ScribeUp Privacy Collection Notice

The Blue Ribbon Solutions Pty Ltd (ABN 12 701 306 292)

Email: admin@ScribeUp.com.au

ScribeUp is an AI-assisted clinical scribing and documentation tool. A practitioner may use ScribeUp during a consultation to record the consultation, convert the consultation audio into text and generate draft clinical documentation using a pre-defined template. The practitioner is responsible for reviewing and verifying the generated documentation before using it or incorporating it into the practitioner’s clinical or medical record system.

ScribeUp is a documentation tool. It does not provide clinical or medical advice, diagnosis or treatment recommendations.

Practitioners and other ScribeUp users

• Account information, including a verified email address;
• Subscription and billing information, including information processed through our payment provider;
• Usage and security metadata (e.g. timestamps, IP address, device/browser info for monitoring/security);
• Communications and support information when you contact us.

Patients and clients

When a practitioner uses ScribeUp in connection with a patient or client consultation, ScribeUp may collect or process:

• the patient or client's name and, where provided, date of birth;
• consultation audio and the patient or client's voice;
• personal information, health information and other information discussed during the consultation;
• a transcript generated from the consultation audio; and
• draft clinical notes, reports or other clinical documentation generated from that information.

Some consultation information is processed only temporarily for the purpose of generating the draft clinical documentation. The fact that information is processed temporarily does not mean that it is not personal or health information.

We collect personal information to:

• provide, operate and secure ScribeUp;
• create and manage user accounts;
• process subscriptions and payments;
• transcribe consultation audio and generate draft clinical documentation;
• generate reports/notes based on User Inputs;
• provide customer support, monitoring and security; and
• comply with applicable legal and regulatory obligations.

If a practitioner does not provide information required to create or operate an account, we may not be able to create the account, process a subscription or provide access to relevant ScribeUp features.

If a patient or client does not consent to ScribeUp being used for a consultation, ScribeUp will not be used to generate AI-assisted clinical documentation for that consultation, and the practitioner will need to use an alternative method of documentation.

Practitioners are expected to obtain any consent or other authority required before recording a consultation or providing patient or client information to ScribeUp. Before the recording workflow begins, ScribeUp displays a “Confirm Patient Consent” screen which the practitioner must accept before proceeding with the recording. A patient or client may decline to have ScribeUp used for their consultation. If ScribeUp is not used, the practitioner will need to use another method to prepare the relevant clinical documentation.

Based on ScribeUp’s current architecture, consultation audio is temporarily stored on the user’s device and sent for processing when the recording is completed. ScribeUp does not retain consultation audio, transcripts or generated clinical documentation on its backend after processing. Generated documentation may be copied to the user’s clipboard or downloaded as a PDF to the user’s device and may then be transferred by the practitioner to the practitioner’s own clinical or medical record system.

ScribeUp retains certain information required to operate the service, including user account information, usage/security metadata and patient or client name and, where provided, date of birth.

Once you Archive a client within ScribeUp, ScribeUp will purge the history after 60 days. This will remove the patient/client’s name, date of birth and associated history from ScribeUp, including any backups.

We use third-party service providers to operate ScribeUp and process information on our behalf. Depending on how ScribeUp is used, these providers may process personal or health information.

• Deepgram (speech-to-text) — Australia region
• AWS Bedrock (Anthropic) — AI generation — Australia region
• Stripe (payments)
• Supabase (auth/account data — Sydney region)
• Vercel (hosting/deployment — intended Syd1)
• Ventra IP (domain registrar)
• Google Cloud OAuth — Australia region (for Google authentication/pass-through using a Google Account)
• SMTP2GO — Australia region (for email services)

We may also disclose to professional advisers and regulators where required or authorised by law.

Our Privacy Policy contains further information about how we manage personal information, including access and correction, security, disclosures and privacy complaints. It is available at: scribeup.com.au/privacy.