StenoHealth provides an AI assisted clinical documentation platform for healthcare organizations. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use our website, the StenoHealth platform (“Platform”), and related services.

By using the Platform or engaging with our services, you agree to the practices described in this Privacy Policy. Questions may be directed to privacy@stenohealth.com.

1. Scope and Our Role

1.1 Two Different Roles

Processor / Business Associate. When we process personal information or protected health information ("PHI") about patients on behalf of a healthcare provider, health plan, or other covered entity ("Customer"), we act solely as that Customer's processor (and, where HIPAA applies, its Business Associate). In this role, the Customer, not StenoHealth, determines the purposes and means of processing, and remains the controller/covered entity for that data. Our handling of that information is governed by our Business Associate Agreement ("BAA") and/or data processing terms with the Customer, and by HIPAA and applicable privacy law, not by this Privacy Policy. If you are a patient with questions about your medical records or other personal information held by your healthcare provider, please contact your provider directly, since your provider controls that information and directs our processing of it.

Controller. When we collect information directly for our own purposes, such as website visitor data, marketing contacts, account administration data, and job applicant information, we act as the controller (or "business," as applicable under state privacy law) responsible for that information. This Privacy Policy governs that processing.

1.2 What This Policy Does Not Cover

This Privacy Policy does not apply to the privacy practices of our customers, to third party websites or services we link to, or to PHI to the extent governed by a BAA.

2. Information We Collect

Account and Organization Information

Name, work email address, phone number, job title, organization name, role and permission level, and billing contact details.

Health Information Submitted Through the Platform

When authorized users document health interactions, we may process audio recordings, transcripts, clinical notes, patient identifiers, encounter metadata, and related records. This information is generally PHI and is processed on behalf of, and at the direction of, our healthcare customers under a BAA.

Usage and Device Data

IP address, browser type, operating system, device identifiers, pages and features accessed, timestamps, referring URLs, and audit log data used for security monitoring and product improvement.

Feedback and Support Communications

Messages, tickets, survey responses, and call or meeting notes when you contact us for support or provide feedback.

Mobile Information for Text Messaging

If you provide your mobile phone number and opt in to our text messaging program, we collect your phone number, your consent record, and your opt in and opt out status.

Job Applicant Information

If you apply for a role with us, we collect the information in your application, resume, and interview records.

Information From Third Parties

We may receive information from our customers, electronic health record partners, identity and authentication providers, payment processors, and business contact data providers.

3. How We Use Information

• Provide and operate the Platform, including transcription, documentation generation, quality assurance, and audit response features.
• Authenticate users, administer accounts, provision access, and process billing.
• Communicate with you about your account, service changes, security notices, support requests, and, where permitted, product updates.
• Monitor, investigate, and prevent fraud, abuse, unauthorized access, and security incidents.
• Analyze usage patterns, troubleshoot defects, measure performance, and develop new features.
• Comply with legal, regulatory, contractual, and audit obligations, including HIPAA.
• Enforce our Terms of Service and protect our rights, property, and users.

We do not sell personal information, and we do not use PHI for advertising or marketing purposes.

4. Artificial Intelligence and Model Development

The Platform uses artificial intelligence and machine learning to transcribe audio and generate clinical documentation. We want to be explicit about how data is used in that process.

• We do not use customer PHI to train general purpose or third party foundation models.
• Any use of PHI to evaluate or improve our own models is limited to what is permitted under our BAA and HIPAA, including for data aggregation and health care operations, and is performed under access controls and audit logging.
• We may create deidentified data in accordance with the standard at 45 C.F.R. 164.514 and use deidentified and aggregated data to develop, evaluate, and improve the Platform. We do not attempt to re identify this data.
• Our AI subprocessors are contractually prohibited from using customer data to train their own models and are bound by written agreements, including BAAs and mandatory Zero Data Retention.
• AI generated output is a draft that requires human review. Our customers remain responsible for the accuracy of final documentation.

5. How We Share Information

Service Providers and Subprocessors

We share information with vendors that support the Platform, including cloud hosting, speech recognition, AI model providers, analytics, customer support tooling, payment processing, and communications infrastructure. Each is bound by written agreements limiting use of the information to the services provided, and by a BAA where PHI is involved. A current list of subprocessors is available on request at privacy@stenohealth.com.

At Your Direction

We share information with electronic health record systems and other integrated services when you or your organization configure and authorize that exchange.

Legal and Safety

We may disclose information when required by law, subpoena, court order, or regulatory request, or where necessary to investigate suspected fraud, enforce our agreements, or protect the rights, property, or safety of StenoHealth, our customers, or the public. Where PHI is involved, disclosures follow HIPAA requirements and our BAA.

Corporate Transactions

If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to the confidentiality and HIPAA obligations that applied before the transfer.

Text Messaging Data

We do not share your mobile phone number, consent record, or SMS opt in status with third parties for their marketing or promotional purposes. This information is used solely to operate the text messaging program described in Section 6.

No Sale or Targeted Advertising

We do not sell personal information or share it for cross context behavioral advertising as those terms are defined under United States state privacy laws.

