01 / RETENTION
Audio isn’t kept.
Transcripts stay until you delete them, and configurable retention sets the period for your workflow.
Your patients’ dataProtected
- Where it’s stored
- Canada
- Encryption
- In transit & at rest
- Visit audio
- Not retained
- Used for AI training
- Never
- Business Associate Agreement
- Included
Documented for HIPAA, PIPEDA, PHIPA and Quebec’s Law 25.
Privacy & security
Your patients’ data. Kept in Canada.
Scribeberry stores your data in Canada, encrypts it in transit and at rest, and never uses it for AI training.
Audio is not retained, and you control how long transcripts stay.
Our assessments are published below. Read them with your privacy officer.
Our data practices
What we keep.
What we don’t.
Scribeberry turns your encounter into a draft you can review and edit. Here’s what happens to the data along the way.
02 / STORAGE
Stored in Canada.
Your data is stored in Canada and encrypted in transit and at rest.
03 / AI TRAINING
Never trains a model.
Nothing you submit to Scribeberry is used to train AI. It’s written into our published terms.
HIPAA and PIPEDA
Two systems.
One answer.
Scribeberry supports both HIPAA (United States) and PIPEDA (Canada) compliance for clinics that work across both. Our published statement and assessments describe how patient data is handled under each.
- PIPEDA, plus Ontario’s PHIPA and Quebec’s Law 25
- HIPAA, with a BAA in the published terms
- SOC 2 Type 2, with the report through the Trust Center
Compliance also depends on your clinic’s configuration and provincial requirements. Review these documents with your privacy officer before deployment.
Documents and resources
Read it all.
Before you sign.
Every document your privacy officer is likely to ask for, as a PDF you can download today.
Security
- Privacy Impact AssessmentPDF
- Independent Security Risk Assessment/AuditPDF
- Privacy Compliance StatementPDF
- Patient Informed Consent FormPDF
Download the patient consent template for your clinic’s consent conversation.
Controls
Independently
assessed.
assessed.
About the auditor
Checked by a
privacy veteran.
Our audit was conducted by Ingrid Ruys, who has spent decades in privacy and regulatory work and has led many privacy impact assessments.
Her roles include work at the Alberta Medical Association, Brightsquid and the City of Edmonton.
Ingrid Ruys on LinkedInIn the assessment
Fifteen documents.
One assessment.
Some of these require an NDA because our agreements with third-party providers require it for disclosure. Email hello@scribeberry.com or request access through the Trust Center.
- Anthropic BAA
- Azure Canada Privacy Laws
- Azure Foundational PIA
- Microsoft Data Processing
- HIPAA Questionnaire – Dashboard Summary
- Azure Compliance Offerings
- Azure BAA
- Privacy Policy Scribeberry
- Scribeberry Notice of Privacy Policies
- Comprehensive Scribeberry Guide (PIA)
- Scribeberry PIA Amendment
- Scribeberry Contingency Plan
- Scribeberry HIPAA Sanctions Plan
- HIPAA Compliance Program for Scribeberry
- Terms and Conditions for Scribeberry
Security, in brief
The short version.
For your checklist.
Scribeberry stores Canadian customer data in Canada, encrypts it in transit and at rest, does not retain audio and never uses your data for AI training. A BAA is included in the published terms.
Open the Trust Center- Storage
- Canadian customer data is stored in Canada
- Encryption
- In transit and at rest
- Audio
- Not retained
- Transcripts
- Kept until you delete them, with configurable retention
- AI training
- Your data is never used for AI training
- Agreements
- Business Associate Agreement included in the published terms
- Certification
- SOC 2 Type 2, with the report available through the Trust Center
- Laws addressed
- HIPAA, PIPEDA and provincial laws such as Ontario’s PHIPA and Quebec’s Law 25
Where is data stored?
Your data is stored in Canada. Read our published privacy policy.
Is patient data used to train AI models?
Your data is never used for AI training. Read our published terms.
Is Scribeberry SOC 2 certified?
Yes. Scribeberry is SOC 2 Type 2 certified. Request the report through the Trust Center.
Is data encrypted?
Your data is encrypted in transit and at rest.
How long are audio, transcripts and notes retained?
Audio is not retained. Transcripts are retained until you delete them, with configurable retention.
Where can I find privacy and security documents?
Find our privacy policy, privacy impact assessment, security assessment and BAA on this page. Request additional security reports through the Trust Center or email hello@scribeberry.com.
How should we explain the workflow to patients?
Explain that Scribeberry helps draft the note and that you review it before adding it to the chart. Ask for consent before recording and continue with manual notes if the patient declines. See our consent guide for a sample conversation and documentation steps.
Berry, with your approval
Nothing sent
without you.
Berry prepares forms, referrals and intakes, then waits for your go-ahead. Same protections as the rest of Scribeberry.
