Responsible AI Use Policy

This Responsible AI Use Policy describes how Scribe-X, LLC ("Scribe-X") uses and governs artificial intelligence within the Scribe-X Clinical Intelligence Platform, including the role of human review, the use of Customer Data, and the responsibilities of Scribe-X and its customers. This Policy is incorporated by reference into each agreement that references it. Capitalized terms not defined in this Policy have the meanings given in the applicable agreement.

1. Purpose and Scope

1.1 Purpose. This Policy describes the principles and controls Scribe-X applies when developing, deploying, and monitoring AI-enabled features of the Platform. It also explains the intended role and known limitations of those features and the safeguards applicable to their use.

1.2 Covered Services. This Policy applies to AI-enabled features included in the Services purchased by Customer under an applicable Order Form, Statement of Work, or other ordering document (each, a "Solution"). It does not expand the features or Services Customer has purchased or create any entitlement to features identified as planned, under development, or otherwise not included in the applicable ordering document.

1.3 AI Output. "AI Output" means draft documentation or other content produced by an AI-enabled feature of the Platform.

1.4 Relationship to Other Agreements. Customer Data, including Protected Health Information, remains subject to the applicable agreement, Business Associate Agreement, and Data Handling and Security Schedule. The Business Associate Agreement controls in the event of a conflict concerning Protected Health Information. The Data Handling and Security Schedule governs data retention, deletion, location, access, and security controls. Customer and its Authorized Users are also subject to Scribe-X's Acceptable Use Policy.

2. Role of AI in the Services

2.1 Intended Function. AI-enabled features of the Platform assist in preparing clinical documentation from information captured during a patient encounter. Depending on the Solution purchased by Customer, those features may generate draft notes and other draft documentation components identified in the applicable ordering document. Scribe-X does not represent that AI Output is complete, error-free, or appropriate for use without the required human review.

2.2 Service Models. The role of AI and Scribe-X personnel differs by Solution:

• Live. A trained Remote Medical Scribe documents the patient encounter in real time directly in Customer's electronic health record. Live does not use the encounter-capture workflow used by the Subscription Solutions to generate draft documentation.

• Assist. AI-enabled features generate draft documentation from the captured patient encounter. A trained Remote Healthcare Assistant reviews and completes the draft before Scribe-X delivers it to Customer.

• Solo. AI-enabled features generate draft documentation from the captured patient encounter. Scribe-X personnel do not review or complete the draft before delivery; Customer's Healthcare Provider is responsible for reviewing and finalizing it.

2.3 No Autonomous Clinical Decisions. The Platform is a clinical documentation tool. Depending on the Solution, AI-enabled features may generate suggested diagnostic codes, proposed orders, and other documentation components for review and approval by a qualified Healthcare Provider. The Platform is not authorized to make autonomous clinical, coding, or billing decisions or to replace the professional judgment of a qualified Healthcare Provider. All AI Output requires Healthcare Provider review under Section 3 before it is treated as final or relied upon for any purpose.

2.4 Draft Status. Documentation produced through an AI-enabled feature remains draft documentation until a Healthcare Provider reviews, revises as appropriate, and signs it. The signed documentation maintained in Customer's electronic health record is the authoritative medical record.

3. Human Oversight and Clinical Responsibility

3.1 Required Provider Review. Customer will ensure that a qualified Healthcare Provider reviews each AI Output for accuracy, completeness, clinical appropriateness, and consistency with the applicable patient encounter. The Healthcare Provider must make any necessary corrections and approve or sign the documentation before treating it as final or relying on it for clinical care, coding, billing, patient communications, or any other purpose.

3.2 Scope of Review. Provider review must include any draft note and, when included in the applicable Solution, any draft order, code, after-visit material, or other documentation component produced through the Platform. The Healthcare Provider should not assume that an AI Output includes every clinically relevant fact or accurately reflects every statement made during the encounter.

3.3 Scribe-X Personnel Review. Review or completion by a Remote Medical Scribe or Remote Healthcare Assistant is a documentation-quality control and does not replace review by the Healthcare Provider. Scribe-X personnel do not make clinical decisions or approve the final medical record on the Healthcare Provider's behalf.

