What this page is for
This Privacy Policy explains how we handle account and marketing data. It does not govern PHI — that is covered by the BAA, the Master Services Agreement, and the controls described on the Security page.
Information we collect
- Account data: name, work email, practice, role, phone, your authentication identifiers.
- Usage data: in-app interactions, performance telemetry, error reports — used to maintain service quality.
- Marketing data: if you submit a demo or newsletter form, the information you provide.
- Cookies: strictly necessary cookies for session management. Analytics cookies are opt-in.
What we do not do
- We do not sell personal data.
- We do not run third-party advertising trackers on scribara.com.
- We do not train shared models on identified PHI.
- We do not retain audio recordings after the encounter is processed unless you opt in.
Sub-processors
A current list of sub-processors (AWS, Cloudflare, Stripe, WorkOS, Datadog, Drata, and our model providers) is maintained at scribara.com/subprocessors. We notify customers 30 days before adding a new sub-processor.
Your rights
If you are in California, the EU, the UK, or another jurisdiction with applicable privacy law, you have rights to access, correct, port, and delete your personal data. Email privacy@scribara.com. We respond within 30 days.
Data residency
Marketing and account data is processed in the United States. Customer workspaces can be pinned to US-East, US-West, or EU-West on Enterprise plans.
Children
Scribara is a B2B clinical product. We do not knowingly collect data from children under 16 outside the patient-data context governed by the BAA.
Changes
Material changes to this policy will be announced via email to your account admin and posted here at least 30 days before taking effect.
Contact
Privacy questions: privacy@scribara.com. Scribara, Inc., 548 Market Street, San Francisco, CA 94104.