 24, 2026

Scribing.io ("Scribing.io," "we," "our," or "us") values your privacy. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use our website, applications, software, and related services (collectively, the "Services").

This Privacy Policy applies to information processed by Scribing.io in connection with the Services. Where Scribing.io processes information solely on behalf of a healthcare organization or other customer, the customer's agreement and applicable privacy instructions may govern that processing. This policy should be read together with any applicable BAA, DPA, or other customer agreement.

1. Information We Collect

a. Account and Professional Information

• Name, email address, phone number, organization or practice information, professional role, and other information you provide when creating or managing an account.

• Authentication and security information associated with your account.

b. Usage, Device, and Technical Information

• IP address, browser and device type, operating system, pages or features accessed, referring URLs, timestamps, diagnostics, and performance data.

• Log, security, and fraud-prevention information generated through use of the Services.

c. Audio, Transcription, and Documentation Data

• Audio recordings or other source content submitted to or generated by the Services.

• AI-generated transcripts, notes, summaries, structured documentation, and related metadata such as timestamps, duration, word counts, or processing status.

d. Health and Patient Information

Depending on how the Services are configured and used, customers may submit information relating to patients or other individuals, including protected health information or other health-related information. When we process such information on behalf of a healthcare organization or other customer, we generally act as a service provider or business associate and process the information according to the customer's instructions and applicable agreements, such as a BAA or DPA. The customer is generally responsible for determining the lawful basis and permissions for submitting such information to the Services.

e. Payment and Transaction Information

Payment transactions may be processed by third-party payment providers. We may receive limited transaction information, such as payment status, order reference, billing country, plan, and subscription details. Payment card details may be collected and processed directly by the applicable payment provider.

f. Cookies and Similar Technologies

We may use cookies, local storage, pixels, and similar technologies for authentication, preferences, security, analytics, and service functionality. Where required by law, we will request appropriate consent for non-essential technologies.

2. How We Use Information

• Provide, operate, maintain, and improve the Services.

• Process audio, transcripts, and documentation at the direction of the user or customer.

• Authenticate users, protect accounts, detect fraud or abuse, monitor security, and troubleshoot technical issues.

• Communicate about accounts, subscriptions, support requests, product changes, and service-related notices.

• Personalize or improve the user experience and analyze usage and performance.

• Comply with legal obligations, enforce our agreements, and protect our rights, users, and systems.

3. How We Share Information

We do not sell personal information for money. We may disclose information in the following circumstances:

• Service Providers: to vendors that host, store, process, secure, analyze, support, or otherwise provide services to Scribing.io, including cloud infrastructure, analytics, communications, payment processing, and AI or machine-learning service providers, subject to contractual and security controls appropriate to the processing.

• Customer Direction and Integrations: when a user or customer instructs us to send information to an EHR, integration, workflow tool, or other third party.

• Legal and Safety: when necessary to comply with law, legal process, or lawful government requests, or to protect the rights, safety, security, or property of Scribing.io, our users, or others.

• Business Transactions: in connection with a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, subject to appropriate confidentiality and legal protections.

• With Consent: when you direct or otherwise authorize us to disclose information.

4. AI and Service Providers

To provide features such as transcription and documentation generation, we may send relevant content to third-party infrastructure or AI providers acting on our behalf or as otherwise permitted by applicable agreements. We aim to limit processing to what is reasonably necessary for the requested service and to use contractual, security, and confidentiality controls appropriate to the processing.

Where a customer agreement or BAA imposes additional restrictions on the use or retention of protected health information, those contractual restrictions will control.

5. Data Retention and Deletion

We retain information for as long as reasonably necessary to provide the Services, maintain business and security records, comply with legal obligations, resolve disputes, enforce agreements, and otherwise fulfill the purposes described in this Privacy Policy. Retention periods may vary based on the type of information, the customer's configuration, and applicable contractual or legal requirements.

Customers may be able to delete or request deletion of certain audio, transcripts, or account data through the Services or by contacting support@scribing.io, subject to legal, security, backup, and contractual requirements.

6. Security

We maintain technical, administrative, and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction. Depending on the service and configuration, safeguards may include encryption in transit and at rest, access controls, authentication mechanisms, logging, monitoring, vulnerability management, and other security measures.

No system or method of transmission or storage can be guaranteed to be completely secure. In the event of a security incident or breach that triggers a legal or contractual notification obligation, we will provide notice as required by applicable law and applicable agreements.

7. International Data Transfers

Information may be processed in the United States and other countries where Scribing.io or its service providers operate. Where applicable law requires safeguards for international transfers, we use legally recognized transfer mechanisms and contractual protections appropriate to the transfer.

8. Your Rights and Choices

Depending on your location and the context in which we process your information, you may have rights to request access, correction, deletion, restriction, portability, or objection to certain processing, or to withdraw consent where consent is the applicable legal basis. Certain rights may be subject to legal exceptions or may be exercised through the healthcare organization or other customer that controls the relevant information.

To exercise a privacy right or ask a question about our processing practices, contact support@scribing.io. We may need to verify your identity and, where appropriate, coordinate with the applicable customer.

9. Children's Privacy

The Services are not intended for individuals under 18 years of age. We do not knowingly collect personal information directly from children under 18 through the Services. If you believe that a child has provided personal information to us, contact support@scribing.io so we can assess and address the issue.

10. Third-Party Links and Integrations

The Services may contain links to or integrations with third-party websites, EHRs, payment providers, or other services. Their privacy practices are governed by their own policies and terms. Scribing.io is not responsible for the privacy or security practices of third parties that we do not control.