3.4 Professional Responsibility. The Healthcare Provider remains responsible for exercising independent professional judgment and for all diagnoses, treatment decisions, orders, prescriptions, coding and billing determinations, and other clinical or professional actions taken in reliance on documentation produced through the Platform. The allocation of clinical responsibility in this Section does not limit Scribe-X's obligation to perform the Services in accordance with the applicable agreement.

4. AI Development and Governance

4.1 Governance Program. Scribe-X maintains a risk-based governance program for AI-enabled features of the Platform. Scribe-X involves appropriate personnel in the oversight of AI-enabled features based on the nature and potential impact of the feature under review.

4.2 Intended Use Review. Scribe-X evaluates AI-enabled features, including when initially deploying a feature or materially expanding its intended use, for the feature's intended purpose, foreseeable limitations and misuse, required human oversight, data-protection implications, and potential effects on documentation quality and patient care. The scope of that evaluation is proportionate to the nature and risk of the feature.

4.3 Development Controls. Scribe-X develops and configures AI-enabled features for defined documentation functions and evaluates them against criteria appropriate to those functions. Scribe-X applies change-management controls to the release of new features and material changes to existing features, including testing and review through Scribe-X's applicable change-management process.

4.4 Third-Party AI Components. Before using a third-party model or other AI component to process Customer Data, Scribe-X evaluates the provider and the proposed use of the component for security, privacy, performance, and contractual risk. Any provider that processes Protected Health Information on Scribe-X's behalf is treated as a subprocessor and must be subject to the protections described in the applicable Business Associate Agreement and Data Handling and Security Schedule.

4.5 Continuing Oversight. Scribe-X reviews its AI-governance practices periodically and when warranted by a material change to the Platform, applicable law, identified risk, or significant quality or security event.

5. Data Use and Model Training

5.1 Processing Customer Data. Scribe-X processes Customer Data through AI-enabled features only as permitted by the applicable agreement and Business Associate Agreement, including to provide, secure, support, and evaluate the Services for Customer. Processing Customer Data to generate AI Output does not, by itself, train or fine-tune an AI model.

5.2 No Training on Customer Data. Scribe-X does not use Customer Data — including encounter audio, transcripts, draft and delivered documentation, Healthcare Provider edits, or any other artifact generated in the course of providing the Services — to train, fine-tune, or otherwise develop the weights or parameters of any artificial intelligence or machine learning model. The foregoing restriction applies whether or not Customer Data has been subject to automated minimization or redaction controls. Scribe-X may use Customer Data to evaluate output quality, investigate reported errors, provide support, and configure the Services for Customer, in each case as permitted by the applicable agreement and Business Associate Agreement.

5.3 Provider Context. Templates, documented preferences, corrections, and other configuration associated with a Healthcare Provider may be used as Provider Context to tailor that Healthcare Provider's documentation. Provider Context is customer-specific configuration and is not used to train or fine-tune model weights for use by other customers.

5.4 Third-Party Model Providers. Scribe-X does not authorize a third-party model or AI-service provider to retain Customer Data or use it to train or improve models for itself or any third party. Any permitted processing by such a provider must be limited to providing services to Scribe-X and remain subject to the applicable contractual, privacy, and security protections.

6. Testing, Monitoring, and Material Changes

6.1 Evaluation Before Release. Scribe-X evaluates AI-enabled features for production use against documented criteria appropriate to their intended function. Evaluation may address factual accuracy, completeness, unsupported content, material omissions, formatting, and performance across the specialties, languages, and care settings for which the feature is intended to be used. Production release is subject to review through Scribe-X's applicable change-management process.

6.2 Production Monitoring. Scribe-X monitors AI Output through periodic, risk-based sampling and review. Monitoring may include documentation-quality measures, reported errors, provider corrections, operational performance, and trends identified at the provider, customer, or service level. Sampling does not constitute review of every AI Output.

