Legal

Privacy Policy

How we collect, use, and protect information when you use ScribeCam.

Effective Date: September 30, 2026

1. Introduction

ScribeCam, Inc. ("ScribeCam," "we," "us," or "our") operates the ScribeCam platform, including our website at www.scribecam.com, mobile applications, and web application (collectively, the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect information about you when you use the Service.

By using the Service, you acknowledge and understand how we collect, use, and disclose information as described in this Privacy Policy. If you do not agree with our practices, do not use the Service.

This Privacy Policy applies to all users of the Service, including registered account holders, report recipients, and visitors to our website. It does not apply to third-party websites or services that may be linked from our Service. We process personal information to perform our contract with you, to meet our legal obligations, and for our legitimate business interests in operating and improving the Service. Where we rely on your permission for a specific feature — such as access to your device’s precise location or camera — we ask for it in the application and you can withdraw it at any time in your device settings.

We do not use your data to profile you for advertising, credit, employment, insurance underwriting, or other automated decision-making purposes unrelated to the Service.

2. Information We Collect

2.1 Information You Provide Directly

  • Account registration information: name, email address, and password.
  • Subscription and billing information: processed by Stripe, Inc. on our behalf (see Section 6).
  • User-generated content: video recordings, photographs, and audio narration you upload or capture through the Service.
  • Report content: text, observations, findings, and metadata included in or generated from your uploaded content.
  • Contacts: contact details you enter manually or import from your device’s address book (only the people you select—we do not upload your entire address book). Contacts are stored on our servers and synchronized across our mobile and web applications so you can address and share reports from either.
  • Communications: messages you send to us via contact forms, email, or support channels.

2.2 Information Generated Automatically

  • Device identifiers, browser type, operating system, and IP address.
  • Usage data: pages visited, features used, timestamps, and interaction patterns.
  • Log data: server logs associated with your account activity.
  • Location data: approximate location derived from IP address; and, only if you explicitly grant permission in our mobile application, precise device location sampled continuously while you are recording — latitude, longitude, altitude, accuracy, heading, and speed.
  • Analytics data: we use two analytics services on our public website (scribecam.com). The first counts page views and shows which pages visitors reach and where they arrived from; it is served from our own domain and sets no cookies. The second is Google Analytics, provided by Google LLC and loaded through Google Tag Manager. Google Analytics sets cookies in your browser (for example, cookies named _ga) and collects information about your visit, including the pages you view, the page that referred you, your approximate location derived from your IP address, your device and browser type, and interactions such as scrolling, clicks on links that leave our site, file downloads, video engagement, and when a form is started or submitted. It does not collect what you type into a form. We have not enabled Google's advertising features for Google Analytics. Google's use of this information is described at How Google uses information from sites or apps that use our services. You can prevent Google Analytics from collecting information about you by blocking cookies in your browser or by installing the Google Analytics Opt-out Browser Add-on. Until September 10, 2026 we used a third-party analytics tool on our public website that recorded on-page activity; we removed it from the Service on that date. We no longer use session-recording or session-replay tools on our website or in our web application.
  • Do Not Track: ScribeCam's Service does not currently respond to browser "Do Not Track" signals. We will update this disclosure if our practices change. Google Analytics, described above, records activity on our public website only, using cookies set for our own domain; we have not enabled Google signals or any Google advertising feature, and we do not allow any third party to use the Service to track your online activities across other websites.

2.3 Information From Third Parties

  • If you authenticate through a third-party single sign-on provider, we receive your name and email address from that provider.
  • Report recipients who create a free Report Only account provide their email address.

2.4 Data We Do Not Collect

ScribeCam's Service is not designed or certified to receive, process, or store the following categories of regulated data. You are prohibited from uploading these data types under our Terms of Use:

  • Protected Health Information (PHI) as defined under HIPAA. ScribeCam is not a HIPAA Business Associate and has not executed a Business Associate Agreement (BAA).
  • Financial account numbers, payment card data (beyond subscription billing handled by Stripe), or bank routing numbers regulated under GLBA or PCI-DSS.
  • Government-issued identification numbers, Social Security numbers, or biometric identifiers regulated under state biometric privacy laws.
  • Personal data of EU or UK residents where processing would require ScribeCam to act as a data processor under GDPR or UK GDPR without an applicable Data Processing Agreement in place.

