Privacy Policy

1. Introduction

Sampson Scribe LLC ("Sampson," "we," "us," or "our") provides a medical documentation tool designed for healthcare providers. This Privacy Policy explains how we collect, use, store, and protect information when you use our mobile application, web service, and marketing website (collectively, the "Service").

By using Sampson, you agree to the collection and use of information in accordance with this policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address and legal name
• Authentication credentials (securely hashed)
• The outcome of an identity check against the public CMS NPPES registry, if we ask you to enter your NPI for that purpose. We do not store the NPI itself (see Terms §3.2).
• Account preferences and settings (e.g., custom physical-exam template)
• Billing records: your subscription status, plan, and the identifiers our payment processor (Stripe) assigns to your customer record and payment method. Your card number is entered directly into Stripe's secure form and never reaches our servers; we do not store card numbers or expiration dates. We keep a one-way fingerprint of the payment method so a free trial cannot be claimed repeatedly.

2.2 Audio Recordings

When you use Sampson to document patient encounters, we temporarily collect:

• The audio recording of your dictation (transient — see retention below)
• The transcription generated from that recording
• The clinical note generated from the transcription

Audio retention: Audio files are uploaded to a private, encrypted S3 bucket for processing, then permanently deleted from our servers within 72 hours of upload. We do not retain raw audio long-term, and we do not copy audio to any other system for analysis or training.

2.3 Patient Information

The clinical notes you create may contain patient information that you dictate, including:

• Patient demographics (age, gender)
• Chief complaints and symptoms
• Medical history, medications, and allergies
• Physical examination findings
• Diagnostic results and clinical assessments

These notes live in your private Sampson account and are visible only to you. They are not used to train any model, are not aggregated, and are not analyzed by anyone other than you.

You are responsible for ensuring that any patient information you input complies with applicable healthcare privacy regulations (such as HIPAA in the United States).

2.4 Operational & Compliance Logging

We automatically collect a small amount of technical metadata required to operate the Service safely and to meet HIPAA audit-trail obligations:

• Device type, operating system, and app version
• Crash reports and uncaught errors (captured by our own backend with text content scrubbed; no third-party error tracker is used)
• Audit-log entries for each note generation: timestamp, your user ID, the patient ID, model used, token counts, and timing information — required for HIPAA-style access logging
• Per-account usage counters (number of notes generated, last-active date) for billing/quota and abuse prevention
• Transcription quality metadata (overall confidence score, word count) so the app can flag potentially unreliable transcripts back to you

None of the above contains the text of your transcripts or notes. This logging exists to keep the Service running and to satisfy compliance — not to study your content.

2.5 What We Do Not Collect by Default

Unless your account has explicitly opted in, the following are never saved to any analytics, training, or aggregation store:

• Note text deltas (what you edited and what Sampson originally generated)
• Individual flag dismissals or corrections
• Transcript text outside your own patient record
• Per-encounter audio retention beyond the 72-hour window

These are gated server-side by a feature flag (dataCollection) that is disabled for every account by default. Even if a client mistakenly sends this data, the server discards it for non-opted-in users.

2.6 Marketing Website Analytics and Advertising

Our public marketing pages (the home page, pricing, blog, and signup pages) use advertising measurement pixels from Meta (Facebook) and OpenAI (ChatGPT Ads) so we can tell which ads bring clinicians to us. These pixels set cookies, record the page you visited, your IP address, and browser information, and may match that to your account on those platforms under their own privacy policies. When you start a trial or subscribe, we may also report that event to those platforms server-side; for OpenAI Ads this includes a one-way hash of your email address, and for Meta it includes only the click identifier, IP address, and browser information — never your email, name, or phone number.

These pixels never load on clinical pages. They are restricted to a fixed list of marketing routes, they are disabled for anyone signed in to a clinician account (even on a marketing page), and they are disabled whenever any clinical content is rendered. No patient information, note text, or in-app activity is ever sent to an advertising platform. You can limit pixel tracking with your browser's cookie controls, an ad blocker, or the ad settings in your Meta or OpenAI account.

3. How We Use Your Information

We use the collected information only to:

• Provide and maintain the Service
• Transcribe your audio recordings into text (transient — deleted from our servers within 72 hours of upload)
• Generate clinical documentation from your dictations
• Sync your notes across your own devices
• Send you service-related notifications (e.g., "Note ready")
• Investigate crashes and operational errors
• Respond to your support requests
• Detect and prevent fraud or abuse
• Satisfy our HIPAA audit-logging obligations

We never use your data to train our models unless you specifically opt in — every user is opted out by default. Your audio recordings, transcriptions, and clinical notes are never used to train third-party models. Every AI provider we use is under a written agreement that explicitly prohibits it from using your content for model training. See Section 5 for the current providers.

4. Data Storage and Security

4.1 Where We Store Data

Your data is stored using the following services:

• Firebase (Google Cloud) - Authentication and database storage
• Amazon Web Services (AWS) - Temporary audio file storage and processing

We store your data with infrastructure providers (AWS and Google Cloud/Firebase) that maintain SOC 2 compliant data centers located in the United States.