6.3 Updates and Regression Evaluation. Scribe-X may update models, prompts, configurations, and related components to maintain or improve the Services. For material updates, Scribe-X performs testing appropriate to the nature of the change, including regression evaluation against relevant documentation-quality criteria, as part of its applicable change-management process.

6.4 Material Changes. Routine updates that do not materially change an AI-enabled feature's intended use, human-review model, Customer Data practices, or disclosed limitations do not require customer notice. Scribe-X will provide notice consistent with the applicable agreement before implementing a change that materially alters any of those matters, except when an earlier change is reasonably necessary to address an urgent security, safety, legal, or regulatory issue. In that event, Scribe-X will provide notice as soon as reasonably practicable.

6.5 Corrective Action. If monitoring, testing, or a reported issue identifies a significant quality, safety, privacy, or security concern, Scribe-X will evaluate the concern and take action reasonably appropriate to its nature and severity. Corrective action may include adjusting configuration, increasing review, correcting or delaying an update, restricting affected functionality, or suspending the affected feature while the concern is addressed.

7. Accuracy, Bias, and Known Limitations

7.1 Potential Errors. AI Output may contain inaccurate, incomplete, inconsistent, or unsupported information. It may omit information from an encounter, attribute information to the wrong speaker, misunderstand clinical terminology, or generate content not supported by the encounter. Human review remains necessary even when an AI-enabled feature has performed reliably in prior encounters.

7.2 Factors Affecting Performance. Performance may vary based on factors including specialty, encounter complexity, audio quality, background noise, overlapping speech, speaker differentiation, accents, language, use of an interpreter, and the completeness and accuracy of information available to the Platform.

7.3 Supported Uses. Scribe-X evaluates AI-enabled features for the languages, care settings, and documentation functions identified as supported in the applicable product documentation or ordering document. Customer should not assume that a feature has been evaluated or is suitable for a language, setting, or use case that Scribe-X has not identified as supported.

7.4 Bias and Performance Variation. Scribe-X does not represent that an AI-enabled feature is free from bias or that it will perform identically across all individuals or populations.

7.5 Performance Metrics. An accuracy or quality measure is meaningful only when considered with the applicable evaluation criteria, sample, use case, and population. Unless expressly stated in the applicable agreement, Scribe-X does not guarantee a particular accuracy percentage or error rate. When available for the purchased Solution, Scribe-X may provide Customer with account-specific quality or performance reporting.

8. Transparency, Traceability, and Error Reporting

8.1 Solution Transparency. Scribe-X identifies the role of AI and the applicable human-review model for each Solution in this Policy and the applicable product or ordering documentation. Scribe-X will not describe AI Output as having received review by Scribe-X personnel when the applicable Solution does not include that review.

8.2 Source Traceability. The availability of source audio, transcripts, draft documentation, and related Encounter Data is governed by the retention periods in the Data Handling and Security Schedule. Traceability to source materials ends when those materials are deleted in accordance with that Schedule. For Live Services, documentation is created directly in Customer's electronic health record and no source audio or transcript is retained, as described in the Data Handling and Security Schedule.

8.3 Operational Traceability. Subject to the retention periods in the Data Handling and Security Schedule, Scribe-X maintains operational records reasonably appropriate to support investigation of significant reported issues involving AI Output. The records available for a particular issue depend on the Solution, configuration, data retained, and time elapsed since the applicable encounter.

8.4 Reporting Concerns. Customer and its Authorized Users may report a suspected documentation error or concern regarding AI behavior through Scribe-X's approved support channel or at privacy@scribe-x.com. Reports should be made promptly and include information reasonably sufficient to identify the affected output without transmitting Protected Health Information through an unauthorized channel.

8.5 Investigation. Scribe-X will review reported concerns and, where warranted, evaluate them using the source materials, operational records, and other information then reasonably available. Because applicable retention periods vary by category as stated in the Data Handling and Security Schedule, Scribe-X may be unable to reconstruct or fully investigate an issue reported after relevant source materials have been deleted. Submitting a report does not extend an applicable retention period unless Scribe-X confirms that relevant materials will be preserved.