If you believe regulated data was inadvertently uploaded, contact privacy@scribecam.com immediately.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide, operate, and maintain the Service, including generating automated reports from your uploaded content.
  • To process your uploaded video, photos, and narration through our AI-powered report generation pipeline.
  • To manage your account, process subscriptions, and deliver customer support.
  • To send transactional communications, including report delivery notifications, account alerts, and service updates.
  • To generate and track report analytics as described in the Service (e.g., who accessed your report and when).
  • To improve, test, and develop the Service using aggregated and de-identified operational metrics. De-identified data is processed in a form that cannot reasonably be used to identify any individual. We take reasonable measures to keep it that way, we publicly commit not to attempt to reidentify it, and we require any recipient of it to do the same.
  • To review a limited sample of reports, and the content they were generated from, in order to check and improve the quality of the Service. See Section 4.2.
  • To detect, investigate, and prevent fraud, abuse, and security incidents.
  • To comply with legal obligations and enforce our Terms of Use.

We do not use your personal information or User Content to train or fine-tune AI models without your explicit written consent.

4. Artificial Intelligence Processing

ScribeCam's core functionality relies on artificial intelligence and machine learning technology to convert your video, photographs, and narration into structured reports. By using the Service, you acknowledge and agree to the following:

4.1 AI Sub-Processors

To deliver our report generation Service, we transmit elements of your uploaded content — including video frames, photographs, audio transcriptions, and derived text — to third-party artificial intelligence providers acting as sub-processors. These are commercial providers of large language and multimodal models, together with the model-routing gateways used to reach them. A current list of our AI sub-processors is available to customers on request at privacy@scribecam.com.

We access these providers under their standard commercial API terms rather than negotiated agreements. Where we call a model provider directly under our own commercial account, that provider’s standard terms do not permit our customers’ content to be used to train its models. Where we reach a model through a routing gateway, training and data sharing are governed by account settings rather than by the terms themselves, and we have turned off every data-sharing and training setting the gateway makes available to us. That gateway transmits your content to the model provider selected to serve the request. Providers may still retain request data for a limited period for abuse monitoring, security, and legal compliance under their own terms. We transmit your content to these providers only for the purpose of generating your reports. Where we call a model provider directly, that processing takes place in the United States; where a request is routed through a gateway, the gateway may select a provider endpoint outside the United States, and we do not currently control the region in which a routed request is served.

4.2 Automated Processing and Human Access

Report generation is fully automated. ScribeCam personnel do not read every report or review all uploaded media, and access your content only for the specific purposes listed below. We do not use your content to infer characteristics about you unrelated to the Service, or to market to you.

A limited number of ScribeCam personnel we authorize can access your content, and do so only for the following reasons:

  • to respond to a support request you have submitted;
  • to diagnose and fix a technical problem affecting the Service or your reports, such as a recording or upload that did not complete, or a report that failed to generate;
  • to review a limited sample of reports, and the content they were generated from, to check and improve the quality of the Service;
  • to investigate suspected abuse, fraud, or a security incident; or
  • to comply with a legal obligation, valid legal process, or governmental request, or to protect the rights, property, or safety of ScribeCam, our users, or the public, as described in Section 7.3.

Access is limited to personnel whose role requires it. Content may also be accessed in connection with a business transfer as described in Section 7.4.

Separately, our error-monitoring service records diagnostic information when something goes wrong in the Service. Those records can include fragments of your content — for example, part of a transcript or a report field that was being processed when the error occurred. They are retained only as long as needed for diagnosis and are available to the same limited personnel under the same controls.

4.3 Automated Decision-Making

The report output is generated automatically from your inputs. ScribeCam does not make legally significant decisions about you based on automated processing. All report content is produced at your direction and for your use.

5. Data Storage and Infrastructure

Your data is stored and processed using third-party infrastructure and service providers. Your account data, uploaded content, and generated reports are stored and processed in the United States, except that an AI request routed through a gateway may be served by a provider endpoint outside the United States, as described in Section 4.1. Our DNS and network-security provider operates a global network and may process connection information such as your IP address at a location near you. These providers fall into the following categories:

  • Cloud object storage — your uploaded video, photos, audio, and generated report files.
  • Database infrastructure — account data, report metadata, and access records.
  • GPU and general compute — where your uploaded video, photographs, and audio are processed to generate reports.
  • Web application hosting and content delivery.
  • DNS and network security, including automated protection against abuse and automated sign-in attempts.
  • Transactional email delivery.
  • Error monitoring and performance diagnostics.
  • Website and application analytics — page-view and traffic measurement, including Google Analytics on our public website.
  • Mobile application delivery and push-notification relay — used to build and distribute our mobile application and to deliver notifications to your device.

A current list of the specific providers within each category is available to customers on request at privacy@scribecam.com.