4.2 Security Measures

We implement industry-standard security measures:

• Encryption in transit (TLS/SSL) for all data transfers
• Encryption at rest for stored data
• Secure authentication with Firebase Auth
• Automatic session timeout — you are signed out after 2 hours of inactivity on a desktop or shared workstation. On your own mobile device the in-app window is 7 days, because there your device's lock screen (Face ID, Touch ID or passcode) is the primary protection. Sessions are never ended while a recording or upload is still in progress.
• Access controls limiting data access to authorized personnel
• Ongoing internal security review and automated monitoring

4.3 Data Retention

• Audio recordings (our servers): Deleted from our servers within 72 hours of upload
• Audio recordings (on your device): A copy is also cached on the device that made the recording, so that a recording is not lost if the upload fails mid-shift — you are never asked to re-record an encounter that already happened. That local copy is purged 24 hours after the recording is confirmed uploaded, and in every case within 72 hours. It is held in the app's private, operating-system-protected storage on a device you control, and it is cleared when you sign out.
• Clinical notes & transcripts: Automatically deleted 14 days after creation to minimize retained patient information. You can also delete a note sooner at any time. Notes are never copied or moved out of your account for analytics, advertising, or training. If we reasonably suspect a violation of the Terms of Service, we may review content as described in Terms §4.2 (Monitoring & Abuse Review), preferably on de-identified copies.
• Operational / HIPAA audit logs: Timestamps, user IDs, patient IDs, and model-call metadata are retained for 6 years to meet HIPAA audit-log retention requirements. These logs never contain the text of your transcripts or notes.
• Account data: Retained while your account is active
• Custom instruction history: Retained for up to 10 years for compliance, security, and legal defense purposes (see Terms of Service Section 9)
• Quality-improvement data (opt-in only): If you have explicitly opted in (see Section 2.5), correction events and edit deltas may be retained indefinitely. By default this is disabled for every account.

Account Deletion: You can permanently delete your account at any time using the Delete Account option in the app's Settings screen (or by contacting us). When you do, we delete your clinical notes and personal profile, but we retain HIPAA audit-log records and custom instruction audit records (including your email and user ID) for the retention periods described above to protect against legal claims and maintain system integrity.

5. Third-Party Services

We use the following third-party services to provide the Service. This is our current list. We may replace a provider (for example, move to a different speech-to-text or language-model vendor) when doing so improves accuracy, speed, reliability, or cost. Any replacement must meet the same conditions: a signed BAA or equivalent data-processing agreement, no use of your content for model training, and no retention beyond what is needed to provide the service. We update this section no later than the change takes effect.

Equal protection. Every third party that receives patient information is contractually bound — through Business Associate Agreements (BAAs) and/or Data Processing Addendums (DPAs) — to safeguard it with protections at least equal to those described in this Privacy Policy, to use it solely to provide their service to us, and never to use it to train their models or share it further. We send only the minimum each service needs to function: your audio to the transcription provider, and your transcript to the note-generation provider. Stripe and Resend handle only your account and billing details, never patient information. The advertising pixels described in Section 2.6 run only on our marketing pages and never receive clinical data.

6. Your Rights

You have the right to:

• Access: Request a copy of your data
• Correction: Update or correct your information
• Deletion: Delete individual notes, or permanently delete your entire account at any time using the Delete Account option in the app's Settings screen
• Data Portability: Export your notes in a standard format
• Withdraw Consent: Stop using the Service at any time

To exercise these rights, contact us at contact@sampsonscribe.ai.

7. Healthcare Provider Responsibilities

Sampson is a documentation tool designed for licensed healthcare providers. As the user, you are responsible for:

• Ensuring your use of Sampson complies with applicable laws and regulations
• Reviewing and verifying all generated clinical notes before use
• Obtaining any required patient consents for recording
• Maintaining appropriate safeguards for patient information
• Recognizing that Sampson is a documentation-assistance tool only and does not provide clinical recommendations, diagnoses, or decision support; all clinical decision-making remains your sole responsibility

Sampson operates as a Business Associate under HIPAA when processing Protected Health Information on behalf of healthcare providers (Covered Entities). Every account holder executes our Business Associate Agreement when accepting the Terms of Service; each accepted version is archived with its version number and cryptographic hash, and a copy is available from your account at any time. We maintain signed BAAs with all third-party subprocessors that handle PHI. Practices or organizations that need a group BAA or a countersigned copy can contact us at admin@sampsonscribe.ai.

8. Children's Privacy

Sampson is intended for use by healthcare professionals and is not directed at individuals under 18 years of age. We do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Clarifications that do not change our data practices are posted here with an updated "Last updated" date. If we change what we collect or how we use it, we will notify you by email or in the app before the change takes effect, and where the change requires it we will ask for your fresh consent. Replacing a service provider with another that meets the conditions in Section 5 is not such a change; we update the list in Section 5 no later than the switch. Our commitments never to sell your data and never to train AI models on your content without your explicit opt-in are described in the Terms of Service and cannot be changed by a quiet update to this page.

10. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: