Data Handling and Security Schedule

1. Definitions

1.1 “Agreement” means the written agreement between Scribe-X and Customer under which Scribe-X provides the Services, together with each Order Form, addendum, exhibit, and business associate agreement entered into under it, and each document incorporated into it by reference, including this Schedule.

1.2 “Live Services” means Scribe-X’s core live scribe Services, under which a Remote Medical Scribe documents a patient encounter contemporaneously with the encounter, working directly in Customer’s electronic health record.

1.3 “Remote Medical Scribe” means a trained member of Scribe-X’s workforce who documents a patient encounter, working exclusively off-site through the Platform. A Remote Medical Scribe performing that work asynchronously rather than during the encounter is a “Remote Healthcare Assistant
” The two terms describe the same trained workforce, holding the same qualifications and completing the same training, and are distinguished by when the work is performed rather than by who performs it.

1.4 “Subscription Solutions” means the Assist Solution and the Solo Solution. Under both, adaptive automation drafts documentation from the captured patient encounter.

1.5 “Encounter Data” means encounter audio, transcripts, and draft and delivered documentation generated in the course of documenting a patient encounter.

1.6 “Encounter Capture” means the recording and transmission of encounter audio through the Platform in connection with the Subscription Solutions.

1.7 “Provider Context” means the templates, stated preferences, and configuration that tailor an individual Healthcare Provider’s documentation output.

1.8 “Protected Health Information” or “PHI” has the meaning given in 45 C.F.R. 160.103.

1.9 “Personal Information” means information that identifies or reasonably can be linked to an individual and that is not PHI, including Healthcare Provider and administrator account records and Platform activity attributable to a named user.

1.10 “Sensitive Personal Information” means the subset of Personal Information that receives heightened protection under applicable state law, including biometric identifiers.

1.11 “Operational Data” means activity, efficiency, and quality information generated by the Platform that does not contain PHI or Personal Information.

1.12 “Minimization” means the automated removal and redaction of PHI and Personal Information from operational logs before those logs are emitted. Minimization is an engineering control applied at the point of logging. Minimization is not de-identification under 45 C.F.R. 164.514, and Scribe-X does not represent minimized data as de-identified information.

1.13 “Portability Window” means the ninety (90) day period following termination or expiration of the applicable Agreement, during which Customer may export its data before deletion.

2. Data Handling Model

2.1 Categories of Data. Retention under this Schedule is determined by the category of data rather than by the point in the workflow at which the data is created or held. The categories are: (a) Protected Health Information; (b) Personal Information; and (c) Sensitive Personal Information. Where a Service does not create data within a category, no retention period under this Schedule applies to that Service with respect to that category. Operational Data is not within any of the foregoing categories and is addressed in Section 3.4 below. Where a retention period is measured by the duration of the applicable Agreement, that period runs until the applicable Agreement terminates or expires, without regard to the term of any Order Form entered into under it.

2.2 Live Services. Under the Live Services, the encounter connection is ephemeral. Encounter audio and encounter video are transmitted through the connection, and Scribe-X does not record or store either. Documentation is created in real time directly in Customer’s electronic health record, and Scribe-X retains no copy. Scribe-X retains connection metadata that contains no PHI, consisting of session duration and participant identity.

2.3 Subscription Solutions. Under the Subscription Solutions, documentation is prepared asynchronously. Encounter Capture records encounter audio only, and Scribe-X does not record or store encounter video. Encounter audio, transcripts, and draft and delivered documentation persist from the encounter forward and are retained as stated in Section 3.

2.4 Basis for Retention. Encounter Data is retained for the duration of the applicable Agreement because the Subscription Solutions operate across a Healthcare Provider’s record rather than on a single encounter. Retained Encounter Data supports a Healthcare Provider’s access to prior encounters Scribe-X documented for that Healthcare Provider, the tailoring of documentation output through that Healthcare Provider’s own edits and stated preferences as described in Section 7, reconciliation of a documentation entry against its source recording as described in Section 3, and Customer’s export of its data. Additional capabilities that operate across a Healthcare Provider’s record, including chart preparation, chart review, documentation quality and revenue review, and inbox management, are made available only as stated in the Product Terms. When made available, a capability may operate on retained Encounter Data, on information synchronized from Customer’s electronic health record for that purpose, or both, in each case as stated in the Product Terms and, where applicable, this Schedule.

2.5 System of Record. All documentation produced through the Platform is draft documentation until a Healthcare Provider reviews and signs it. Customer’s electronic health record is the system of record, and Customer and its Healthcare Providers are solely responsible for reviewing the accuracy and completeness of all documentation before any clinical, billing, coding, or other use.

2.6 New Solutions and Capability Layers. A Subscription Solution, intelligence layer, or add-on capability first published after the effective date of this Schedule is governed by the version of this Schedule in effect when Customer elects it.

3. Retention and Deletion

3.1 Protected Health Information

Encounter audio is retained alongside the transcript generated from it, and a documentation entry may be reconciled against the source recording for as long as both are retained.

Live Services. Scribe-X creates and retains no Protected Health Information in the categories above in connection with the Live Services, other than session messaging.

3.2 Personal Information

3.3 Sensitive Personal Information

Where encounter audio is processed to distinguish one speaker from another, the only result recorded is a text label applied to speech within the transcript for that encounter. A speaker label identifies no individual and has no meaning outside the encounter in which it is recorded. Scribe-X does not create or retain a voice template, voiceprint, or other biometric representation, whether as a separate artifact or within any retained record, does not use speaker data to identify an individual, and does not match a speaker across encounters. The Platform accordingly does not create or store a biometric identifier.

