Privacy Policy
MediScribe Flow ("we," "us," or "our") is designed with healthcare privacy in mind. This Privacy Policy explains what information we collect, how we use it, and how we protect it when you use the MediScribe Flow mobile application and related services (collectively, the "Service").
1. Information We Collect
We collect the following categories of information:
- Account information. When you sign in through our authentication provider, we receive your email address and a unique user identifier. We do not store passwords.
- Clinical notes and voice recordings. Content you dictate or type into the app — including patient visit notes, clinical narratives, audio recordings, transcripts, selected templates, and related clinical context — is transmitted to our servers to prepare structured documentation workflows. This content may include protected health information (PHI) that you provide.
- Limited technical information. To operate the Service securely, routine requests from the app include basic technical details such as app version and operating system version. MediScribe Flow does not use crash-reporting, analytics, advertising, or tracking SDKs, and does not collect product-usage analytics. We do not sell this data.
- No analytics, cookies, advertising, or tracking. MediScribe Flow does not use analytics, cookies, or advertising or tracking SDKs — on this website or in the app. We do not track you across other apps or websites, and we do not sell your data.
- Email delivery information. If you use the secure email delivery feature, we process the recipient addresses you enter to route the generated documents.
2. How We Use Information
We use the information we collect solely to operate and improve the Service:
- To prepare, format, preview, and deliver structured clinical documentation based on your inputs
- To transcribe dictated audio, generate draft documentation, and surface documentation-review suggestions using AI processing
- To authenticate your account and maintain session security
- To diagnose technical problems, monitor service reliability, and fix bugs
- To communicate with you about your account or support requests
We do not use your clinical content for advertising, sell data to third parties, or conduct marketing profiling.
3. Health and Clinical Data — Your Responsibility
MediScribe Flow is a tool designed with healthcare privacy in mind and is intended for use by healthcare professionals in a manner consistent with applicable law. You are responsible for ensuring that your use of the Service — including what clinical content you enter and how you share the resulting documents — complies with HIPAA, applicable state privacy laws, and your organization's policies.
If your organization operates as a HIPAA-covered entity or business associate, please contact us at support@mediscribeflow.com to discuss a Business Associate Agreement (BAA) before using the Service with PHI.
4. Offline Recordings and Local Storage
When your device is offline, voice recordings are stored locally in the app's protected device storage until a network connection is available. At that point, recordings are automatically uploaded for processing and removed from local storage.
Prepared PDF documents and template assets may be temporarily cached in your device's cache directory. These cached files are cleared automatically when you sign out. You can also clear the app's locally cached data at any time using the "Clear all device data" option in the app, which clears the local cache — recordings, cached documents, and saved preferences — from that device. This affects the local cache on your device only; the authoritative record is retained server-side by the covered entity in accordance with applicable retention obligations. Any recordings not yet uploaded should be synced before clearing.
5. Information Sharing
We do not sell, rent, or trade your personal information or clinical content. We share information only in the following limited circumstances:
- Service providers. We use a small number of third-party infrastructure providers (cloud hosting, authentication, documentation processing) that process data on our behalf under confidentiality agreements. These providers do not use your data for their own purposes.
- AI service provider. We use a third-party AI service provider engaged under a Business Associate Agreement (BAA) with Zero Data Retention to provide AI processing for transcription and documentation assistance. When you use dictation, transcription, document generation, or documentation-review features, the relevant audio, transcript or typed narrative, selected template, and related clinical context may be sent to that third-party AI service provider through MediScribe Flow's backend solely to provide those features. Under that agreement, your content is not retained by the AI service provider after the request is processed and is not used to train its models; the provider acts as a service provider for this processing and is not permitted to use this content for advertising or marketing profiling.
- Legal requirements. We may disclose information if required by law, court order, or to protect the rights, property, or safety of MediScribe Flow, our users, or others.
- Business transfers. If MediScribe Flow is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a materially different privacy policy.
6. Security
We implement administrative, technical, and physical safeguards designed to protect the information we hold. These include encrypted data transmission (TLS), encrypted local storage on device, access controls, and authentication via industry-standard OAuth 2.0 / PKCE flows.
No method of transmission over the internet or electronic storage is 100% secure. We encourage you to use a strong device passcode and to sign out of the app when not in use, especially on shared devices.
7. Data Retention and Deletion
We retain your account information and processed documentation for as long as your account is active or as needed to provide the Service. Voice recordings are deleted from our servers promptly after processing is complete.
To request deletion of your account and associated data, email us at support@mediscribeflow.com. We will process deletion requests within 30 days, subject to any legal retention obligations.
You can clear the app's locally cached data on your device at any time using the "Clear all device data" feature in the app settings. This clears the local cache on that device only; the authoritative record is retained server-side by the covered entity in accordance with applicable retention obligations. Recordings not yet uploaded should be synced before clearing.
8. Children
The Service is intended for use by healthcare professionals and is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the effective date above. If we make material changes, we will notify you via the app or by email. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us:
MediScribe Flow, LLC
Email: support@mediscribeflow.com