Security

HIPAA and BAAs

• We operate as a HIPAA Business Associate and provide BAAs to clinician customers.
• We maintain a BAA with our cloud infrastructure providers for the infrastructure used to store and process data.
• If/when we use additional AI providers, we require appropriate contractual protections (including a BAA where applicable) before processing PHI with that provider.

Encryption

• In transit: TLS for communications between your device and our services.
• At rest: encrypted storage for session data.

Access controls

• Only you can access your sessions in the app.
• Administrative access is restricted and audited.
• Support access to session content is rare and permitted only upon explicit customer request for troubleshooting; such access is logged.

Logging and audit

• We are designed to avoid PHI content in logs and analytics.
• We maintain audit logs of administrative actions and access events.

Transcription and note generation

• We may process transcript text with AI providers to generate clinical notes.
• We configure AI processing to prohibit training on your data and to minimize retention by the provider where available.
• Outputs must be reviewed by the clinician and may be inaccurate.

Data lifecycle

1. Record session audio in the app
2. Transcription produces text
3. Notes are generated from the transcript
4. Audio auto-deletes after ~3 days
5. You can delete sessions at any time (primary deletion is immediate; backups expire within up to ~7 days)

Subprocessors

We use the following third-party subprocessors to provide the Service:

Questions