Encounter audio is retained as stated in Section 3.1 and is subject to the safeguards stated in Section 6.

3.4 Operational Data

Minimization is applied to remove PHI and Personal Information before operational logs are emitted. Operational Data is retained as operationally required and is not subject to the periods stated above.

3.5 Portability Window and Deletion

On termination or expiration of the applicable Agreement, Customer may export its data for ninety (90) days. Scribe-X will make export available in a machine-readable format on written request. At the end of the Portability Window, Scribe-X deletes the data in accordance with Section 3.6, except where retention is required by law. A Portability Window of a different length applies where the applicable Agreement states one.

3.6 Deletion and Disposal

Deletion is performed by automated process on a defined schedule. Data in backups is deleted on the backup cycle then in effect and is not restored to production after the Portability Window closes. Media and storage are disposed of in accordance with Scribe-X’s media handling procedures.

4. Traceability

Documentation produced under the Subscription Solutions may be traced to the transcript and the encounter audio from which it was generated for as long as those artifacts are retained under Section 3.1.

Documentation is draft documentation until a Healthcare Provider reviews and signs it. On signature, the record in Customer’s electronic health record is the authoritative account of the encounter. Traceability supports review of how a draft was produced and does not displace the signed record.

The Live Services produce no transcript and no audio, and documentation created under the Live Services has no source artifact to trace to.

5. Location and Access

Customer data is stored and processed in the United States and is handled by United States-based teams. The Platform is cloud-hosted on Amazon Web Services. Customer data is logically separated by tenant. Access is role-based, least-privilege, and limited to personnel who require it to deliver the Services, in each case under workforce confidentiality obligations. Access to retained Encounter Data is limited to authorized personnel with operational responsibility for it. Staffing is entirely onshore.

6. Security Controls

Scribe-X encrypts data at rest using AES 256-bit encryption, media streams using AES 128-bit encryption, data in transit using TLS, and real-time media using DTLS/SRTP. Access controls are role-based and least-privilege, with unique credentials, cryptographically hashed passwords, and multi-factor authentication required for administrative access. Customer data is logically separated by tenant, and identifiable data is neither shared across customers nor used outside the Services provided to the customer from which it originated. Scribe-X applies automated Minimization and redaction controls to PHI and Personal Information before operational logs are emitted. Scribe-X maintains intrusion detection, file integrity monitoring, log monitoring, and access and system activity logging, and makes access audit logs available to Customer administrators. Scribe-X conducts vulnerability scanning, penetration testing, and third-party risk assessment on a regular cycle, applies security patches under continuous monitoring, and requires background checks and HIPAA training for personnel with access to Protected Health Information. Access is provisioned and deprovisioned promptly upon a change in role or status.

7. Model Training

Scribe-X does not use Customer data to train, fine-tune, or otherwise develop the weights or parameters of any artificial intelligence or machine learning model. The foregoing restriction applies to encounter audio, transcripts, draft and delivered documentation, Healthcare Provider edits, and every other artifact generated in the course of providing the Services, whether or not that artifact has been subject to Minimization.

Scribe-X does not maintain evaluation, regression, or test datasets composed of Customer encounter content.

Scribe-X tailors documentation output to an individual Healthcare Provider through configuration and structured context derived from that Healthcare Provider’s own edits and stated preferences. That tailoring does not train or modify any model. Nothing derived from one Healthcare Provider’s encounters influences documentation produced for any other Healthcare Provider or for any other customer.

Scribe-X requires each subprocessor that processes Customer data to be contractually prohibited from using that data to train or improve its own models.

8. Incident Response

Scribe-X maintains a documented incident response plan with defined severity levels, escalation paths, and post-incident review. Scribe-X will notify Customer of any incident affecting Customer data without unreasonable delay and within the timelines required by HIPAA and by the applicable Agreement and will cooperate with Customer through investigation and remediation.

9. Subprocessors

A limited set of subprocessors supports the Platform. Scribe-X requires each subprocessor with access to Customer data to enter into a written agreement imposing obligations consistent with this Schedule and, where the subprocessor handles Protected Health Information, with business associate obligations. Scribe-X will provide the current subprocessor list to Customer on request and will not engage a new subprocessor with access to Protected Health Information without imposing those obligations.

10. Exceptions

An exception to this Schedule must be documented, approved by Scribe-X management and by the Information Security Officer, time-bound, and periodically reviewed.

11. Review and Changes

11.1 Review. The Information Security Officer is responsible for oversight of this Schedule and the retention practices it states. Scribe-X reviews this Schedule periodically, upon a material change to business operations, upon a change to data handling or retention practices, and following a significant security or operational incident. Questions regarding this Schedule or Scribe-X’s information security program may be directed to the Information Security Officer at privacy@scribe-x.com.

11.2 Changes. Scribe-X may update this document with prior written notice to the customer. No update will materially reduce the protections or service scope applicable to a customer during a committed term. If an update materially and adversely affects a customer, that customer may request a revision as it applies to that customer, either as a reversion to a prior version acceptable to the customer or as an adjustment to customer-specific policy language requirements, and Scribe-X will consider each request on a case-by-case basis. Prior versions are archived and available at the dated URL for the version in effect on any given date.