Security and privacy
Care deserves thoughtful protection.
Explore how Transcribe Health protects health information, supports your team’s responsibilities and handles data throughout a visit.
At a glance
Clear safeguards for your clinic.
Agreements for your clinic
Review the BAA and DPA that set out how health information is handled.
Protected access
Encryption, role-based access, audit logs and configurable multi-factor authentication help protect information.
Data and privacy
Clinical records are stored in Canada, with AI processing governed by your organisation’s settings.
Clinical review
Your care team reviews AI-generated content and retains responsibility for clinical decisions.
Your information
Data residency and retention
All persistent data, including recordings, transcripts and notes, is stored in Canada on infrastructure we operate. Transcription runs on our own servers in Canada; audio is not sent to a cloud transcription service.
Where AI processing happens
Australian clinical AI requires an eligible processing route and the applicable approved overseas processing arrangements. Australia-only AI can be unavailable where no Australian provider is configured. Records and transcription remain on Canadian infrastructure.
Retention you control
Audio recordings are deleted automatically 90 days after transcription. Transcripts and session records are kept for 7 years and then deleted automatically. You can turn on an earlier-deletion policy (1 to 30 days, off by default) that removes sessions, recordings, transcripts and documents sooner. Audit logs are kept for at least 6 years.
From visit to note
How information moves.
Here is a typical clinical documentation workflow, from a visit to a note your team can review.
- 01
Capture
With patient consent, the clinician records a visit using Transcribe Health.
- 02
Transcribe
Speech-to-text transcription runs on infrastructure we operate in Canada.
- 03
Assist
The transcript and relevant context support AI-generated drafts, subject to your organisation’s processing settings.
- 04
Review
A clinician reviews the output and keeps the appropriate record in the clinic’s EHR.
We never use customer content, or anything de-identified, anonymized, aggregated or synthesized from it, to train or improve any AI model, ours or a third party's. Read the privacy policy
Safeguards at work.
Administrative safeguards
- Designated Security Officer
- Role-based access control
- Scheduled security awareness training
- Documented incident response procedures
- Regular security evaluations
Technical safeguards
- Multi-factor authentication, which clinic admins can require for every member
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Audit logging of access to health information
- Security monitoring and alerting
- Automatic sign-out after 12 hours
Agreements and responsibilities.
Understand how Transcribe Health supports your clinic and review the agreements that govern our services.
HIPAA (United States)
For US clinics, Transcribe Health acts as a Business Associate under HIPAA and the HITECH Act. A Business Associate Agreement is accepted electronically before any session can run, on every plan.
PIPEDA and provincial health privacy law
Transcribe Health is designed to meet the Personal Information Protection and Electronic Documents Act (PIPEDA) and its fair information principles, and to support clinics under provincial health privacy laws (PHIPA in Ontario, PIPA in British Columbia and Alberta, and Alberta’s Health Information Act). Your clinic remains the custodian of its patients’ records; we process them on your behalf.
Shared responsibilities
Your clinic
- Obtain valid patient consent and authorisation
- Train staff on their privacy obligations
- Control who in your clinic can access the system
- Report suspected incidents to us within 24 hours
- Keep your DPA and BAA acceptance current
Transcribe Health
- Secure hosting and processing of health information
- Administrative, technical and physical safeguards
- Incident detection, response and notification
- Regular security assessments and updates
- Ongoing compliance monitoring
Talk to our team.
Questions about privacy, security or agreements? Reach the right team directly.
- Privacy
- privacy@transcribe.health
Privacy questions, access and correction requests, and privacy impact assessment requests
- Security
- security@transcribe.health
Security incidents and vulnerability reports
- Compliance and agreements
- compliance@transcribe.health
BAA, DPA, security questionnaires and vendor reviews
- Legal
- legal@transcribe.health
Contract notices and legal correspondence