SpecScribe stores and processes patient information with the controls described on this page: application servers and patient-record storage pinned to Canadian regions, AI drafting on the Claude API in the United States with known identifiers removed first, patient records encrypted with AES-256-GCM before they're saved, required multi-factor sign-in, role-based access inside each clinic, and an audit log of access to patient records.
This page is written for clinic privacy officers. It describes how the product works today, including the parts that depend on a vendor's own configuration.
"Enforced by the app" means SpecScribe refuses to send patient data to that service when it isn't configured for a Canadian region, and the request fails instead. "Per vendor configuration" means the location depends on the vendor's own settings, which the app doesn't check.
| Service | Purpose | Data | Region | How the region is set |
|---|---|---|---|---|
| Vercel | Hosts the app, its server functions and scheduled jobs | Data in transit while a request is handled; application logs | Server functions: Montréal (yul1) | Enforced by the app for patient-data routes. Edge network and log storage: per vendor configuration. {{TODO: confirm Vercel log storage region and any log drain}} |
| PostgreSQL database | System of record | Patient records, transcripts and notes (encrypted fields below), audit log | {{TODO: confirm database provider and region}} | Checked and reported by the app's health check; not enforced |
| Amazon S3 | Session audio and imported PDFs of prior notes | Audio recordings; scanned prior notes | Canadian AWS region | Enforced by the app |
| Anthropic Claude API | Drafting notes, codes, handouts, prior-auth text and recaps | Clinical text with known identifiers removed | United States | Outside Canada by design; identifiers are removed before sending |
| Speech-to-text (Microsoft Azure AI Speech, Canada Central) | Transcribing visit audio | Session audio (identifiers can't be removed from audio) | Canada | The app checks that the endpoint is in a Canadian Azure region before sending audio; Microsoft doesn't retain the audio or transcript |
| Redis queue | Retrying note write-backs to a connected EHR | Record IDs, a hashed patient ID and error text; no note content | {{TODO: confirm Redis provider and region}} | Per vendor configuration |
| Your EHR (beta connections) | Chart context in, signed notes back, when connected | Signed notes, problem list, medications | Set by your EHR vendor | Per vendor configuration |
| Clerk | Clinician sign-in and multi-factor authentication | Staff names, emails and sign-in data; no patient records | United States | Per vendor configuration |
| Cloudflare Turnstile (through Clerk) | Bot check on sign-in and sign-up | Browser signals | Global | Per vendor configuration |
| Stripe | Subscription billing | Clinic billing contact and payment details; no patient records | United States | Per vendor configuration |
| Slack | Internal notifications for website demo requests, chat leads and security alerts | Visitor name, email and practice; alert codes and IDs; no patient records | United States | Per vendor configuration |
Under the data agreement each practice signs at onboarding, we give the clinic at least 30 days' notice of a material change to subprocessors; in Yukon, where the law requires it, we ask for the clinic's written consent first.
SpecScribe encrypts patient information with AES-256-GCM in the application, before it's written to the database, so the database only holds ciphertext for these fields. Each value gets its own random initialization vector, and keys are versioned so they can be rotated and old records re-encrypted.
- Patient name, date of birth, health number, phone, email, address and insurance details.
- Session transcripts, AI-drafted notes, your edited notes and template sections.
- Patient handouts, the rationale behind each billing-code suggestion, and prior-authorization clinical text.
- Session audio in S3 uses server-side encryption (AWS KMS where configured, otherwise S3-managed AES-256).
- Traffic uses HTTPS, with HSTS telling browsers to refuse plain HTTP.
Not encrypted at the application layer: billing-code values and descriptions, payer names on prior-auth requests, patient sex, and audit-log entries, which hold IDs and actions rather than clinical content. The encryption key is derived from a secret held in the hosting provider's encrypted environment settings.
Every clinic's data is kept separate: each database query is scoped to the signed-in user's practice. Inside a practice, what you can see depends on your role.
| Role | Encounters | Transcripts | Notes and codes |
|---|---|---|---|
| Provider | Only encounters where they are the provider | Yes | Yes |
| Admin | Every encounter in the practice | Yes | Yes |
| Biller | Every encounter in the practice | No | Yes |
| Staff | Schedule and status of every encounter | No | No |
Only the encounter's own provider can sign its note. SpecScribe platform-support accounts can read encounter records to help with support requests, but not raw transcripts, and that access is logged like any other.
- Multi-factor authentication is required for every account before it can reach patient data.
- Sessions end after 15 minutes of inactivity and after 24 hours regardless of activity.
- Billing, checkout and the data agreement are restricted to practice admins.
Views and changes of patient records and notes are written to an audit log with the user, role, time, IP address, action and record ID. The log records which fields were touched, never their values.
Each practice's log is hash-chained, so a missing or altered entry breaks the chain, and a daily job verifies the chains. The database refuses updates, deletions and truncation of audit rows, and a daily scan looks for unusual access patterns. {{TODO: confirm the daily off-host audit export (AUDIT_EXPORT_BUCKET) is configured in production}}
- Transcription won't start until the patient's consent to recording and AI-assisted documentation is recorded.
- Before text goes to the AI model, the patient's name, health number, phone, email, street address and dates are removed. This reduces what's sent; it isn't full de-identification, and other details mentioned in the visit can remain.
- Audio can't be redacted. It's sent only to Canadian storage and the Canadian speech-to-text endpoint.
- Audio is deleted when you sign the note. Audio for unsigned encounters is purged after 30 days by default.
- In British Columbia, Nova Scotia and Québec, audio isn't stored at all: it goes to speech-to-text and is discarded. In Nova Scotia and Québec, once your practice accepts its agreement, the transcript and the AI draft are also destroyed when you sign, and in any case within 7 days or 48 hours of being recorded or drafted, unless your administrator turns that limit off.
- Nothing becomes part of the record until a clinician reviews and signs it.
Deleting a patient removes them and their encounters from every view and from AI context straight away, and deletes any remaining audio. Clinical records are then kept for the retention period: the later of 10 years after the last contact or the patient's 25th birthday. After that, a daily job overwrites the patient's encrypted demographics, notes, handouts and billing-code rationale.
The retention purge doesn't yet cover prior-authorization requests, consent records or imported PDFs of prior notes, and audit-log entries are kept permanently. {{TODO: state database backup retention period and region}}
Report a suspected vulnerability or privacy incident to privacy@specscribe.ca. Our security contact details are also published at /.well-known/security.txt.
Under the data agreement, we notify your clinic without delay, and in any case within 24 hours, of discovering an actual or suspected breach of health information, so you can meet your own notification duties under your province's law.
Yes. Session audio is stored in a Canadian AWS region, and the app enforces it. AI drafting runs on the Claude API in the United States, after the patient's name and other known identifiers are removed. The database region is listed in the subprocessor table. Some services, such as sign-in (Clerk) and billing (Stripe), are in the United States and don't receive patient records.
SpecScribe doesn't use your data to train models. AI drafting runs on the Claude API, Anthropic doesn't use API content to train its models, and the data agreement states that prompts are not used for model training.
Yes. Every practice signs one during onboarding, framed by its province's privacy law: in Alberta, an Information Manager Agreement under section 66 of the Health Information Act; in Ontario, an agent agreement under PHIPA; and where no provincial health statute covers the practice, a service agreement under PIPEDA or the provincial private-sector act. Have your own counsel review it.
Platform-support accounts can read encounter records to help with support requests, but not raw session transcripts, and that access is audit-logged.
No, not yet. We can walk your privacy officer through the controls on this page in detail.
No product can do that on its own. Your clinic keeps its obligations; SpecScribe provides the mechanisms described here to support them. General information, not legal advice.
This page describes how SpecScribe works; it is general information, not legal advice. Your clinic is responsible for its own privacy obligations.
Last reviewed: 2026-10-22
We'll go through data flows, your province's data agreement and your PIA questions with a fictional patient on screen.