OmniMD AI Scribe Privacy Policy

About This Privacy Policy

This Privacy Policy applies to OmniMD, Inc. (“We” or “Us”), and its contractors performing services on its behalf. We are a web-based electronic health record software vendor that provides AI Scribe, an application and web-based platform that enables clinicians to more efficiently create clinical documentation. AI Scribe is designed to integrate with your OmniMD electronic health record (“EHR”). This Privacy Policy explains our data collection, maintenance, use and sharing practices (“Data Practices”) in connection with AI Scribe.

AI Scribe Application: a mobile application available through the Apple Store or Google Play that allows you to record and transcribe an encounter on the go. The Application integrates with the AI Scribe Web-Based Platform so that your transcriptions from your on-the-go encounters are made available in the AI Scribe Web-Based Platform.

AI Scribe Web-Based Platform: provides a fuller suite of application services to assist you with recording and transcriptions, clinical documentation, chart review, clinical insights, summarization, clinical information extraction and generation of structured clinical documentation.

We refer to the AI Scribe Application and the AI Scribe Web-Based Platform together as “AI Scribe.”

When we collect, maintain, use and disclose your data under this Privacy Policy, we refer to this as “processing”. When you use AI Scribe, you consent to our processing of your data as described in this Privacy Policy. This Privacy Policy is also subject to and made a part of the OmniMD Terms and Conditions.

You will find in this Privacy Policy:

What data we collect from you and how we collect it when you use AI Scribe;
How we maintain and use your data;
How we share your data with third parties, such as our contractors performing services on our behalf;
What our privacy and security practices are;
What choices you have for your data;
What rights you have for your data;
How you can find out more information about our Data Practices, ask any questions, or report concerns you may have.

This Privacy Policy only applies to AI Scribe. It does not apply to any other applications, products, services, or software solutions that we may provide from time to time, including your use of your instance of the OmniMD EHR. For our separate website privacy practices, please visit Privacy Policy – OmniMD.

1. What Data Do We Collect?

We collect different types of data when you use AI Scribe. The types of data that we collect are:

Business Data

When you use AI Scribe, we may collect your business name, address, business type, billing and payment information, such as corporate credit card or account information, employee names, titles and contact information, product information, system operating information, feedback, survey information, communications such as emails and other information you may provide us about your business.

Personal Data

When you use AI Scribe we may collect your name, username, mailing and billing address, email address, phone number, employment information, professional credentials, billing and payment information, such as credit card or account information, and other information when you register for an AI Scribe account. We may also collect certain Usage Data described below that may identify you, such as IP address.

Usage Data

When you use AI Scribe via the Internet or on your mobile device through the Application, we may collect log-in information, such as your user credentials, browser type, operating system type, device/mobile device type/models, versions, network information, browser settings, private or public IP address, session identifiers, geolocation (to verify that you are located within the U.S.), domain name, referrer page, log-in and access times, entry and exit pages. We may also collect other usage data, such as event and error logs, crash reports, audit trails, log-in attempts and denials, security alerts, performance metrics, interactions, diagnostic information, and the review, approval signatures and other actions you take in connection with AI Scribe. We may also in some instances collect prompt metadata, feature interaction data, telemetry and other workflow utilization metrics. Some Usage data, such as IP address, may also be Personal Data in certain circumstances. We may also collect cookie-related data, as described more specifically in Section 9 of this Privacy Policy.

Client Data

When you use AI Scribe, you may provide us with patient or client level data and other information (“Client Data”). This is data that you either own or have a right to provide to us when you use AI Scribe. Client Data may include medical information, sensitive medical information (such as HIV/AIDS, STD, mental/behavioral health, substance use, reproductive health, genetic), and other clinical encounter information about an individual, that your practice may collect and use in connection with your business. You may provide the following types of Client Data to us when you use AI Scribe so we can help you generate clinical documentation, such as SOAP, Procedure, Consultation, Lab Orders, Imaging Orders, Prescription Orders and other types of documentation. We may also collect the following types of Client Data from your EHR in order to perform the activities described in this Privacy Policy.

Patient demographics and vital signs
Medical histories and prior medical records
Problem lists, complaints, diagnoses, symptoms and conditions
Medications and medication allergies/intolerances
Procedures
Laboratory results
Imaging information
Clinical notes
Clinical impressions and observations
Clinical conversations and transcripts
Audio recordings
Documents and uploaded files
Information required to generate ICD, CPT, E and M, MIPS and other clinical or billing information.

Consent for Client Data

You are required to obtain consent from individuals where required by applicable laws when recording, transcribing, using and sharing Client Data with AI Scribe. This means that you must be familiar with the laws of the state in which you operate and comply with any state or federal privacy, security or recordkeeping laws that may affect how you collect, maintain, use and share Client Data or the manner in which you obtain consent.

Specifically, you MUST obtain consent from individuals before utilizing record and transcription functionality. We require you to obtain consent EVEN IF consent is not required by the laws of your state. If an individual does NOT consent, you may NOT use AI Scribe to record and transcribe a clinical encounter. If you record and transcribe an encounter using AI Scribe, you are representing that you have obtained consent from the individual to have the encounter recorded and transcribed and that such consent complies with any applicable laws.

2. How Do We Maintain and Use Your Data?

We maintain and use Business Data, Client Data, Personal Data and Usage Data (collectively, “Data”) to provide you with services and operate the AI Scribe. Certain features and services are only available when you access the services through our Web-Based Platform. Use of the Application is limited to recording, transcription and transmission for on-the-go encounters only.

We may maintain and use Data to authenticate and maintain your log-in session for AI Scribe. We may also maintain and use Data to connect your use of AI Scribe with your instance of your EHR and collect Client Data from your EHR.
We may maintain and use Data to manage your account, for example, to create, maintain and administer your account, monitor your account for compliance with this Privacy Policy and the Terms and Conditions, provide customer support, bill you for services, or investigate, suspend or terminate your account.
We may maintain and use Data to provide you with marketing about our other services or products that we may provide, communicate with you about our news, announcements, important notifications, support, product or feature upgrades, or to offer you our other products and services.
We may maintain and use Data to create recordings and transcriptions and transmit these recordings and transcriptions to your instance of your EHR. Raw recordings are not retained after transcription occurs. After the draft clinical documentation has been created (i.e., SOAP Note), the transcription is no longer retained.
We may maintain and use Data to provide you with clinical insights, clinical summaries, clinical documentation, chart reviews, clinical information extraction and generation of structured clinical documentation. data analytics, and other services that may be relevant to your business and medical practice. These processing activities are only available and performed when you use the Web-Based Platform. When performing these activities, we may interface with and process Client and other Data obtained from your EHR.
We may aggregate, analyze and otherwise process Data in order to provide you with services and allow AI Scribe to work properly. We may process Data to audit, detect fraud or misuse, investigate security incidents, correct, develop, enhance, host, improve performance, accessibility and usability, integrate, maintain, operate, trouble-shoot, program, upgrade, plan, optimize, and personalize AI Scribe. We may aggregate and de-identify Data as related to these activities. Once Data has been de-identified in accordance with applicable laws, it is no longer subject to this Privacy Policy.
We may maintain certain audit logs and raw event data for general system performance, auditing and security purposes. You have the ability to review certain audit logs for a period of two (2) months from the date of the logged event. After such 2 year period, audit logs are archived in accordance with our data retention practices. Generally, we retain audit logs for 6 years from the date of their creation, with limited exceptions.
We may use artificial intelligence (AI) in order to perform the processing activities described in this Section. For example, we may utilize ambient listening technology and natural language processing when you record and transcribe an encounter. We will never use Client Data or Personal Data to train or model any AI used in connection with the services without your approval. However, we may use Client Data or Personal Data in order to ground and improve your own instance of AI Scribe.
We may process Data for our management and administration, including compliance and auditing processes, security activities, internal business development, and creating aggregated and/or de-identified data sets. We may process Data as necessary to monitor and enforce compliance with this Privacy Policy and Terms of Use and our other rights, or to protect the privacy and security of our other clients.
We may process Data if required by applicable laws, such as court order or other legal process.
We will never process Data for any purpose not permitted by this Privacy Policy without your approval.

3. How Do We Share Your Data?

We may share your Data with third parties to provide you with the services and operate AI Scribe, to the extent permitted by this Privacy Policy and applicable laws. We may, from time to time and in our discretion, contract with software and application developers, service providers and other suppliers and contractors in order to operate AI Scribe. We may also consult with and share Data with our accountants, attorneys and other consultants in order to provide the services. By using AI Scribe, you authorize us to share Data with these third parties as necessary to provide the services, operate AI Scribe or at your direction.

For example, we host AI Scribe through our third party contractor, Oracle Cloud. We also utilize certain AI software contractors, including Chat GPT, Assembly AI and Oracle Cloud when providing the services and operating the AI Scribe, and we may utilize backup and disaster recovery, payment processing, customer support and other contractors. If we share any Client Data that is likely to contain PHI with such third parties, we are required to obtain a subcontractor business associate agreement to the extent required by HIPAA.

We may share your Data with our software and other contractors that may assist us with the services that we provide, including hosting services, clinical insights, data analytics, and other processing activities in connection with our services and AI Scribe. We may also share Client Data obtained from your instance of your EHR with these contractors to perform these processing activities.
We may share Data with our software and other contractors to create recordings and transcriptions and transmit these recordings and transcriptions to your instance of your EHR as draft clinical documentation. Raw recordings and transcriptions are not retained.
We may share Data with our software and other contractors to help us aggregate, analyze, de-identify and otherwise process Data in order to provide you with services and allow AI Scribe to work properly. This includes processing Data to audit, detect fraud or misuse, investigate security incidents, correct, develop, enhance, host, improve performance, accessibility and usability, integrate, maintain, operate, trouble-shoot, program, upgrade, plan, optimize, and personalize AI Scribe.
We may share Data with our software and other contractors in order to create, maintain and administer your account, provide customer support, bill you for services, provide you with marketing and communications about our other services or products that we may provide on our behalf, or to investigate, suspend or terminate your account.
Our software and other contractors may utilize AI to perform the processing activities described in this Section. For example, ambient listening and natural processing activities may be supported and processed utilizing AI technologies. We will never share P to train or model any AI used in connection with the services without your approval. However, we may share Client Data or Personal Data with our software and other contractors in order to ground and improve your own instance of AI Scribe.
We may share Data with our software and other contractors for our management and administration, including compliance and auditing processes, security activities, internal business development, and creating aggregated and/or de-identified data sets. We may share Data with our software and other contractors as necessary to monitor and enforce compliance with this Privacy Policy and Terms of Use and our other rights, or to protect the privacy and security of our other clients.
We may share Data if required by applicable laws, such as pursuant to a court order and to a judicial officer or pursuant to other legal process. If required by applicable laws, we will attempt to notify you if practicable to do so and provide you with an opportunity to seek protection against our disclosure of Data.
We will never share Data for any purpose not permitted by this Privacy Policy without your approval.
We may from time to time and at our option provide integration tools with third parties for you to use in connection with AI Scribe. These third parties may independently collect Data from you. You should review their privacy notices and contact them with any questions about how they may share your Data. We do not control the contents or manner of any such communications, nor can we control how the third party uses and shares your Data.
We may also integrate with Google Analytics and similar entities to provide geolocation data when you access and navigate our AI Scribe, so that we can determine you are located within the United States. You may be able to utilize any tools such third party makes available to exercise your choice over what Data and functionality is utilized by such third party. However, certain services may not work if you disable these third-party tools. Therefore, use of any service that requires a third-party tool is your acceptance of such third-party tool.
If a third party that we offer integration with is not a contractor providing services on our behalf, we do not have any control over these third-parties. We are not responsible for and disclaim any liability for the privacy and security of any Data that you provide in connection with such third parties. You are solely responsible for all Data which you post or share with these third parties and you should obtain additional information about their privacy and security practices.

4. What Are Our Privacy and Security Practices?

We respect your privacy and the privacy of your clients/patients. We use commercially reasonable efforts to handle your Data responsibly. We only process your Data to provide the services you’ve chosen, such as using AI Scribe, and as described in this Privacy Policy. Although we cannot guarantee that information transmitted over the Internet and through AI Scribe will be 100% secure, we implement reasonable and appropriate safeguards and controls designed to make your Data that you provide to us and process in connection with AI Scribe securely accessible only by you. We use reasonable efforts to protect your Data using advanced security tools and practices, such as firewalls, encryption, intrusion detection, and regular security checks. Our team constantly updates our security to keep up with the latest standards and protect against threats.

