Last updated: April 2, 2026
This Privacy Policy describes how SmartScribe Corp (doing business as JotPsych) ("SmartScribe," "Company," "we," "us," or "our") collects, uses, discloses, and protects information when you use our websites, applications, browser extensions, and related services (collectively, the "Services"). It also describes your privacy rights and the protections available to you under applicable law.
By accessing or using the Services, you acknowledge that you have read this Privacy Policy and agree to the collection and use of information in accordance with its terms. If you do not agree, you must discontinue use of the Services immediately.
The Services enable clinicians to record clinical sessions using their device's microphone. Audio is uploaded to our cloud infrastructure in encrypted chunks during or immediately following the session. The audio is then transmitted to third-party transcription providers for conversion to text.
Raw audio is permanently deleted after transcription is complete. SmartScribe does not retain audio recordings beyond the time required to produce a transcript. The resulting transcription is retained as part of the encounter record and is subject to the data retention periods described below.
SmartScribe uses artificial intelligence, including third-party large language model providers, to process clinical data in the following ways:
The Services employ per-user learning, meaning user preferences and correction patterns are retained to improve the quality of future outputs for that specific user. This is not foundational model training.
SmartScribe does not use client clinical data to train foundational AI models. Clinical data processed through the Services is used solely to deliver and improve the Services for the applicable Client.
By default, personally identifiable information (PII) is removed from clinical content before it is sent to third-party AI providers. This default behavior is configurable by the Client at the account level. SmartScribe is not responsible for any increased risk resulting from a Client's decision to disable PII removal.
Through Client use of the Services, SmartScribe may collect, process, and store the following categories of patient data:
All patient data is treated as PHI and handled in accordance with HIPAA and the terms of any applicable Business Associate Agreement (BAA) between SmartScribe and the Client.
The Services support insurance claims generation and submission through third-party clearinghouse partners. Claim data includes CPT codes, ICD-10 codes, dates of service, billed amounts, and related encounter information. Provider billing identity data -- including National Provider Identifier (NPI), Tax Identification Number (TIN), and taxonomy codes -- is collected and stored to facilitate claims submission.
Patient payments are processed through a third-party payment processor. SmartScribe does not store credit card numbers, bank account numbers, or other direct financial instrument data. Such data is collected and managed exclusively by our payment processing provider in accordance with PCI DSS standards.
Remittance and payment data received from insurers is stored as part of the billing record.
Electronic prescriptions are processed through a third-party e-prescribing platform. To use e-prescribing features, clinicians must register with the e-prescribing platform, which requires the following information: full legal name, date of birth, NPI, and DEA number.
For identity proofing purposes, the e-prescribing platform may require additional verification data, including Social Security Number, credit card verification, and photo identification. This identity proofing data is submitted directly to the third-party e-prescribing platform and is never transmitted to, stored by, or accessible to SmartScribe.
The Services support prescribing of controlled substances (Schedules II through V) with enhanced authentication as required by federal and state law. Prescription records are managed within the third-party e-prescribing platform.
For clinicians who use credentialing features, SmartScribe collects and stores:
Credentialing data is stored with enhanced encryption and access controls and is retained for the duration of the provider's relationship with SmartScribe.
The Services include telehealth functionality powered by a third-party video infrastructure provider. Video and audio streams are processed by the video infrastructure provider during the session.
Chat messages exchanged during telehealth sessions are transmitted in real time and are not persisted or stored by SmartScribe or the video infrastructure provider after the session ends.
Patients are not users of SmartScribe and do not create accounts. However, the Services facilitate certain interactions with patients on behalf of Clients, including:
SmartScribe acts as a conduit for these communications on behalf of the Client. The Client is responsible for obtaining any required patient consent for these communications.
The JotPsych Note Shuttle Chrome Extension helps clinicians transfer clinical notes from JotPsych to their EHR systems. The Extension collects only the data necessary to provide this functionality.
Information you provide:
Information collected automatically:
The Extension reads page content only when you explicitly initiate a scrape or mapping action. It does not passively monitor browsing activity.
When transferring notes to your EHR, medical note content is retrieved from your JotPsych account via secure API calls. Note content passes through the Extension for insertion into your EHR but is not stored persistently by the Extension. All data transmission uses HTTPS encryption.
