Privacy Policy

This Privacy Policy applies to:

• All users of the SOAP-E platform, including healthcare professionals and authorized personnel
• Information collected through our website, mobile applications, and related services
• Protected Health Information (PHI) processed in connection with our Service
• Personal information of users and any individuals whose information may be processed through the Service

Our privacy practices are designed to comply with applicable federal and state privacy laws, including but not limited to the Health Insurance Portability and Accountability Act (HIPAA), the California Consumer Privacy Act (CCPA), and other relevant privacy regulations.

When you create an account or use our Service, we may collect:

• Professional credentials and licensing information
• Contact information (name, email address, phone number)
• Professional affiliation and workplace information
• Account authentication data (encrypted passwords, OAuth tokens)
• User preferences and settings
• Profile information you choose to provide

In the course of providing our documentation assistance service, we process:

• Clinical observations and notes you input into the system
• Generated documentation content and AI-assisted outputs
• Conversation transcripts and session data (when applicable)
• Documentation metadata (timestamps, revision history, user interactions)
• Quality assurance and accuracy feedback data

Important: We process this information solely to provide our documentation services and do not use it for any other purpose without your explicit consent.

We automatically collect certain technical information to operate and improve our Service:

• Device information (browser type, operating system, device identifiers)
• IP addresses and location data (general geographic region only)
• Usage patterns and interaction data (pages visited, features used, session duration)
• Performance metrics and error logs (anonymized)
• Security monitoring data (login attempts, access patterns)
• Cookie data and similar tracking technologies (see Section 10 for details)

When you contact us or interact with our support services:

• Customer support communications and correspondence
• Feedback, surveys, and user research responses
• Training session recordings (with your consent)
• Marketing communication preferences
• Event and webinar participation data

We may receive information from:

• OAuth providers (Google, Microsoft) for authentication purposes
• Professional licensing databases for credential verification
• Healthcare institutions for authorized users (with proper agreements)
• Legal and compliance service providers (for regulatory requirements)
• Analytics and security service providers (anonymized data only)

PHI may include any information you input that relates to:

• Patient identifiers (names, dates of birth, medical record numbers)
• Clinical observations and treatment notes
• Diagnostic information and assessment data
• Treatment plans and therapy goals
• Progress notes and session summaries
• Any other individually identifiable health information

We process PHI only as necessary to provide our documentation services. We encourage users to follow data minimization principles:

• Use patient initials rather than full names when possible
• Include only clinically relevant information necessary for documentation
• Consider using de-identification techniques where appropriate
• Regularly review and purge unnecessary PHI from the system

We protect PHI through comprehensive security measures including:

• End-to-end encryption for all PHI in transit and at rest
• Strict access controls and authentication requirements
• Audit logging of all PHI access and modifications
• Employee training on HIPAA compliance and PHI handling
• Incident response procedures for potential PHI breaches

PHI is retained only as long as necessary to provide our services or as required by applicable law. We provide secure deletion mechanisms and maintain detailed records of PHI disposal activities.

We use your information to:

• Provide AI-assisted clinical documentation services
• Generate, organize, and manage your clinical notes and documentation
• Authenticate your identity and maintain account security
• Process payments and manage subscription services
• Provide customer support and technical assistance
• Maintain and improve the functionality of our Service

We may use aggregated, de-identified information to:

• Analyze usage patterns to improve user experience
• Develop new features and enhance existing functionality
• Train and improve our AI models (using only de-identified data)
• Conduct quality assurance and performance optimization
• Generate anonymized research and industry insights

We may use information as necessary to:

• Comply with applicable laws, regulations, and legal processes
• Respond to lawful requests from government authorities
• Enforce our Terms of Service and other agreements
• Protect the rights, privacy, safety, or property of users or third parties
• Investigate and prevent fraud, security breaches, or other illegal activities

With your consent, we may use your contact information to:

• Send service-related notifications and updates
• Provide educational content and training materials
• Share product announcements and feature updates
• Invite you to participate in surveys or research studies
• Send marketing communications (you can opt out at any time)

We may share information with trusted third-party service providers who assist us in operating our Service, subject to strict contractual obligations:

• Cloud infrastructure providers (with HIPAA-compliant services)
• Authentication and security service providers
• Payment processing and billing services
• Customer support and help desk platforms
• Analytics providers (using only de-identified data)
• Legal and professional service providers

All service providers that may access PHI are required to sign Business Associate Agreements and implement appropriate safeguards.

Where applicable and with proper authorization, we may share information with:

• Your employing healthcare institution (as specified in institutional agreements)
• Authorized supervisors or colleagues (with your explicit permission)
• Quality assurance and compliance personnel (for institutional requirements)
• IT administrators (for technical support and system administration)

We may disclose information when required by law or to protect public safety:

• In response to valid legal process (subpoenas, court orders, search warrants)
• To comply with regulatory investigations or audits
• To report suspected abuse or neglect as required by law
• To prevent imminent harm to individuals or public safety
• To protect against fraud or other illegal activities
• In connection with law enforcement investigations (with proper authorization)

In the event of a merger, acquisition, or sale of assets, user information may be transferred to the acquiring entity, subject to:

• Advance notice to affected users
• Continued protection under equivalent privacy standards
• Option for users to request data deletion before transfer
• Compliance with all applicable privacy laws and regulations

We may share de-identified, aggregated information for legitimate business purposes, including research, industry analysis, and service improvement, provided such information cannot be used to identify individuals or patients.

