Privacy Policy

This policy applies to:

• Practice administrators and staff who create and manage a SpecScribe account on behalf of a medical practice.
• Health care providers (clinicians) who use SpecScribe to document clinical encounters.
• Patients whose personal health information is processed through the platform as part of their provider's documentation workflow.

SpecScribe acts for the medical practice, which is responsible for its patients' health information, in the role its province's law defines: for example, an information manager under Alberta's HIA, an agent under Ontario's PHIPA, or a service provider under PIPEDA. The practice retains primary responsibility for PHI collected from patients. SpecScribe processes that PHI only as directed by and on behalf of the practice.

2.1 Account & User Information

When a practice creates an account, we collect: practice name, address, NPI number, specialty, and billing information. For individual users, we collect name, email address, role, professional credentials, and multi-factor authentication data.

2.2 Personal Health Information (PHI)

To provide the documentation service, we process the following PHI on behalf of the practice:

• Patient name, date of birth, health card number, and contact information
• Audio recordings of clinical encounters (only after the patient's consent is recorded in SpecScribe)
• Transcripts of clinical encounters
• Clinical notes, diagnoses, procedure codes, and treatment plans
• Insurance and billing information
• Prior authorization requests and correspondence

Patient identifiers, transcripts, notes and other clinical fields are encrypted using AES-256-GCM at the application layer before being written to our database. PHI values are not written to system logs; errors returned by EHR systems are reduced to machine-readable codes before logging.

2.3 Technical & Usage Data

We automatically collect IP addresses, browser type, session duration, and feature usage events for security monitoring and product improvement. This data does not include PHI.

We use personal information only for the purposes for which it was collected:

• Generating AI-assisted draft clinical notes for provider review
• Suggesting diagnosis codes (ICD-10-CA) and, for Alberta physicians, billing codes (AHCIP), and flagging possible under-coding for provider approval
• Drafting prior authorization requests at the direction of the provider
• Drafting plain-language patient handouts (English or French) for provider approval
• Monitoring documentation completeness and compliance requirements
• Providing account management, billing, and customer support
• Detecting and preventing unauthorized access or security incidents

AI outputs are always drafts. SpecScribe never auto-finalizes clinical notes, submits claims, or makes clinical decisions on behalf of a provider. All AI-generated content requires explicit provider review and approval before use.

We do not sell personal information, use PHI for advertising, or use customer data to train our AI models.

Application hosting: The SpecScribe application runs in Vercel's Montréal, Canada region (yul1). Requests that read or write PHI are processed there.

Storage: PHI is stored in Canada. The database and encrypted audio storage run in AWS ca-central-1 (Montréal).

AI processing: Notes, code suggestions, prior-authorization drafts, handouts and recaps are generated by Anthropic's Claude models through the Claude API. Anthropic processes this content in the United States, so it is transferred outside Canada for processing. Before content is sent, patient identifiers (name, health card number, phone, email, street address and dates) are removed, and the identified record stays stored in Canada. Anthropic does not use API content to train its models.

Speech-to-text: Audio is transcribed by Microsoft Azure AI Speech in its Canada Central region, where the audio is processed. Microsoft does not retain the audio or the transcript after transcription.

Enforcement: In production, SpecScribe checks the configured region of the application, speech-to-text and storage services before any transcription or storage of PHI, and refuses to proceed if any of them is outside Canada. AI processing, described above, is the one service outside Canada.

User account data: Authentication and user identity data (provider names, email addresses, and MFA credentials) is processed by Clerk Inc., a US-based authentication service provider. This data may be stored on servers outside Canada. Clerk processes user identity data only — no patient PHI is transmitted to Clerk. A Data Processing Agreement is in place with Clerk governing the handling of this data.

Billing: Payment and subscription data is processed by Stripe Inc. in the United States. No patient PHI is ever transmitted to Stripe.

PHI records are never hard-deleted within their retention period. When a practice deletes a patient, the record is removed from use immediately (soft-deleted) and its encrypted contents are permanently destroyed by an automated daily job once the retention period has passed: the later of 10 years after last contact or the patient's 25th birthday. Both steps are recorded in the audit log.

We implement the following safeguards, designed to support PIPEDA Principle 7 and the safeguard duties in provincial health-privacy laws:

• Encryption at rest: AES-256-GCM at the application layer for all PHI fields before database write
• Encryption in transit: TLS on all connections; HSTS enforced
• Access control: Role-based access (RBAC) within each practice; every query is scoped to the signed-in user's practice, so one practice cannot access another's data
• Multi-factor authentication: Required for every account before any PHI can be accessed
• Session management: 15-minute idle timeout; 24-hour absolute maximum session duration
• Audit logging: Every PHI read, write, and delete is logged with user ID, timestamp, IP address, and resource in a tamper-evident hash chain that is verified daily; failures trigger an alert. PHI values are never included in logs
• Consent: Audio cannot be recorded or transcribed until the patient's consent to recording and AI-assisted documentation is recorded

Patients do not interact with SpecScribe directly. Access, correction, and complaint requests are handled through the medical practice, which is responsible for the records, under the access and correction rights in its province's privacy law.

Practices can export patient notes from SpecScribe as PDF to fulfil a patient's right of access.

If a patient believes their health information has been mishandled, they may file a complaint with the applicable regulator:

• Federal / all provinces: Office of the Privacy Commissioner of Canada (OPC) — priv.gc.ca
• Alberta: Office of the Information and Privacy Commissioner of Alberta — oipc.ab.ca
• British Columbia: Office of the Information and Privacy Commissioner for British Columbia — oipc.bc.ca
• Manitoba: Manitoba Ombudsman — ombudsman.mb.ca
• New Brunswick: Ombud New Brunswick — ombudnb.ca
• Newfoundland and Labrador: Information and Privacy Commissioner of Newfoundland and Labrador — oipc.nl.ca
• Nova Scotia: Information and Privacy Commissioner for Nova Scotia — oipc.novascotia.ca
• Ontario: Information and Privacy Commissioner of Ontario — ipc.on.ca
• Prince Edward Island: Information and Privacy Commissioner of Prince Edward Island — assembly.pe.ca
• Québec: Commission d'accès à l'information du Québec — cai.gouv.qc.ca
• Saskatchewan: Information and Privacy Commissioner of Saskatchewan — oipc.sk.ca
• Northwest Territories: Information and Privacy Commissioner of the Northwest Territories — oipc-nt.ca
• Yukon: Yukon Information and Privacy Commissioner — yukonaccountability.ca

In the event of a privacy breach, SpecScribe will notify the affected practice without undue delay. The practice and SpecScribe will jointly assess whether the breach meets the notification threshold under applicable law:

• PIPEDA: Notify the OPC and affected individuals if there is a “real risk of significant harm”
• Provincial health-privacy laws set their own thresholds and timing. For example, Alberta's HIA requires notice to the OIPC, the Minister and the individual “as soon as practicable” where there is a risk of harm, and Ontario's PHIPA requires notice to the individual at the first reasonable opportunity after any theft, loss or unauthorized use or disclosure, and to the IPC in prescribed circumstances. Each practice's compliance page shows the rule for its province or territory.

We may update this policy to reflect changes in our practices or applicable law. Material changes will be communicated to practice administrators by email at least 30 days before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

Questions or concerns about this policy or how we handle personal information should be directed to: