Privacy Policy

AmbiScript is committed to protecting the privacy and security of information entrusted to us. This Privacy Policy explains how AmbiScript collects, uses, stores, and protects information when users access our website, platform, and related services, including our mobile applications.

Website cookies and external services

We store your cookie preference in your browser for up to six months. This essential storage remembers whether you allow optional external services. You can change your choice at any time using Cookie settings.

Google Analytics is loaded only after you allow analytics cookies. It helps us understand website visits and usage. You can accept or reject analytics separately from external scheduling and video services in Cookie settings. Google may process usage and device information as described in Google’s Privacy Policy.

Calendly scheduling and embedded video players are loaded only after you allow external services. These providers may use cookies and similar technologies for functionality, analytics, or marketing. Rejecting optional cookies does not prevent you from browsing the website. To arrange a demo without the embedded scheduler, email hello@ambiscript.com.

Withdrawing permission stops further loading on this website and reloads the page if analytics or an external service was active. It does not delete cookies already set by third parties; you can remove those using your browser settings.

1. Information We Collect

AmbiScript collects information necessary to provide and support our services. This includes:

• Account and contact information such as name, email, role, organization, and authentication identifiers.
• Clinical encounter audio such as voice recordings of patient encounters captured when an authorized clinician explicitly starts a recording in the app.
• Clinical transcripts and generated documentation such as text transcripts derived from audio, clinical notes, summaries, and structured documentation generated from those transcripts.
• Usage and diagnostic information such as application usage activity, performance data, crash reports, and audit logs used to operate, secure, and improve the service.
• Information you enter such as any data uploaded or entered into the platform by authorized users.

2. Protected Health Information (PHI)

AmbiScript is designed to support healthcare workflows and processes Protected Health Information on behalf of healthcare organizations. When AmbiScript handles PHI, we do so in accordance with applicable HIPAA requirements and Business Associate Agreements in place with our customers and our sub-processors.

3. How We Use Information

Information may be used to:

• Provide, operate, and improve the AmbiScript platform.
• Authenticate users and manage access.
• Transcribe clinical conversations and generate clinical documentation, summaries, insights, and workflow outputs.
• Provide support and respond to inquiries.
• Maintain security, auditability, and compliance.
• Monitor platform performance and reliability.

AmbiScript does not sell personal information or PHI. AmbiScript does not use customer data, audio, or transcripts to train AmbiScript's own AI models, and our sub-processors do not use customer data to train their foundation models when accessed through our enterprise agreements.

4. Sub-processors and Third-Party AI Services

To deliver the AmbiScript service, we use the following Microsoft Azure services as sub-processors. Both run on Microsoft-operated, HIPAA-eligible Azure infrastructure under our Business Associate Agreement with Microsoft Corporation. Each is used only as necessary to deliver the service.

Microsoft Azure AI Speech

• Data sent: encounter audio captured by the clinician using the AmbiScript app.
• Purpose: to produce a written transcript of the conversation, including speaker diarization and language detection.
• Operator: Microsoft Corporation, processed within secured Microsoft-operated Azure data centers.
• Protection: data in transit is encrypted using TLS, data at rest is encrypted, and Microsoft is bound by our BAA covering Azure AI Speech as a HIPAA-eligible service.

Microsoft Azure OpenAI Service

• Data sent: the text transcript generated from the encounter, together with system prompts and clinical templates required to produce structured documentation.
• Purpose: to generate clinical notes, visit summaries, structured documentation, and workflow outputs from the transcript.
• Operator: Microsoft Corporation, processed within secured Microsoft-operated Azure data centers. AmbiScript does not send customer data to OpenAI's public services.
• Protection: data in transit is encrypted using TLS, data at rest is encrypted, and Microsoft is bound by our BAA covering Azure OpenAI Service as a HIPAA-eligible service. Under our enterprise agreement, Microsoft does not use customer prompts, outputs, or fine-tuning data to train its foundation models.

Customer organizations are notified in advance of material changes to the list of sub-processors that receive PHI.

5. Data Security

AmbiScript uses Microsoft Azure and Microsoft Entra ID to support secure hosting, authentication, access control, logging, and operational security. Data is protected using administrative, technical, and physical safeguards, including encryption in transit and at rest. Production access is restricted to authorized personnel under role-based access controls with audit logging.

6. Access Controls

Access to AmbiScript systems is limited to authorized users. User authentication is managed through Microsoft Entra ID, and access is provisioned based on role and business need.

7. Data Sharing

AmbiScript does not sell personal information or PHI. We share information only as necessary to:

• Operate the service through the sub-processors listed in Section 4.
• Support customer-authorized integrations, such as EHR systems explicitly enabled by the customer organization.
• Comply with legal obligations, valid legal process, or to protect the safety of users or the public.
• Carry out a corporate transaction, such as a merger or acquisition, subject to appropriate confidentiality and continuity-of-protection commitments.

8. Data Retention

AmbiScript retains information only for as long as necessary to provide services, meet contractual obligations, support audit and compliance requirements, or comply with applicable law. Customer organizations may request deletion of data subject to their agreement with AmbiScript and applicable legal retention requirements.

9. User Responsibilities

Authorized users are responsible for using AmbiScript appropriately, obtaining required patient and provider consent before recording, protecting their login credentials, and ensuring that information entered into the platform is handled in accordance with their organization's policies and applicable law.

10. Children's Information

AmbiScript is a professional clinical tool intended for use by licensed healthcare providers. It is not directed to children, and we do not knowingly collect personal information from individuals under the age of 18 except in the context of a clinician documenting a pediatric encounter on behalf of a healthcare organization.

11. Changes to This Policy

AmbiScript may update this Privacy Policy from time to time. Material changes will be posted on this page with a revised effective date and, where appropriate, communicated directly to customer organizations.

12. Contact