We implement a multi-layered security approach designed to protect your information from unauthorized access, disclosure, alteration, or destruction:

• End-to-end encryption (AES-256) for all data in transit and at rest
• Multi-factor authentication for all user accounts
• Role-based access controls with principle of least privilege
• Intrusion detection and prevention systems
• Secure API design
• Automated security monitoring and anomaly detection
• Regular security updates and patch management

• Comprehensive employee background checks and security training
• Regular HIPAA and privacy training for all personnel
• Incident response procedures and breach notification protocols
• Business Associate Agreements with all relevant vendors
• Regular review and updating of security policies and procedures
• Designated Privacy Officer and security team oversight
• Data governance and classification protocols

Our security program includes continuous monitoring, regular assessments, and ongoing improvement based on evolving threats and best practices. We maintain compliance with industry standards including HIPAA Security Rule requirements.

When you use our Service to process PHI, we act as your Business Associate under HIPAA. This means we are legally bound to protect PHI and use it only for the purposes specified in our Business Associate Agreement.

As a covered entity or individual, you have the following rights regarding PHI:

• Right of Access: Request copies of PHI we maintain on your behalf
• Right to Amend: Request corrections to inaccurate or incomplete PHI
• Right to Restrict: Request limitations on how PHI is used or disclosed
• Right to an Accounting: Receive a list of disclosures we have made
• Right to Alternative Communications: Request confidential communications
• Right to Complain: File complaints about our privacy practices

To exercise any of these rights, please contact our Privacy Officer using the information provided in Section 16. We will respond to your request within the timeframes required by HIPAA (typically 30 days for most requests).

We follow the HIPAA minimum necessary standard, which means we access, use, and disclose only the minimum amount of PHI necessary to accomplish the intended purpose.

This Privacy Policy serves as our Notice of Privacy Practices as required by HIPAA. If you are a covered entity using our Service, you should provide appropriate notice to your patients regarding your use of our services.

We retain different types of information for varying periods based on legal requirements and business needs:

When information is no longer needed, we securely delete or destroy it using industry-standard methods:

• Cryptographic erasure for encrypted data
• Physical destruction of hardware when appropriate
• Verification and documentation of deletion activities
• Coordination with third-party service providers for complete removal

You can request deletion of your data at any time, subject to legal and regulatory retention requirements. We provide tools within the Service for you to delete specific documentation and manage your data retention preferences.

In certain circumstances (such as litigation or regulatory investigations), we may be required to preserve information beyond normal retention periods. We will notify you of such requirements when legally permissible.

You have comprehensive rights regarding your personal information:

• Access: Request copies of all personal information we maintain about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information (subject to legal requirements)
• Portability: Request your data in a structured, machine-readable format
• Restriction: Request limitations on how we process your information
• Objection: Object to certain types of processing

You can control how we communicate with you:

• Opt out of marketing communications at any time
• Choose preferred communication channels (email, phone, mail)
• Set frequency preferences for non-essential communications
• Request confidential communication methods when necessary

Within your account settings, you can:

• Review and update your profile information
• Manage data sharing preferences
• Configure security settings and authentication methods
• View and download your data
• Request account deletion
• Access privacy and consent management tools

To exercise any of these rights, you can:

• Use the privacy controls within your account settings
• Contact our Privacy Officer directly (see Section 16)
• Submit a written request via email or mail
• Call our privacy helpline during business hours

We will respond to your requests within 30 days and provide updates if additional time is needed. There is generally no charge for exercising these rights, though we may charge a reasonable fee for excessive or repetitive requests.

We use various tracking technologies to provide and improve our Service:

• Essential Cookies: Required for basic Service functionality and security
• Functional Cookies: Remember your preferences and settings
• Analytics Cookies: Help us understand how you use our Service (anonymized)
• Session Management: Maintain your login state and session security
• Security Tokens: Protect against cross-site request forgery and other attacks

You can control cookie settings through:

• Your browser settings (most browsers allow you to block or delete cookies)
• Opt-out tools provided by analytics providers
• Privacy-focused browser extensions and tools

Please note that disabling essential cookies may impact the functionality of our Service.

We use privacy-compliant analytics services to understand Service usage. These services:

• Process only anonymized and aggregated data
• Do not track individual users across other websites
• Provide opt-out mechanisms for users
• Comply with applicable privacy regulations
• Are bound by data processing agreements that protect user privacy

We respect Do Not Track signals and similar privacy preferences. When we detect these signals, we limit data collection to essential Service functionality only.

