Privacy at Sadek AI

Sadek AI is a company founded by patients, doctors, researchers, and technologists. We believe that patients should have the power to control their health information through technology. Patients should also be an equal partner in relationships with their care providers.

We leverage groundbreaking technologies to help people remember the important details from their health conversations, so they can better follow their care plan. With more context and understanding of medical conversations, we hope to help everyone achieve better health outcomes.

How Scriba Protects Your Privacy

These five Privacy Principles guide all decisions we make as we build and improve Scriba:

• You own and control when your data is collected and how it is shared. We only collect and share personal health data with your consent. We use privacy by design principles to limit the data we collect and to give you notice in the App when you have choices to share data.
• You can change your mind. You can delete recordings or your account at any time.
• We never sell personal data. We want to be clear on this point. We don't have a business model that includes making money from selling your identifiable data.
• Anonymized Data is better. Any research and development is performed on de-identified health data or external data sets that are acquired with patient consent. If we have an opportunity to include your personal data in our research, we will request your consent before we do so.
• Data Security is not a trade-off. You trust us to keep your data secure and that guides everything we build. Because of that, we apply HIPAA security standards to all health data we collect.

Privacy Policy

Effective December 1, 2024

Scriba was created to help people get structured documentation from health conversations. Scriba provides services through the Scriba Service ("Scriba App" or "App")(collectively, "the Scriba Services," "Scriba" or "the Services"). Our goal with this Privacy Policy is to inform you about how Scriba works by explaining the data you provide, data we collect, how we use it to provide the Services and when it is shared.

What Personal Data Does Scriba Collect About Me?

Account Information

We may collect contact information such as your phone number, email, address, or single sign-on login information to create an account and allow you to access it.

Health Information

When you record a health conversation, we collect the audio and process that into a readable transcript that we store. We use the transcript to create a recording summary tailored to you or your health professional which may include your recording.

Conversations

You can initiate a recording of any health conversation in the Services. It will immediately be available to you when you log in. You may choose to share that conversation with another Scriba user.

Analytics and Passively Collected Data

We collect data about how you use Scriba including your IP address, mobile device ID, click or tap history, type of OS or browser and other actions on the Services. This information is collected from your phone or web browser as you interact with web and mobile apps and helps us improve your experience with the Services.

Feedback and Support

We love to hear from you! Whether you have an idea to make Scriba better or need a little help, we store the emails you send us and use them to help us prioritize how to improve our product.

De-identified Data

De-identified Data is non-personal information that is aggregated or de-identified so that it cannot reasonably be used to identify an individual. We use de-identified data for research and development of new products or tools, to refine our algorithms and machine learning applications, and to improve the Services and the services we provide. We may disclose such information publicly and to third parties, for example, in public reports about health, to partners under agreement with us, or in benchmarking information we provide to the medical community.

How Does Scriba Use Personal Data?

We process personal data to provide the Service to you:

• We use machine learning to process your audio recording and create a transcript of relevant medical mentions that we provide to you.
• We use your name when you share a recording, so the recipient knows who sent it.
• We use your name, email address, and mobile phone number to manage your account, contact you about your use of Scriba, respond to your requests, and inform you of new features or products.
• We use Analytics and Passively Collected Data to understand how you use Scriba, to test features and tools, ensure Scriba is working properly, and protect it from bad actors.
• We use personal data to improve Scriba. For example: to troubleshoot and protect against errors; perform data analysis and testing; conduct research and surveys; develop new products or tools; and refine our algorithms and machine learning applications.
• We use your email address to send you information about Scriba or our Partners. You can opt-out from receiving messages at any time by clicking "unsubscribe" in any email you receive.
• We use your contact information and information about how you use the Services to send promotional communications that may be of specific interest to you. These communications are aimed at driving engagement and maximizing what you get out of the Services, including information about new features, survey requests, events and other information we think may be of interest to you. We also communicate with you about new product offers, promotions and contests.
• We are always looking for ways to make our Services smarter, faster, more secure, integrated and useful to you. To that end, we use collective learnings about how people use our Services and feedback provided directly to us to troubleshoot and to identify trends, usage, activity patterns and areas for integration and improvement of the Services.
• We use personal data to promote the safety and security of Scriba, our users, and other parties. For example, to protect against fraud and abuse, respond to a legal request or claim, conduct audits, and enforce our terms and other policies.

When Is My Personal Data Shared?

We never sell personal data. We only share it with your consent or when required or permitted by law.

