CIP Privacy Policy

This Policy states how Scribe-X collects, uses, and protects information in connection with the Clinical Intelligence Platform. This Policy applies to Scribe-X’s healthcare organization customers and their authorized users. Patient health information is governed by the provider’s notice of privacy practices, HIPAA, and the Business Associate Agreement between Scribe-X and the provider organization.

1. Information Scribe-X Processes

(a) Patient encounter data. Encounter audio, transcripts, and clinical documentation Scribe-X processes on a customer’s behalf. Patient encounter data is protected health information and is handled solely in Scribe-X’s capacity as a business associate under HIPAA and the Business Associate Agreement.

(b) Account and user data. Names, work contact details, credentials, and roles of authorized platform users.

(c) Usage and technical data. Log, device, and usage information generated by the Platform and used for security, support, and operation.

2. Use of Information

Scribe-X uses information solely to provide the Services a customer has purchased, including operating, securing, supporting, and improving the Services, meeting legal and contractual obligations, and communicating with authorized users, and for no other purpose. Scribe-X does not sell personal information and does not use customer data for advertising. Scribe-X does not use customer data to train, fine-tune, or otherwise develop any artificial intelligence or machine learning model, and does not de-identify protected health information. Documentation output is tailored to an individual healthcare provider through configuration and structured context, as the Responsible AI Use Policy describes.

3. Disclosure of Information

Information is shared only with the customer organization to which it belongs, with subprocessors bound by written agreements consistent with Scribe-X’s obligations, and where required by applicable law. Aggregated statistics used to operate and improve the Services contain no protected health information and identify no customer, user, or patient.

4. Retention and Security

Retention periods and security controls are stated in the Data Handling and Security Schedule at scribe-x.com/legal/data-handling, which is the authoritative statement of both. In the event of a security incident affecting Customer data, Scribe-X will notify Customer as required by HIPAA, the applicable Business Associate Agreement, and the Data Handling and Security Schedule.

5. Customer Requests

An authorized user may review and correct account information through the customer’s administrator or by contacting Scribe-X at privacy@scribe-x.com. Customers may request export of their data or submit inquiries regarding data deletion by contacting Scribe-X at privacy@scribe-x.com. Retention periods, portability options, and deletion procedures are described in the Data Handling and Security Schedule at scribe-x.com/legal/data-handling. A patient should direct a request about a medical record to the healthcare provider that maintains it. Questions about this Policy or Scribe-X's privacy practices may be directed to privacy@scribe-x.com.

6. Changes to This Policy

Scribe-X may update this document with prior written notice to customers. No update will materially reduce the protections or service scope applicable to a customer during a committed term. If an update materially and adversely affects a customer, that customer may request a revision as it applies to that customer, either as a reversion to a prior version acceptable to the customer or as an adjustment to customer-specific policy language requirements, and Scribe-X will consider each request on a case-by-case basis. Prior versions are archived and available at the dated URL for the version in effect on any given date.