ScribeCam is designed to store and process data in the United States. Apart from gateway-routed AI requests as described in Section 4.1, we do not transfer personal data outside the United States for storage or processing purposes.

6. Payment Processing

ScribeCam does not collect or store your payment card information. Consumer subscription payments are processed by Stripe, Inc. ("Stripe"). By providing payment information, you authorize Stripe to process charges on our behalf in accordance with Stripe's Privacy Policy and Terms of Service. Payment card data is handled directly by Stripe in accordance with PCI-DSS standards.

For enterprise customers billed directly by ScribeCam, invoicing is also processed through Stripe. We collect billing contact name, company name, billing address, and email address for invoice delivery purposes only.

7. How We Share Your Information

We do not sell your personal information, as that term is defined under applicable law. We do not share your personal information with third parties for their independent marketing or advertising purposes. We share information only in the following circumstances:

7.1 Service Providers and Sub-Processors

We share information with vendors and service providers who perform services on our behalf, including the categories of infrastructure and service providers described in Section 5 and the AI sub-processors described in Section 4.

Most of these providers act as our service providers or processors. Under the terms that govern our accounts with them, they may use your personal information only to provide their services to ScribeCam, and not for their own independent purposes.

Four of our providers work differently, and we want to be clear about them:

  • Our mobile application delivery and push-notification provider acts as an independent controller of the information it receives, under its own privacy policy. When we send a notification to your device, that provider receives your device’s push token and the text of the notification, which may include the title of a report and the name of a person who has shared a report with you. It does not receive your uploaded video, photographs, audio, or report content.
  • Our database infrastructure provider processes your data only on our instructions and is barred by its terms from training artificial intelligence on it. Its standard terms do, however, allow it to create aggregated, anonymized statistics from the data it hosts, to own those statistics, and to share them with third parties including its other customers. Those statistics do not identify you and do not include your uploaded media or report content.
  • Our model-routing gateway does not prohibit training on the content passing through it in its standard terms. Whether content may be used for training or shared onward is controlled by settings on our account rather than by the terms themselves, and we have turned off every data-sharing and training setting it makes available to us. See Section 4.1.
  • Our payment processor, Stripe, acts as an independent controller for parts of what it does — including fraud prevention, risk scoring, and its own legal and regulatory compliance obligations — and uses the information it collects for those purposes under its own privacy policy. We do not control those uses. See Section 6.

7.2 Report Recipients

When you share a report, the recipient will have access to the report content you have chosen to share. Report recipients must create a free Report Only account to access the report. You control who has access to your reports and may revoke access at any time through the Service.

7.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of ScribeCam, our users, or the public. Where permitted by law, we will provide you with reasonable notice before complying with such requests.

7.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.

8. Data Retention

We retain your account information and User Content for the duration of your active account and for up to ninety (90) days following account closure or termination, after which we delete your User Content and generated reports within thirty (30) days. A verified deletion request is honored within thirty (30) days regardless of that period, except for data we are required to retain under applicable law.

You may request deletion of specific content prior to the end of your retention period by contacting us at privacy@scribecam.com. We will process deletion requests within thirty (30) days of receipt, subject to our legal retention obligations.

When your account or a report is deleted, we erase your recordings, photographs, reports, and personal information from our active systems, and residual copies held in encrypted backups are overwritten in the normal backup rotation within ninety (90) days. For each sealed report we also keep a verification record: a randomly assigned Bundle ID, a SHA-256 cryptographic fingerprint of the report, the seal and registration dates, internal report identifiers, a reference to your account, and basic details of the device and app version used to seal it (installation ID, device model, and operating system). This record cannot be used to reconstruct your content, and our public verification page at app.scribecam.com/verify returns only whether the Bundle ID and fingerprint the person checking already holds match a sealed report, and the date it was sealed — nothing else from the record, and no indication of whether an unmatched Bundle ID exists. We keep this record for as long as your account exists, so that reports you have already delivered remain independently verifiable; it is deleted when your account is deleted.

9. Data Security

We implement commercially reasonable administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, destruction, and loss. These measures include encrypted data transmission (TLS), access controls and authentication requirements, role-based access management for internal personnel, and security monitoring of our infrastructure.

No method of transmission over the internet or electronic storage is completely secure. In the event of a data security incident affecting your personal information, we will notify you without undue delay and as required by applicable law.

10. Your Rights and Choices

10.1 Access, Correction, and Deletion

You may access and update your account information through your account settings. You may request deletion of your account and associated data by contacting us at privacy@scribecam.com. We will process account deletion requests within thirty (30) days of receipt, subject to our retention obligations.