Here are the circumstances under which your personal data may be shared:

When You Consent, Agree or Direct Us to Share It

There may be times when you ask us to perform an action that will share your data. For example:

• You may direct us to share a recording with a family member who is a Scriba user. You can revoke this access at any time.
• The Scriba Service includes links and interactions with third parties that aren't controlled by Scriba. We partner with these organizations because they provide benefits that we think makes the Scriba experience more beneficial to you. We do not share personal data with partners unless you direct us to do so and we include a link to the partner's privacy policy in the Services so you will know how your data will be used by that partner.
• Please note that once your data is shared with a third party, it is covered by any policies that apply to that third party and you will have to contact them directly to access or delete your personal data.

To Provide the Scriba Services

We transfer data to service providers and other partners who process it for us, based on our instructions and in compliance with this Privacy Policy and other confidentiality and security measures enforced by legal contract. This processing can include services such as customer support, cloud storage, marketing, data analysis, research, and surveys.

We use Google Analytics, a web analysis service operated by Google Inc. ("Google"). Google Analytics uses cookies (text files) stored on your computer to allow for analysis of your visits to websites and interactions with them in order to personalize your experience and improve the Services. You may prevent data from being used by Google Analytics by downloading and installing the Google Analytics Opt-out Browser Add-on.

To Comply with the Law

We may disclose the information we collect from you in order to comply with the law, a judicial proceeding, court order, or other legal process, such as in response to a court order or a subpoena.

Please note: Our policy is to notify you of legal process seeking access to your information, such as search warrants, court orders, or subpoenas, unless we are prohibited by law from doing so. In cases where a court order specifies a non-disclosure period, we provide delayed notice after the expiration of the non-disclosure period. Exceptions to our notice policy include exigent or counterproductive circumstances, for example, when there is an emergency involving a danger of death or serious physical injury to a person.

To Protect Us and Others

We may disclose the information we collect from you where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms of Use or this Policy, or as evidence in litigation in which Scriba is involved.

Business Transfers

If we are acquired by or merged with another company, if substantially all of our assets are transferred to another company, or as part of a bankruptcy proceeding or reorganization, we will give affected users notice before transferring any personal data to a new entity.

How Do You Keep My Data Safe?

We use a combination of technical, administrative, and physical controls to keep user data secure. Data is always transmitted via secure channels. Data is encrypted in transit and at rest using the industry best practice encryption standards (e.g. S/MIME, X.509 certificates, TLS) to safeguard your information. Data is protected as it travels over the internet during read and write operations using HTTPS. We use HIPAA-compliant products and services for health data storage and processing. In addition to using state-of-the-art security systems, we also have strict internal access-control policies to prevent privacy violations.

How Do You Protect Children?

Scriba is not intended for children. If we become aware that we are collecting data from a child under 13, we will promptly delete the data and the account. If you have reason to believe that a child under the age of 13 provided data to us without parent or guardian consent, please contact us at apps@sadek.ai.

Access to, Storage of, and Deleting My Personal Data

You may access and modify personal data that you have submitted by logging into your account and updating your profile information. Please note that copies of information that you have updated, modified or deleted may remain viewable in cached and archived pages of the Service for a period of time. Your personal data is stored and accessible on your device as well as in the cloud.

We store information associated with your account until your account is deleted. You can delete your account at any time from the settings menu in the Services or by contacting us at apps@sadek.ai. Please note that it may take 24 hours to delete your account information, and we may preserve it for legal reasons or to prevent harm, including as described in the "When Is My Personal Data Shared?" section.

Your California Privacy Rights

This Privacy Policy complies with the California Consumer Privacy Act (CCPA), which requires that we provide California residents with notice that you have the right to:

• opt-out of the sale of personal information,
• know about personal information collected, disclosed or sold,
• request deletion of personal information, and
• be treated without discrimination should you exercise these rights.

More information regarding the: sources from which we collect personal information can be found above in the section titled "What Personal Data Does Scriba Collect About Me?"; business and commercial purposes for which we collect your personal information can be found above in the section titled "How We Use Your Information"; categories of recipients with whom personal information is shared or sold can be found in the section above titled "When Is My Personal Data Shared?"

We do not sell any personal information collected from your use of the Scriba Service.

To make a request under the California Consumer Privacy Act, or for any questions or concerns about our Privacy Policy or practices, please contact us at apps@sadek.ai.

Changes to This Policy

We will notify you before we make material changes to this policy and give you an opportunity to review the revised policy before deciding to continue using Scriba. You can review previous versions of the policy in our Archive of Previous Privacy Policies.