We use trusted OAuth providers (such as Google) for secure authentication. These providers:

• Handle login credentials securely without us storing passwords
• Provide only basic profile information necessary for account creation
• Allow you to revoke access at any time through their platforms
• Are subject to their own privacy policies and terms of service

We utilize enterprise-grade cloud services that provide:

• HIPAA-compliant infrastructure and data processing
• Advanced security features and compliance certifications
• Data residency controls and geographic restrictions
• Comprehensive audit logging and monitoring capabilities
• Business Associate Agreements for PHI protection

We use PCI DSS-compliant payment processors that:

• Handle all payment card data securely
• Do not share your financial information with us
• Provide fraud protection and secure transaction processing
• Maintain their own privacy policies and security standards

Our AI-powered features utilize secure, healthcare-compliant machine learning services that:

• Process data within HIPAA-compliant environments
• Do not retain or learn from individual user data
• Provide audit trails for all AI processing activities
• Implement appropriate safeguards for PHI protection
• Are covered by comprehensive Business Associate Agreements

Our Service may contain links to third-party websites or integrate with external services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any information.

Your data is processed and stored within the United States in HIPAA-compliant data centers.

We implement strict controls on cross-border access to data:

• Geographic restrictions on data access based on user location and applicable laws
• Role-based access controls that consider jurisdictional requirements
• Audit logging of all international data access activities
• Regular review of access patterns and compliance requirements

We are committed to protecting your data from unauthorized government access. We:

• Respond only to lawful requests with proper legal authority
• Challenge overly broad or inappropriate requests when legally possible
• Provide transparency reports on government data requests (when legally permissible)
• Implement technical measures to prevent unauthorized access
• Notify users of government data requests when legally allowed

Our Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected such information, we will take immediate steps to delete it.

Our Service is designed exclusively for licensed healthcare professionals and authorized personnel. Users must meet professional licensing requirements and age restrictions to access the Service.

When healthcare professionals use our Service to document care for minor patients:

• Additional safeguards apply to protect pediatric patient information
• Users must comply with applicable laws regarding consent and authorization
• Special retention and access controls may apply based on state and federal requirements
• Parents and guardians retain all rights regarding their minor children's health information

We maintain comprehensive incident response procedures to address potential data breaches:

• Immediate containment and assessment of any suspected breach
• Forensic investigation to determine scope and cause
• Risk assessment to evaluate potential harm to individuals
• Coordination with law enforcement and regulatory authorities as required
• Implementation of corrective measures to prevent future incidents

In the event of a breach involving personal information or PHI, we will:

• Notify affected individuals within 60 days of discovery (or sooner as required by applicable law)
• Report to the Department of Health and Human Services within 60 days for PHI breaches
• Notify regulatory authorities within 72 hours where required
• Inform covered entities immediately if we are acting as a Business Associate
• Provide media notification if the breach affects more than 500 individuals

Our breach notifications will include:

• Description of what happened and when the breach was discovered
• Types of information involved in the breach
• Steps we have taken to investigate and address the breach
• Recommendations for individuals to protect themselves
• Contact information for questions and assistance
• Actions we are taking to prevent similar breaches in the future

We continuously work to prevent breaches through:

• Regular security assessments and vulnerability testing
• Employee training on security best practices and threat recognition
• Implementation of advanced threat detection and prevention systems
• Regular review and updating of incident response procedures
• Coordination with cybersecurity experts and law enforcement

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service offerings. We will notify you of material changes through:

• Prominent notice on our website and within the Service
• Email notification to your registered email address
• In-app notifications highlighting key changes
• Updated "Last Modified" date at the top of this policy
• For significant changes, we may require your consent to continue using the Service

Material changes include:

• Changes to how we collect, use, or share personal information or PHI
• Changes to your rights or our legal bases for processing
• Changes to data retention periods or deletion practices
• Addition of new third-party service providers that may access your data
• Changes to our security practices or breach notification procedures
• Changes to international data transfer practices

When we make material changes to this Privacy Policy:

• You will have the opportunity to review the changes before they take effect
• You can choose to accept the changes and continue using the Service
• You can request deletion of your account and data if you disagree with the changes
• For certain types of changes, we may require your explicit consent
• You can contact us with questions or concerns about any changes

We maintain an archive of previous versions of this Privacy Policy, which is available upon request. This allows you to review the evolution of our privacy practices over time.

We have designated a Privacy Officer who is responsible for overseeing our privacy program and handling privacy-related inquiries and requests. Our Privacy Officer can be reached at:

For general questions about our Service or this Privacy Policy, you can contact us at:

You also have the right to file complaints with relevant regulatory authorities:

• For HIPAA-related concerns: U.S. Department of Health and Human Services, Office for Civil Rights
• For general privacy concerns: Your state's Attorney General office
• For California residents: California Privacy Protection Agency
• For residents of other states: Relevant state privacy or consumer protection agencies

We are committed to responding to your privacy inquiries promptly:

• General inquiries: Within 2 business days
• Privacy rights requests: Within 30 days (may be extended by an additional 30 days for complex requests)
• HIPAA-related requests: Within 30 days as required by law
• Urgent privacy concerns: Within 24 hours
• Data breach notifications: According to applicable legal requirements