6. Text Messaging (SMS) Communications and Consent

If you provide your mobile phone number and opt in, StenoHealth may send you text messages related to your account, appointment and documentation reminders, product and service updates, and customer support.

Consent to receive text messages is not required as a condition of using the Platform or purchasing any service. By opting in, you provide express written consent to receive automated and manual text messages from StenoHealth at the mobile number you provide.

Message frequency varies depending on your account activity and the program you selected. Message and data rates may apply based on your mobile carrier plan.

You may opt out at any time by replying STOP to any message. After you reply STOP, we will send one final confirmation message and you will not receive further messages unless you opt in again. Reply HELP for assistance, or contact us at privacy@stenohealth.com.

Supported carriers are not liable for delayed or undelivered messages. As stated in Section 5, we do not share your mobile number or opt in status with third parties for marketing or promotional purposes.

7. Cookies and Analytics

Our public website uses cookies and similar technologies for essential functionality, preference storage, and aggregate analytics. You can control cookies through your browser settings, though disabling some cookies may affect site functionality.

We do not deploy third party advertising trackers, marketing pixels, or behavioral advertising technologies on authenticated pages of the Platform or on any page where PHI may be present.

Some browsers transmit Global Privacy Control or similar opt out preference signals. We honor these signals where required by applicable law.

8. Data Security

We maintain administrative, physical, and technical safeguards designed to meet the requirements of the HIPAA Security Rule and industry standards for health technology.

• Encryption of data in transit using TLS and encryption at rest.
• Role based access controls, least privilege provisioning, and multi factor authentication for administrative access.
• Audit logging, monitoring, and alerting on access to production systems and PHI.
• Vendor security review and contractual safeguards for all subprocessors.
• Workforce security training, background screening, and confidentiality obligations.
• A documented incident response plan, periodic risk assessments, and penetration testing.

No system can be guaranteed completely secure. If you believe your account or data has been compromised, contact us immediately at security@stenohealth.com.

9. Breach Notification

If we discover a breach of unsecured PHI, we will notify the affected customer without unreasonable delay and within the timeframes required by HIPAA and our BAA, and will provide the information necessary for the customer to meet its own notification obligations. For personal information not governed by HIPAA, we provide notice as required by applicable state breach notification laws.

10. Data Retention

We retain personal information for as long as necessary to provide the Platform, meet our contractual and legal obligations, resolve disputes, and enforce our agreements.

• Audio recordings are retained for a limited period to support documentation quality, compliance audits, and system reliability, and are then deleted.
• PHI retention and deletion follow the terms of the applicable BAA and customer configuration.
• Account and billing records are retained as required by tax, accounting, and audit obligations.
• Deidentified and aggregated data may be retained indefinitely, as it no longer identifies any individual.

On termination, customers may request an export of their data for 30 days, after which we return or destroy the data in accordance with the BAA.

11. Your Privacy Rights

11.1 Patients

If you are a patient, your rights to access, amend, or restrict your health information are exercised through your healthcare provider, which controls that information. We will support our customers in responding to those requests as required by our BAA.

11.2 State Privacy Rights

Depending on your state of residence, you may have rights to:

• Know what personal information we collect, use, and disclose, and access a copy of it.
• Correct inaccurate personal information.
• Delete personal information, subject to legal and contractual exceptions.
• Opt out of the sale of personal information, targeted advertising, and certain profiling. We do not engage in these activities.
• Be free from discrimination for exercising your privacy rights.

Note that PHI governed by HIPAA, and information maintained by us as a Business Associate, is generally exempt from these state law rights. Requests for such information should be directed to the healthcare provider.

11.3 Consumer Health Data

Certain states, including Washington and Nevada, provide specific protections for consumer health data that falls outside HIPAA. Where those laws apply to information we hold, you may request access to and deletion of that data, and we will not collect, use, or share it without the consent required by those laws.

11.4 How to Exercise Your Rights

Submit a request to privacy@stenohealth.com. We will verify your identity before responding and will respond within the timeframe required by applicable law, generally 45 days, with an extension where permitted. An authorized agent may submit a request on your behalf with proof of authorization. If we deny a request, you may appeal by replying to our response.

12. Marketing Communications

You may opt out of marketing emails at any time by using the unsubscribe link or by contacting privacy@stenohealth.com. We may continue to send transactional and account related messages, which are necessary to provide the Platform.

13. Data Location and International Users

The Platform is operated in the United States and is intended for users located in the United States. Personal information is stored and processed in the United States. If you access the Platform from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your jurisdiction.

14. Children’s Privacy

The Platform is intended for use by healthcare professionals and is not directed to individuals under 18. We do not knowingly collect personal information directly from children under 13 for our own purposes. Pediatric health information submitted by our healthcare customers is processed as PHI on their behalf under a BAA. If you believe we have inadvertently collected information from a child under 13 outside of that context, contact privacy@stenohealth.com and we will delete it.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised date. If changes are material, we will provide advance notice through the Platform or by email, and where required by law, we will obtain your consent before the changes take effect.

16. Contact Us

StenoHealth

Privacy inquiries and rights requests: privacy@stenohealth.com

Security: security@stenohealth.com

General: support@stenohealth.com

Mailing address: 137 Clermont Ave, Brooklyn NY 11205