Privacy Policy

Account information. When you create an account we collect your name, email address, clinician role and credentials (such as an NPI), and, for agencies, the organization's details. If you sign in with Google we receive your name and email address from Google.

Client records you create. Agencies and clinicians use BxScribe to keep clinical records about the people they serve. Depending on what you enter, a client profile can include the client's name, date of birth, address, guardian and care-team contacts, insurance provider and member ID, diagnosis, authorizations, and the session notes, treatment plans, assessments, data collection, documents, uploaded files and session transcripts you create for them. Enter only what you need for the client's care and billing.

Usage and security information. We record how the service is used — for example note counts, feature use, sign-ins and an audit log of who viewed, changed or exported records, with the time, IP address and browser — to run the service, enforce plan limits and protect your data.

We use collected information to:

• Provide and maintain the BxScribe service
• Generate AI-assisted drafts, transcripts and summaries you ask for
• Process payments through Stripe
• Send transactional emails such as verification, invitations, reminders and security alerts
• Keep accounts secure, detect misuse and keep an audit trail
• Improve service quality and develop new features

We do not sell personal information, and we do not use client records for advertising.

Client records in BxScribe belong to the agency or clinician who created them. An ABA agency or clinician is typically a HIPAA covered entity, and BxScribe processes their clients' protected health information on their behalf, as a business associate: we use it only to provide the service they asked for, and the agency or clinician decides who in their organization can see it.

We are putting our own Business Associate Agreement and the agreements with our sub-processors in place; until that work is finished we don't offer a BAA. If your organization needs one, send us a HIPAA & BAA inquiry and we'll follow up when it is available.

Requests from clients and families. If you are a client or caregiver and want to see, correct or get a copy of your records, contact the agency or clinician who provides your services — they control the record. BxScribe gives them the tools to answer: a full-record export and a report of who accessed and disclosed the record.

We use a small set of service providers to host and run BxScribe, including our application host, database and file-storage providers, OpenAI for AI features, Resend for email, and Stripe for payments. Each one processes data only to provide its service to us. The full list — what each vendor does, what data it can see and its Business Associate Agreement status — is on our sub-processors page.

Analytics. We use Google Analytics on our public marketing pages only — never inside the app, the family portal or sign-in pages. Vercel Analytics and Speed Insights measure page loads and performance across the site; on signed-in pages, record IDs and query strings are removed from the page addresses they receive.

We may also disclose information when the law requires it, to protect the rights and safety of our users, or as part of a merger or acquisition under the same protections.

• Agency records belong to the agency and are never deleted on a timer. Finalized notes can't be deleted — corrections are made as amendments.
• Personal-workspace notes are kept for the period you choose in Settings (7 or 10 years, or indefinitely). How long clinical records must be kept is set by state law and payer contracts, often longer for minors.
• Deleting your account takes effect after a 30-day grace period. It removes your sign-in and your personal workspace, including uploaded files. Records you created for an agency stay with that agency. If you own an agency with no other members, its records are deleted with your account, and a record of what was deleted is kept.
• Audit records are kept for seven years, including after an account is deleted.
• Backups held by our infrastructure providers expire on their own schedules after data is deleted from the live service.

We protect data with encryption in transit and at rest, role- and assignment-based access, optional and agency-required two-factor sign-in, automatic sign-out, a tamper-evident audit log and a daily review for unusual activity. Our Security & HIPAA page describes each safeguard. No system is perfectly secure — if you discover a vulnerability, please report it to security@bxscribe.com.

If we discover a breach of unsecured health information or personal data we hold, we will notify the affected agencies and clinicians without unreasonable delay and within the time the law and our agreements with them require, so they can meet their own notification duties.

For your own account, you can:

• Access and correct your account information in Settings
• Download a copy of your data from Settings
• Delete your account from Settings
• Withdraw consent for optional processing, such as email preferences

Requests about a client's records go to the agency or clinician who controls them (see section 3).

For privacy questions or data requests, contact us at support@bxscribe.com. To report a security issue, email security@bxscribe.com. Please don't include client information in your message.