For privacy and security purposes, your use of AI Scribe requires a username and password. You are responsible for securing your username and password and for all activities taken using your username and password. You must notify us immediately if you believe your username or password has been lost or stolen or if you suspect unauthorized activity on your account or unauthorized access to your Data. If you utilize any of our export or download capabilities in the Web-Based Platforms, you acknowledge you are responsible for how you further share your Data in connection with such export or download. You recognize and accept the risks inherent with Internet-based services.

For Client Data that you may provide to us in connection with your use of AI Scribe, we implement reasonable and appropriate safeguards designed to comply with the requirements of HIPAA and business associate agreements. We enter into business associate agreements with all of our clients as required by HIPAA that set forth how we may use and disclose protected health information in connection with AI Scribe. If we experience a breach involving your Client Data or Personal Data, we will report such breach to you to the fullest extent required by applicable laws.

5. What Choices Do You Have for Your Data?

You have choices when we process your Data. Certain categories of Data are required for us to provide the services and therefore, strictly necessary. Other categories of Data are optional and you may choose not to provide us with any such Data.

Strictly Necessary

Many Data types are necessary for us to provide the services and operate AI Scribe. For example, we may need Usage Data in order to maintain, audit and authenticate you to your secure sessions, including IP address, authentication and session cookies. The following are some examples of Data which is strictly necessary for us to provide the services and operate AI Scribe: Session tokens, session cookies, authentication credentials, device authentication data, browser type, operating system versions, IP address, logs, login attempts, geolocation.

Optional

Although AI Scribe is designed to integrate with clinical workflows, you control the amount and type of Client Data that you wish us to process through AI Scribe. You can limit the amount and type of Client Data that you provide to us at any time. You can amend, correct and delete any Client Data that you provide to us at any time. You can choose to not use recording/transcription functionality at any time.
You can choose whether to provide feedback, testimonials or participate in any surveys which may collect Business Data from you.
You can choose not to receive marketing, news, announcements, and similar information by contacting us at the address set out in this Privacy Policy.

Browser Settings

You may be able to configure your browser settings and exercise choice over how certain Usage Data is optionally collected and used, such as cookies. Generally, you may be able to configure analytics, preferences or advertising cookies. You may be able to delete certain browsing data which may be maintained through your web-browser, but this may not delete any browsing data we may have collected, maintained and used with your other Usage Data. Certain cookies or SDKs are strictly necessary and may not be turned off.

6. What Rights Do You Have?

You have the right to amend or delete Client Data, except Data which we may be required to maintain for our management and administration or which we are required to maintain by applicable laws. We implement controls designed to retain your Client Data after you have deleted it only for as long as it is necessary to provide the services and conduct our management and administration. If you delete Client Data, it may continue to be temporarily maintained until the expiration of applicable retention periods.
You have the right to amend or delete Business or Practice Data, except Data which we may be required to maintain for our management and administration or which we are required to maintain by applicable laws.
You have the right to terminate your use of AI Scribe or any of its functionality, provided you comply with applicable termination and other provisions in the Terms and Conditions.
Residents in certain states may have additional rights with respect to their Personal Data under applicable state privacy laws. These rights may include: Rights of Access, Correction, Deletion, Portability, Targeted Advertising, Profiling, and Processing, among others. Please contact us for more information about what rights are available to you for your Personal Data.

7. What Responsibilities Do You Have Under This Privacy Policy?

You Control Your Client Data

We do not and cannot determine or control the manner, amount, type, or nature of the Client Data that you may collect. You decide what Client Data to process for a given encounter or in your EMR. You decide what Client Data to upload, export or download, amend or delete, and how that Client Data may be further used and shared.

Our ambient listening and transcription software is designed to capture and document clinically relevant information and may not capture and document all parts of a conversation or encounter. We provide pause and resume functionality, in addition to start/stop functionality, in connection with our record and transcribe functionality. It is your responsibility to determine when an encounter may require you to pause or stop recording and transcription.

YOU MUST obtain consent from individuals before utilizing record and transcription functionality. We require you to obtain consent EVEN IF consent is not required by the laws of your state. IF YOUR PATIENT/CLIENT HAS NOT CONSENTED TO YOU RECORDING AND TRANSCRIBING AN ENCOUNTER, YOU MAY NOT START RECORDING. We do not independently verify that you have obtained consent or that it is compliant with applicable laws. If you record and transcribe an encounter using AI Scribe, you are representing that you have obtained consent from the patient/client to have the encounter recorded and transcribed and that such consent complies with any applicable laws.

