Smart Clinical Scribe (“we”, “us”) provides software that helps healthcare providers write clinical visit notes. This policy explains what information we collect, how we use it, who else handles it, and the choices you have. It covers the Smart Clinical Scribe website and the Smart Clinical Scribe EMR Autofill Chrome extension.

Smart Clinical Scribe is a documentation tool. It drafts a note from the visit you record, using AI, and the provider reviews, edits and signs it. Notes and transcripts are saved in your account until you delete them. We do not store visit audio.

• Account details. For providers: name, email, specialty, professional credentials, a password stored only as a hash, whether your email is verified, and your staff invite code. For staff accounts: name, email, a hashed password and the providers you are linked to.
• Visit content you create. Transcripts, AI-drafted and signed notes, addenda, tasks and orders, and the patient details you type in, such as name, date of birth, sex, MRN and visit type.
• Records you upload for pre-charting. The file is read to produce a summary. The file itself is not stored; the summary is kept with the note if you use it.
• Settings and templates. Practice details, preferred labs and imaging centers, clinical preferences and custom templates.
• Security and usage records. An audit log of actions (for example sign-in, viewing, editing, signing, exporting and deleting) that does not contain clinical text, and temporary counters used to limit abuse, which can include your network address.

Audio. Visit audio is sent from your browser in short segments so it can be transcribed. Smart Clinical Scribe does not keep the audio. Only the resulting transcript and the note are saved.

• To run the service: transcribe and translate visit audio, draft notes and summaries, and keep your notes, tasks and templates.
• To manage your account and send service emails such as email verification and password reset.
• To keep the service secure, prevent abuse, and find and fix technical problems.
• To meet legal obligations.

We do not sell your data and we do not use it for advertising. We do not use your clinical content to train our own AI models. How our AI provider handles it is described in the next section.

We use these third-party services to run Smart Clinical Scribe. Each one handles data under its own terms and privacy policy, which you can read at the links below. Those documents can change, so please check them directly.

• Google (Gemini AI). Audio segments, transcripts and the patient details in a note request are sent to Google's Gemini models to transcribe, translate and draft notes. Gemini API terms · Google Privacy Policy
• Railway. Hosts our server and database. Railway Privacy Policy
• Cloudflare. Hosts the website. Cloudflare Privacy Policy
• Resend. Sends verification and password-reset emails. Resend Privacy Policy

• You, the signed-in provider, can see your own notes and tasks. A provider cannot see another provider's data.
• Staff you link through your invite code can see your notes and tasks. Only you can sign a note or edit its clinical content.
• Smart Clinical Scribe administrators can see account and usage information in the admin dashboard, such as names, emails, signup dates and counts of notes. The dashboard does not show clinical note content.

• Data travels over encrypted connections (HTTPS).
• Passwords are hashed. Sign-in attempts are rate-limited, and repeated failures temporarily lock sign-in.
• Email addresses are verified, and sessions expire automatically after 12 hours.
• Every request is checked against the signed-in account, so one provider cannot read another's records.

No system is perfectly secure and we cannot guarantee absolute security. If a breach affects your information, we will notify you as required by applicable law.

If you use Smart Clinical Scribe to handle protected health information (PHI) as a covered entity or business associate under HIPAA, you are responsible for making sure your use meets HIPAA's requirements, including patient authorizations where required.

If you need a Business Associate Agreement (BAA), please contact us at the address below before you use the service for PHI.

Providers are also responsible for obtaining patient consent where it is needed, including for recording a visit, and for reviewing every AI-generated note before signing it.

We keep your data while your account is open. From Settings you can download a copy of your data or permanently delete your account.

• Deleting a provider account removes your notes, transcripts, addenda, tasks, templates and settings.
• Deleting a staff account removes the staff account and its links, but not the notes or tasks of the providers it was linked to.
• The audit log, which contains no clinical text, is kept for security.
• Copies in any backups are removed when those backups expire.

You are responsible for any record-keeping rules that apply to you as a provider, so download what you need before deleting.

• Access and portability. Download your data from Settings.
• Correction. Edit your profile, settings and notes in the app.
• Deletion. Delete your account from Settings. You confirm with your password.
• Emails. We send service emails only, such as verification and password reset. We do not send marketing email.

For anything you cannot do yourself in the app, contact us at the address below.

Your sign-in token and a few display details, such as your name, are kept in your browser's local storage so you stay signed in. We do not use advertising or tracking cookies. Signing out clears them.

The Smart Clinical Scribe EMR Autofill extension has one purpose: to place a note you exported from Smart Clinical Scribe into a text box in your EHR, when you ask it to.

• What it stores. When you click “Export to EMR”, the note text is kept in your own browser (Chrome extension storage) for up to 30 minutes, then discarded. You can clear it any time from the extension popup.
• What it sends. Nothing. The extension does not send the note, or anything else, to any server. It has no analytics, no tracking and no advertising.
• Where it runs. It reads the exported note only on the Smart Clinical Scribe website. On an EHR page it acts only when you click the extension icon, or when you have switched on the optional quick button for that specific site, which Chrome asks you to approve. It does not read or collect what is on your EHR pages.
• Permissions. storage keeps the exported note temporarily. activeTab and scripting let it paste into the page you are on when you click it. Optional site access is requested per site, only if you enable the quick button.

You can remove the extension at any time from Chrome, which deletes anything it stored.

Smart Clinical Scribe is for adult healthcare professionals. We do not knowingly collect personal information from anyone under 18 for their own use of the service.

We may update this policy. The date at the top shows when it last changed, and for material changes we will also let you know by email or in the app.

Questions about your account or data, data requests, or a BAA request: smartclinicalscribe@gmail.com