ScribeUp Privacy Policy

This Privacy Policy explains how The Blue Ribbon Solutions Pty Ltd (ABN 12 701 306 292) (ScribeUp, we, us, our) collects, uses, discloses and stores personal information in connection with the ScribeUp Platform.

This Privacy Policy applies to practitioners and other users of ScribeUp, and to patients or clients whose personal information may be processed through ScribeUp.

We handle personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), where applicable, and applicable State and Territory health privacy laws. Given the clinical context in which ScribeUp operates and the nature of the health and other sensitive information that may be processed through the Platform, we pay particular attention to APP 3 (collection of solicited personal information, including sensitive information) and APP 11 (security of personal information).

Entity: The Blue Ribbon Solutions Pty Ltd (ABN 12 701 306 292)

Email: admin@ScribeUp.com.au

ScribeUp is an AI-assisted clinical scribing and documentation tool. A practitioner may use ScribeUp during a consultation to record the consultation, convert consultation audio into text and generate draft clinical documentation using a pre-defined template. The practitioner is responsible for reviewing and verifying generated documentation before using it or incorporating it into a clinical or medical record system.

ScribeUp is a documentation tool. It does not provide clinical or medical advice, diagnosis or treatment recommendations.

This Privacy Policy applies to the ScribeUp websites and web applications, including:

• https://ScribeUp.com.au
• https://ScribeUpndis.com.au
• https://ScribeUpgp.com.au
• https://ScribeUpdoc.com.au
• any other ScribeUp application, extension or service we make available

4.1 Practitioners and other ScribeUp users

• Account information, including a verified email address.
• Subscription and billing information, including information processed via Stripe.
• Usage and security metadata, including timestamps, activity logs, security logs, IP address and device/browser information.
• Communications and support information when you contact us.

4.2 Patients and clients

When a practitioner uses ScribeUp in connection with a patient or client consultation, ScribeUp may collect or process:

• the patient or client's name and, where provided, date of birth;
• consultation audio and the patient or client's voice;
• personal information, health information and other information discussed during the consultation;
• information contained in reference documents provided or uploaded by the practitioner;
• a transcript generated from consultation audio; and
• draft clinical notes, reports or other clinical documentation generated from that information.

Some consultation information is processed only temporarily for the purpose of generating draft clinical documentation. Temporary processing does not mean that the information ceases to be personal information or health information.

4.3 Consultation audio, transcripts and generated documentation

Based on ScribeUp’s current architecture, consultation audio is temporarily stored on the user’s device and sent for processing when the recording is completed. ScribeUp does not retain consultation audio, transcripts or generated clinical documentation on its backend after processing. Generated documentation may be copied to the user’s clipboard or downloaded as a PDF to the user’s device and may then be transferred by the practitioner to the practitioner’s own clinical or medical record system.

ScribeUp’s third-party processors do not retain consultation audio or transcripts after processing. Any logs maintained in connection with that processing contain metadata only and do not contain consultation audio or transcripts.

During a recording session, consultation audio is processed locally in the user’s browser memory and divided into segments of approximately 8 minutes. Each segment is transmitted directly from the user’s browser to Deepgram for speech-to-text processing as it is captured and is not proxied through ScribeUp’s servers. The resulting consultation content is then processed using AWS Bedrock/Anthropic for the purpose of generating draft clinical documentation, which is presented to the user through the Platform.

Under Australian privacy law, sensitive information can include health information. Given the nature of ScribeUp, consultation audio, transcripts, and generated documentation may contain health information and other sensitive information about patients or clients. We only collect sensitive information where it is reasonably necessary for one or more of our functions or activities and we have the individual’s consent, unless the collection is otherwise permitted or required by law.

We may collect personal information:

• directly from practitioners and other users when they create an account, verify an email address, subscribe, make a payment, contact us or otherwise use ScribeUp;
• from patients or clients through consultation audio when a practitioner uses ScribeUp during a consultation;
• from practitioners when they enter patient or client details;
• through transcription and AI processing that generates transcripts and draft clinical documentation; and
• automatically through use of our websites and Platform, including through security, device, network and usage metadata and any cookies or similar technologies we use.

Practitioners are responsible for obtaining any consent or other authority required before recording a consultation or providing patient or client personal information to ScribeUp. A patient or client may decline to have ScribeUp used for their consultation. If ScribeUp is not used, the practitioner will need to use another method to prepare the relevant clinical documentation.

We may use personal information to:

• provide, operate and secure the ScribeUp Platform;
• create and manage user accounts;
• process subscriptions and payments;
• transcribe consultation audio and generate draft clinical documentation based on user inputs;
• provide customer support;
• monitor, maintain and secure the Platform, including through logs and metadata;
• improve the performance, reliability and functionality of the Platform; and
• comply with applicable legal and regulatory obligations.

