• The requirements of the Privacy Act 1988 (Cth) for Australian users;
• The General Data Protection Regulation 2016/679 (GDPR) for users in the European Union and European Economic Area;
• The UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 (DPA 2018) for users in the United Kingdom;
• The Personal Information Protection and Electronic Documents Act (PIPEDA) for users in Canada;
• The Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended by the Health Information Technology for Economic and Clinical Health (HITECH) Act, for US users handling Protected Health Information (PHI).

Therapy Scribe acts as a data processor for personal and health information processed on behalf of healthcare professionals, who are the data controllers. In limited cases (such as user authentication or billing data), Therapy Scribe may act as a data controller. For US users processing PHI, we act as a Business Associate under HIPAA, and all PHI handling is governed by our Business Associate Agreement (BAA), incorporated by reference and available at https://therapyscribe.app/legal/baa. The BAA overrides this Privacy Policy in the event of any conflict regarding PHI.

For APP compliance, we adhere to Principle 1 by managing personal information in an open and transparent manner, as detailed herein.

Your rights under these regulations include access to your personal data, correction of inaccurate data, and data portability. To exercise any of these rights, please contact us at hello@therapyscribe.app.

Definitions

• “Personal Data” means any information relating to an identified or identifiable individual;
• “Processing” means any operation performed on personal data, including collection, use, storage, or disclosure;
• “Data Controller” means the entity that determines the purposes and means of processing personal data;
• “Data Processor” means the entity that processes personal data on behalf of the data controller;
• “Protected Health Information” or “PHI” means individually identifiable health information as defined under HIPAA (45 CFR § 160.103).

• Name, email address, and authentication data;
• Usage data, including interactions with the platform;
• Preferences and communication settings;
• Credit balance and audio usage activity;

• Patient names or initials;
• Session dates and durations;
• Clinical information;
• Other identifiable health-related information as part of session notes;

Non-Personal Data

Automatically Collected Data: When you access the Platform, we may automatically collect device information (e.g., IP address, browser type, operating system), usage logs, and location data (if enabled).

Cookies and Similar Technologies:

• Essential cookies for authentication and security;
• Analytics cookies for understanding user behavior;
• Functional cookies for remembering your preferences;
• Performance cookies to improve our service;

• Clinical or health-related information included in session documentation, as provided by healthcare professionals;
• Information relating to patient identity or treatment context, where applicable. We do not use it for AI training or other unauthorized purposes.

• Strictly limited to fulfilling our TOS obligations, such as generating documentation via AI processing, managing credit-based audio usage with indefinite credit validity, and enhancing platform stability;
• Process orders and manage payment transactions;
• Provide you with drafted clinical documentation, reports, referrals, and emails from therapy sessions;
• Provide and improve our AI-assisted clinical documentation;
• Personalize your experience;
• Communicate with you about our services;
• Comply with legal obligations;
• Improve our website and products;
• Manage and track usage of credit-based payments for audio recordings.

• Consent: For the use of non-essential cookies and processing certain user-submitted data;
• Contractual Necessity: To fulfill our obligations to you under our Terms of Service;
• Legal Obligation: To comply with applicable laws and regulations;
• Legitimate Interests: To understand how our services are used and improve them, provided such interests are not overridden by your data protection rights.

• Service providers who assist in our operations (e.g., cloud storage providers);
• Legal authorities when required by law, such as in response to a court order or other legal process;

• Authentication providers (e.g., for secure login and session management)
• Cloud infrastructure and storage providers;
• Speech-to-text and AI processing platforms;
• Analytics providers to understand usage and improve our services;
• Monitoring and debugging tools to maintain app stability and security;
• Payment processors.

• Contracts with third parties that include Standard Contractual Clauses (SCCs) approved by the European Commission
• Security and privacy due diligence on all vendors
• Use of reputable service providers that comply with applicable privacy frameworks

• Access: Request a copy of the data we hold about you;
• Rectification: Request correction of inaccurate or incomplete data;
• Erasure: Request deletion of your data ("right to be forgotten");
• Restriction: Request restriction of data processing in certain circumstances;
• Portability: Receive your data in a structured, machine-readable format;
• Objection: Object to certain types of processing, such as direct marketing;
• Withdraw Consent: Withdraw your consent at any time, where processing is based on consent;
• Erasure requests will result in deletion from all systems, including backups, within 30 days, unless retention is required for legal purposes (e.g., audit trails under HIPAA); portability provided in JSON/CSV formats.

• The amount, nature, and sensitivity of the personal data;
• The potential risk of harm from unauthorized use or disclosure;
• The purposes for which we process the data;
• Whether we can achieve those purposes through other means;
• Applicable legal, regulatory, tax, accounting, or other requirements.

• Encryption of data in transit (TLS 1.3) and at rest AES-256 encryption;
• Access controls and authentication measures;
• Rate limiting to prevent abuse.

• For patients under 13:
  • We do not knowingly collect personal information directly from children under 13;
  • Any information about patients under 13 should be provided by the healthcare professional with appropriate parental or guardian consent, as required by applicable laws and professional standards.
• For patients between 13 and 18:
  • Information about these patients may be processed as part of the healthcare professional's use of our service.
  • Healthcare professionals are responsible for obtaining any necessary consents and complying with all applicable laws and regulations regarding the processing of minors' data.

• Australia: Office of the Australian Information Commissioner (OAIC)
• European Union: Your local Data Protection Authority
• United Kingdom: Information Commissioner's Office (ICO)
• Canada: Office of the Privacy Commissioner of Canada (OPC)
• US (HIPAA-related): US Department of Health and Human Services Office for Civil Rights (OCR)