Scribe — Privacy Policy
DRAFT for legal review. Items marked [CONFIRM] are business decisions. Version 1.0 draft · prepared 2026-09-03
This policy explains how [CONFIRM — company name, ABN] ("we") handles personal information in connection with Scribe. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Health information is sensitive information under the Privacy Act and attracts the highest level of protection. Almost everything Scribe touches is health information.
1. The short version
Scribe runs on the pharmacy's own computer. In its standard configuration, consultation audio is transcribed on that machine and is not sent to us or to anyone else. The recording is discarded as soon as it has been transcribed. We do not receive your patients' records, and we do not use them to train anything.
The pharmacy — not us — is the entity that holds the patient record. This policy covers what we do; the pharmacy has its own privacy obligations to its patients.
2. Who handles what
The pharmacy is the APP entity responsible for the patient's health record. It collects the consultation, obtains consent, keeps the note, and answers the patient's access and correction requests.
We supply the software. In a standard on-premises installation we do not collect, hold or have access to any patient information at all.
[CONFIRM] If you offer a hosted plan, this changes: you would then hold patient information on behalf of the pharmacy, and this section must say so plainly, naming where the data is stored.
3. What information is involved
Handled by Scribe on the pharmacy's device:
- consultation audio — transient, deleted immediately after transcription, never retained
- the transcript and the drafted note
- patient identifiers entered or imported: name, date of birth, address, Medicare/DVA number
- medication history read from the pharmacy's own dispensing system, or from a medication profile the pharmacist uploads
- the pharmacist's own details, including their AHPRA registration number
- booking details a patient enters on the pharmacy's public booking page: name, date of birth, contact phone and email, and the service requested
Collected by us:
- your account details as a customer: name, business name, email, phone, billing details
- support correspondence you send us
[CONFIRM]whether the software reports any diagnostics or usage telemetry to you. If it does, say exactly what and let people turn it off. If it does not — which is the current design — say so here, because it is a genuine selling point.
4. Consent
Scribe requires the pharmacist to confirm the patient has consented before recording starts. This is enforced in the software, not merely suggested. The consent wording shown on screen changes depending on whether a cloud language model is enabled, because that changes where the information goes.
Obtaining and recording valid consent remains the pharmacy's responsibility.
5. Where information goes
Standard configuration — nowhere. Audio is transcribed locally. Note drafting uses a language model running on the same machine. Nothing leaves the premises.
If the pharmacy enables a cloud language model. Consultation text — not audio — is sent to that provider for processing. This is off by default, the pharmacy turns it on deliberately, and the app states on screen when it is active. The pharmacy should satisfy itself about that provider's terms, including whether the provider is overseas, which engages APP 8 (cross-border disclosure).
If the pharmacy uses the public booking page. Booking details travel to wherever the pharmacy has chosen to host it.
We do not sell personal information. We do not disclose it for marketing.
6. We do not train on your data
We do not use patient information, consultations, transcripts or notes to train, fine-tune or evaluate any machine learning model. Scribe's speech models were trained before deployment on a separate corpus and do not learn from use.
7. Security
- Consultation audio is deleted immediately after transcription and never written to long-term storage.
- In hosted mode, access requires a login; passwords are stored as scrypt hashes, never in plain text. Sessions expire after 60 minutes idle and 12 hours absolute.
- Each pharmacist's consultation records are stored separately from other users'.
- A pharmacy's records are scoped to that pharmacy. A user of one pharmacy cannot read another's.
- Dispensing-system access is read-only, enforced at the database permission level as well as in code, so Scribe cannot alter a dispensing record even if instructed to.
[CONFIRM]device-level controls you require of customers: disk encryption, screen lock, who may physically use the consult-room PC.
Security depends partly on the pharmacy: keeping the device patched, controlling who can use it, and not sharing logins.
8. How long information is kept
Audio: not kept. Transcripts and notes: kept by the pharmacy for as long as its professional record-keeping obligations require — generally 7 years, and for a patient under 18, until they turn 25. Scribe does not delete these automatically; retention is the pharmacy's decision.
Our customer account records: for the life of the account and then as long as tax and corporate law require.
9. Access and correction
A patient wanting access to, or correction of, their health record should ask the pharmacy — the pharmacy holds it, and Scribe gives it the tools to produce and amend it.
If you are our customer and want access to or correction of the information we hold about you, contact us at the address below. We will respond within 30 days. If we refuse, we will tell you why in writing.
10. Data breaches
We maintain a data breach response plan aligned to the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act). Where a breach is likely to result in serious harm, affected individuals and the Office of the Australian Information Commissioner are notified. Details: DATA-BREACH-RESPONSE-PLAN.md.
11. Complaints
Contact us first at [CONFIRM — privacy contact email]. We will acknowledge within 5 business days and respond within 30 days.
If you are not satisfied, you may complain to the Office of the Australian Information Commissioner: oaic.gov.au · 1300 363 992.
12. Changes
We will post any change here and, for material changes, notify customers directly.
Privacy contact: [CONFIRM — name/role, email, postal address] Last updated: [CONFIRM — date of publication]