ScribeUp uses third-party speech-to-text and artificial intelligence services to process consultation content and generate draft clinical documentation.

We do not use consultation audio, transcripts or generated clinical documentation to train our own general or foundation AI models.

We may disclose personal information to third parties where reasonably necessary to provide ScribeUp, operate our business or comply with law. Depending on how ScribeUp is used, some service providers may process personal information or health information on our behalf.

Key service providers

• Deepgram — speech-to-text processing of consultation audio — Australia region;
• AWS Bedrock (Anthropic) — AI generation — Australia region;
• Stripe — payment processing;
• Supabase — authentication and account database hosting — Sydney region; and
• Vercel — website/application hosting and deployment — Sydney (Syd1) region.
• Google Cloud OAuth — Australia region (for Google authentication/pass-through using a Google Account).
• SMTP2GO — Australia region (for email services).

Other disclosures

We may also disclose personal information:

• to professional advisers, such as lawyers and accountants;
• to regulators, law enforcement bodies or other authorities where required or authorised by law; and
• in connection with a proposed or actual corporate transaction, such as a sale, merger or restructure, subject to appropriate confidentiality arrangements.

ScribeUp uses Australian-region servers for the hosting and processing of clinical information. Our service providers used for clinical information processing are configured to use Australian-region servers.

Stripe provides payment processing services to ScribeUp and operates globally. Personal information processed by Stripe may therefore be processed or stored outside Australia, including through Stripe’s global infrastructure and service providers.

We take reasonable steps, where required by applicable privacy law, in relation to any disclosure of personal information to recipients outside Australia.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Because information processed through ScribeUp may include health and other sensitive information, we take the sensitivity of that information into account when determining the reasonable technical and organisational measures required to protect it.

Measures may include:

• access controls and authentication;
• secure hosting arrangements;
• logging and monitoring for security;
• encryption in transit;
• appropriate controls over service-provider access;
• internal policies and procedures.

13.1 Consultation content

Based on ScribeUp’s current architecture, ScribeUp does not retain consultation audio, transcripts or generated clinical documentation on its backend after processing. This does not mean that ScribeUp retains no personal information; other categories of personal information are retained as described below.

13.2 Patient and client identifiers

ScribeUp retains patient or client name and, where provided, date of birth in an Australian-hosted database.

Once you Archive a client within ScribeUp, ScribeUp will purge the history after 60 days. This will remove the patient/client’s name, date of birth and associated history from ScribeUp, including any backups.

13.3 Account, billing and security information

We retain account, subscription, billing, support and usage/security information for as long as reasonably necessary to provide and secure the Platform, administer accounts and subscriptions, comply with legal obligations, resolve disputes and enforce our agreements.

Where personal information is no longer required to be retained and we are not required or authorised by law to retain it, we will take reasonable steps to destroy it or de-identify it.

You may request access to personal information we hold about you, or request that inaccurate, out-of-date, incomplete, irrelevant or misleading personal information be corrected, by contacting us at admin@ScribeUp.com.au. You may also contact us to enquire about deletion of personal information where applicable.

If patient or client information has been copied, downloaded or transferred by a practitioner to the practitioner’s own clinical or medical record system, requests concerning that separately held record should generally be directed to the relevant practitioner or healthcare provider.

If you have a complaint about how we handle personal information, please contact us at admin@ScribeUp.com.au and provide details of your concern. We will acknowledge and investigate the complaint and respond within a reasonable period.

If you are not satisfied with our response, you may be able to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) or another applicable privacy or health complaints regulator.

Our websites and Platform may use cookies and similar technologies for functionality, authentication, session integrity, security and analytics.

ScribeUp does not use advertising tracking or cookies.

We may occasionally receive personal information that we did not request, including information contained in consultation content or reference documents. Where this occurs, we will handle the information in accordance with applicable privacy requirements. Where required, we will determine whether the information could have been collected under the APPs and, if not, take reasonable steps to destroy or de-identify it, provided it is lawful and reasonable to do so.

We maintain a separate ScribeUp Privacy Collection Notice that provides more concise information for practitioners, patients and clients about how information is collected and processed when ScribeUp is used during a consultation. Practitioners should provide or make available the relevant collection information at or before the time patient or client information is collected, or as soon as practicable afterwards, as required by applicable law. The Privacy Collection Notice is available at: scribeup.com.au/privacy-collection-notice.

We may update this Privacy Policy from time to time to reflect changes to our practices, technology or legal obligations. The current version will be published on the ScribeUp Platform and will identify its effective date and/or last updated date.