You may uninstall the Extension at any time. Uninstalling removes all locally stored data (tokens, mappings, preferences) and revokes the Extension's access to your browser. It does not affect your JotPsych account or data stored on our servers.
We use cookies and similar tracking technologies to track activity on our Services and store certain information. Tracking technologies used include beacons, tags, and scripts to collect and track information and to improve and analyze our Services.
Cookies or Browser Cookies. A cookie is a small file placed on your device. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some parts of our Services.
Web Beacons. Certain sections of our Services and our emails may contain small electronic files known as web beacons that permit the Company to count users who have visited those pages or opened an email and for other related website statistics.
We use both session cookies (deleted when you close your browser) and persistent cookies (remain until expiration or deletion) for the following purposes:
We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products and services. Website usage data is captured using first- and third-party cookies and other tracking technologies. We use this information for site optimization, fraud and security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.
We do not sell Personal Data. We do not share Personal Data with third parties for their own marketing or cross-context behavioral advertising purposes.
We may use Personal Data for the following purposes:
We may share your information with Service Providers acting as data processors, affiliates, or as part of a business transfer (such as a merger, acquisition, or asset sale), always in accordance with this Privacy Policy and applicable law.
When data is no longer required for any of the above purposes and no legal retention obligation applies, it will be securely deleted or de-identified.
While we employ commercially reasonable safeguards, no method of electronic transmission or storage is completely secure. SmartScribe cannot guarantee absolute security of your data.
SmartScribe engages the following categories of third-party Service Providers to deliver the Services. All Service Providers are contractually obligated to protect data in accordance with applicable law, and where applicable, Business Associate Agreements are in place:
We do not disclose the specific identity of our Service Providers in this Privacy Policy. Clients subject to BAAs may request a current list of sub-processors by contacting us at info@smartscribe.health.
Subject to applicable law, you have the right to:
To exercise any of these rights, contact us at info@smartscribe.health. We will respond within the timeframe required by applicable law.
Note regarding patient data: Patients whose data is processed through the Services should direct access, correction, or deletion requests to their healthcare provider (our Client). SmartScribe processes patient data on behalf of Clients and will comply with Client instructions regarding such requests.
If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including:
Residents of other states with applicable consumer privacy laws (including but not limited to Virginia, Colorado, Connecticut, Utah, and Texas) may have similar rights. To exercise any state-specific privacy rights, contact us at info@smartscribe.health.
If you opt in to receive messages from JotPsych, we collect your phone number, consent status, messaging preferences, and message logs to operate the messaging program. Messages may include onboarding information, reminders, support communications, or promotional content if you have separately consented.
Carriers and messaging infrastructure providers process messages as our Service Providers and are contractually prohibited from using your data for their own purposes.
You may opt out at any time by texting STOP; a confirmation message will be sent. Message frequency varies. Message and data rates may apply.
We retain opt-in and opt-out records for at least six months after opt-out. No mobile information collected for SMS messaging will be shared with or sold to third parties, business partners, or affiliates for marketing or promotional purposes.
The Services are not directed at children under the age of 13. SmartScribe does not knowingly collect Personal Data from children under 13. Account creation requires that the user be at least 18 years of age. If we become aware that we have collected Personal Data from a child under 13, we will take steps to delete that information promptly.
Your information may be transferred to and processed on servers located outside of your state, province, or country. By using the Services, you consent to this transfer. SmartScribe will take all steps reasonably necessary to ensure your data is treated securely and in accordance with this Privacy Policy and applicable law.
Your data may be disclosed in the following circumstances:
Our Services may contain links to third-party websites or services not operated by SmartScribe. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services. We encourage you to review the privacy policy of every site you visit.
We may update this Privacy Policy from time to time. We will notify you of changes by posting the revised version on this page and updating the "Last updated" date above. For material changes, we may provide additional notice via email or through the Services. Your continued use of the Services after any changes become effective constitutes acceptance of the revised Privacy Policy.
For privacy-related questions, data requests, or concerns about this Privacy Policy:
For general product support:
SmartScribe Corp
Wilmington, Delaware, USA