10.2 Rights for All Users

Regardless of your state of residence, ScribeCam voluntarily extends the following rights to all U.S. users:

  • The right to request access to the personal information we hold about you.
  • The right to request correction of inaccurate personal information.
  • The right to request deletion of your personal information, subject to our legal retention obligations.
  • The right to receive a copy of the personal information you have provided to us in a portable format, where technically feasible.

To exercise any of these rights, contact us at privacy@scribecam.com.

10.3 Report Access Control

You control who can access your generated reports. You may revoke access for any report recipient at any time through the Service.

10.4 Communication Preferences

You may opt out of non-transactional marketing communications at any time by following the unsubscribe instructions in those messages. You cannot opt out of transactional communications necessary for the operation of the Service.

11. California Privacy Rights (CCPA/CPRA)

This section applies to California residents and supplements the rest of this Privacy Policy. ScribeCam complies with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA").

11.1 Categories of Personal Information Collected

  • Identifiers: name, email address, IP address, device identifiers, online identifiers such as analytics cookie IDs, and account ID.
  • Contact information: names, email addresses, and phone numbers of report recipients you add or import.
  • Commercial information: subscription records and transaction history.
  • Internet or other electronic network activity: usage data, log data, and interaction data.
  • Audio and visual information: video recordings, photographs, and audio narration you upload.
  • Geolocation data: approximate location derived from IP address, and — only where you have granted permission in our mobile application — precise device location sampled continuously throughout a recording session, including latitude, longitude, altitude, accuracy, heading, and speed. Precise geolocation is treated as sensitive personal information under the CCPA/CPRA; see Section 11.6.
  • Inferences: report analytics and usage patterns derived from your activity.

11.2 Purposes for Collection

We collect the categories of personal information identified above for the business and commercial purposes described in Section 3 of this Privacy Policy.

11.3 Sharing and Disclosure

We do not sell personal information as defined under the CCPA/CPRA. We do not share personal information for cross-context behavioral advertising.

In the preceding twelve months, we have disclosed personal information for business purposes to the following categories of third parties: cloud object storage providers; database infrastructure providers; compute and artificial-intelligence processing providers; web application hosting and content delivery providers; DNS and network security providers; transactional email providers; error monitoring and diagnostics providers; website analytics providers; mobile application delivery and push-notification providers; payment processors; and, where legally required, governmental or regulatory authorities. The categories of personal information disclosed for business purposes in that period were: identifiers; contact information; commercial information; internet or other electronic network activity; audio and visual information; geolocation data; and inferences.

Most of these parties act as service providers or processors under written terms that prohibit them from using your personal information for any purpose other than providing services to ScribeCam. As explained in Section 7.1, our mobile application delivery and push-notification provider, our payment processor, our database infrastructure provider, and our model-routing gateway are partial exceptions, each in a different way and each described in that section.

11.4 Your California Rights

  • Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you.
  • Right to Delete: You may request deletion of personal information we have collected from you, subject to certain exceptions permitted by law.
  • Right to Correct: You may request correction of inaccurate personal information we maintain about you.
  • Right to Opt-Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising.
  • Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted under CCPA/CPRA without your consent.
  • Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

11.5 How to Submit a California Rights Request

To submit a verifiable consumer request under the CCPA/CPRA, contact us at privacy@scribecam.com with the subject line "California Privacy Rights Request." We will verify your identity before processing your request and respond within forty-five (45) days of receipt. You may also use an authorized agent to submit a request on your behalf. The agent must provide written permission signed by you, and we may ask you to verify your own identity directly with us and to confirm that you granted the agent permission.

11.6 Sensitive Personal Information

The audio, video, and photographic content you upload to the Service, and the precise device location recorded during a session where you have granted that permission, may constitute sensitive personal information under the CCPA/CPRA. We collect and use this content to provide the Services you have requested, and otherwise only for the limited purposes described in Sections 4.2 and 7.3. We do not use this content to infer characteristics about you unrelated to the Service or for advertising purposes.

12. Children's Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that a child under 13 has provided personal information to us, please contact us at privacy@scribecam.com.

13. Third-Party Links and Services

The Service may contain links to third-party websites or services. This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email to the address associated with your account, by posting a prominent notice within the Service, or by updating the effective date at the top of this policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

ScribeCam, Inc. Attn: Privacy Officer Santa Rosa, California Email: privacy@scribecam.com Web: www.scribecam.com/privacy

For California-specific requests, include "California Privacy Rights Request" in your subject line. For data security incidents or urgent privacy concerns, contact privacy@scribecam.com with "Privacy Incident" in your subject line.