8.6 Correction and Follow-Up. When appropriate, Scribe-X will communicate material findings to Customer and may use those findings to correct draft documentation, adjust Provider Context or other configuration, improve testing or monitoring, or take corrective action under Section 6.5. Customer and its Healthcare Providers remain responsible for making any necessary correction to a signed medical record in accordance with Customer's policies and applicable law.

9. Customer Responsibilities

9.1 Governance and Training. Customer will establish procedures appropriate to its use of the Platform and ensure that Authorized Users receive instruction concerning the role and limitations of AI-enabled features, required provider review, patient notice and consent, error reporting, and the handling of Protected Health Information.

9.2 Provider Review. Customer will maintain a workflow requiring the review described in Section 3 before AI Output is treated as final or relied upon for clinical care, coding, billing, patient communications, or any other purpose. Customer will not use AI Output as a substitute for the independent professional judgment of a qualified Healthcare Provider.

9.3 Patient Notice and Consent. Customer is responsible for providing patient notices and obtaining and documenting any consent or authorization required for Customer's use of encounter capture (including any consent required under applicable recording or wiretapping laws), AI-assisted documentation, or Protected Health Information. Scribe-X has no means to act on a revocation of authorization mid-encounter, and information already captured in a session is not separately removed on revocation. Where a patient withdraws or withholds consent to recording, Customer will not initiate a new encounter capture session for that patient and will ensure that AI Output from any session conducted without required consent is not used or documented in the patient's medical record. This Section does not limit any obligation imposed directly on Scribe-X by applicable law.

9.4 Customer Instructions and Configuration. Customer is responsible for the accuracy and appropriateness of the templates, preferences, instructions, and other information it supplies to configure the Services. Customer will not configure or instruct the Platform to perform a function outside the intended use of the applicable Solution or in a manner that violates applicable law or the applicable agreement.

9.5 Supported Use and Safeguards. Customer and its Authorized Users will use AI-enabled features only for supported purposes and in accordance with applicable product documentation. They will not circumvent or interfere with a technical or operational safeguard intended to support security, privacy, human review, or compliance.

9.6 Prompt Reporting. Customer will promptly report a suspected material error, recurring quality concern, unauthorized use, or other AI-related issue through an approved channel. Customer will reasonably cooperate with Scribe-X's investigation and remediation, including by providing relevant information that Customer may lawfully disclose.

9.7 Acceptable Use Policy. Customer's and its Authorized Users' use of AI-enabled features remains subject to Scribe-X's Acceptable Use Policy and the applicable agreement.

10. Policy Administration and Changes

10.1 Administration and Review. Scribe-X is responsible for administering this Policy and reviews it periodically. Scribe-X also reviews the Policy following a material change to the Platform or its data practices, a significant AI-related quality, safety, privacy, or security event, or a material change in applicable law.

10.2 Policy Updates. Scribe-X may update this Policy from time to time. Scribe-X will identify the effective date and version of each update. A nonmaterial update, including a clarification, correction, or administrative change, may become effective when posted.

10.3 Material Updates. Scribe-X will provide Customer with written notice of a material update. During Customer's committed subscription term, an update will not materially reduce Scribe-X's commitments concerning human oversight, privacy, security, or the use of Customer Data, materially expand Scribe-X's right to use Customer Data for model training, or materially alter the human-review model applicable to a purchased Solution without Customer's written agreement.

10.4 Urgent Changes. Notwithstanding Section 10.3, Scribe-X may make an earlier change reasonably necessary to comply with applicable law or address an urgent safety or security issue. Scribe-X will notify affected customers of such a change as soon as reasonably practicable. This exception does not permit Scribe-X to expand its right to use Customer Data for model training unless required by applicable law or agreed by Customer in writing.

10.5 Prior Versions and Questions. Scribe-X maintains prior versions of this Policy at the dated URL applicable to each version. Questions regarding this Policy or Scribe-X's use of AI may be directed to privacy@scribe-x.com.