It is your responsibility to review transcriptions and all suggested clinical summaries and other documents, verify their accuracy, completeness and appropriateness, and make amendments or additions as you determine to be necessary. It is your responsibility to exercise professional judgment over any output created or suggested by AI Scribe. AI-generated and software outputs may contain inaccuracies, omissions, formatting errors, incorrect clinical interpretations, or information that is not clinically appropriate. You must independently review and validate all outputs prior to use.

You Are the Final Decision-Maker

AI Scribe is an AI and software assisted tool and is not intended to replace professional clinical judgment. You MUST review, verify and approve all transcriptions and other clinical documentation and suggestions provided by AI Scribe before you complete and sign such documentation. You must identify and make such edits and additions as you deem clinically appropriate in your sole discretion. AI Scribe is NOT a medical provider and does NOT and CANNOT provide medical advice. When you sign and complete clinical documentation, you agree that the clinical documentation is accurate, complete and medically appropriate.

You Must Comply With Applicable Laws for Client Data

Client Data that you provide may contain protected health information, personal data or personally identifiable information subject to applicable laws. You are responsible for complying with all applicable laws, including, without limitation, the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and state privacy laws, when collecting, maintaining, using and disclosing Client Data through AI Scribe, including obtaining applicable consents and providing notices to the extent required by law. If a state law requires you to obtain consent in a specific form and manner or provide a specific notice, you are responsible for complying with such requirements.

You Must Safeguard Your Client Data

Although we implement reasonable and appropriate controls designed to safeguard the availability, confidentiality and integrity of Client Data that you provide to us in accordance with HIPAA, you remain responsible for implementing reasonable and appropriate safeguards when using AI Scribe. This includes safeguarding your username and passwords as required by Section 4 and implementing such other privacy and security controls required by HIPAA and applicable laws. You remain responsible for how you collect, maintain, use and share Client Data in accordance with applicable privacy and security laws and regulations.

8. May Children Use the Services?

AI Scribe strictly prohibits use of the Application or Web-Based Platform by individuals under the age of 18. If you are under the age of 18, you may not create an account or use the services, even if you have permission from a parent, legal representative or guardian. By accessing and using the services, you represent that you are 18 or older at the time of your access and use.

9. Do We Use Cookies and Related Technologies?

Our services may use cookies, pixels, web beacons, local storage technologies, session storage technologies, tags and related technologies to gather and maintain Usage Data for their proper operation. For our Application, this also includes SDKs (software development kits) which may gather and maintain Usage Data. These technologies help to make our Web-Site Platform and Application work as intended, allow you to log-in to your account and maintain a user session, help us to monitor and improve our Application and Web-Based Portal, perform communication functions and other legitimate purposes described in this Privacy Policy. Certain services will not work if these technologies are disabled. These are considered strictly necessary for the services to function as intended.

Cookies and related technologies collect and use certain information from you, but this information does not include direct identifiers such as name, age, phone number, or mailing address. Most browsers are initially set up to accept cookies and you can manage cookies collected in your browser. For example, you can reject cookies, but this may interfere with your ability to log-in and use the services.

10. How May We Use the Services Outside the United States?

Use of AI Scribe outside of the United States is strictly prohibited. AI Scribe may only be accessed and used while located in the United States. We may use and maintain geolocation data collected from you to verify your location at the time you access and use the services. When you access and use the services, you represent that you are located in the United States at the time of your access and use.

11. How May We Change This Privacy Policy?

We may change this Privacy Policy at any time in our sole discretion. If we change this Privacy Policy, we will post the revised Privacy Policy on our website. Any changes will be effective as of the next time you use AI Scribe and your continued use is acceptance of any such changes.

12. How Can You Submit Questions, Complaints and Contact Us?

You can submit questions, complaints, concerns and other information about this Privacy Policy by writing to [email address]. You can also contact your account manager and provide your questions, complaints and concerns.

Contact Information

If you have questions about this Privacy Policy or would like to exercise your rights, please reach out to us:

Email: privacy@OmniMD.com

Mailing Address: OmniMD, 245 Saw Mill River Road, Suite 301, Hawthorne, NY 10532