Platform Privacy Notice

This Platform Privacy Notice explains how Scribeberry Inc. ("Scribeberry", "we", "us", or "our") collects, uses, discloses, and protects information in connection with the Scribeberry clinic management platform, including staff portals, patient portals, online booking pages, and related websites hosted on scribeberryclinics.com and associated domains (the "Platform").

Last updated: 11 August 2026.

This Notice covers Scribeberry's platform operations. It does not replace your clinic's privacy policy for patient health information used in care. If you are a patient, your clinic is typically the custodian of your clinical records.

1. Who we are and the two-layer model

Scribeberry provides software that clinics use to operate their practices. In most cases:

Your clinic (or practitioner) is the custodian or controller of patient health information, appointment and billing records used for care, and clinic-specific policies.

Scribeberry is a service provider / processor that hosts and processes that information on the clinic's instructions to deliver the Platform, and that operates patient authentication and certain platform account functions.

Questions about your care, chart contents, clinic fees, or clinic privacy practices should go to your clinic. Questions about how the Platform itself works, cookies on Scribeberry-hosted pages, or portal login credentials may be directed to Scribeberry as described below.

2. Information we collect

Clinic and staff account data: names, work emails, roles, authentication data (including multi-factor authentication), clinic configuration, branding, feature settings, and support communications.

Patient authentication and portal account data: email address, password hashes or federated auth identifiers, session tokens, device/browser metadata used for security, and similar credentials needed to sign in to a clinic's patient portal or complete booking that creates an account. This is not a substitute for your clinical chart, which remains under clinic control.

Clinic Data processed on clinic instructions: contact and demographic details, appointments, clinical documentation, intake responses, messages, billing artifacts, and other records the clinic or its users enter into the Platform.

Usage, security, and operations data: audit logs, IP addresses, approximate location derived from IP, feature usage telemetry, diagnostic logs, and cookies or similar technologies as described in our Cookie Policy.

Communications: messages you send to support, sales, or security, and metadata needed to respond.

3. How we use information

We use information to: provide, maintain, and secure the Platform; authenticate users; host Clinic Data for the subscribing clinic; enable scheduling, portal, booking, messaging, and related features; provide customer support; monitor abuse and prevent fraud; improve reliability and product quality (including using de-identified or aggregated metrics); communicate service notices; and comply with law.

We do not sell personal information. We do not use Clinic Data to train public generative AI models. Where AI-assisted features are offered inside a clinic's workspace, they operate under the clinic's configuration and applicable agreements.

4. Patient health information

If you are a patient of a clinic using Scribeberry, your clinic controls your health information for care purposes, including clinical notes, diagnoses, treatments, and related records.

Scribeberry processes that information to provide the Platform to your clinic. Access by Scribeberry personnel is limited to what is needed for support, security, hosting, and legal compliance, under confidentiality and access controls.

For access, correction, or complaints about clinical records, contact your clinic first. Your clinic's privacy policy (linked from the clinic's portal or booking footer) explains those rights under applicable provincial and federal privacy law.

5. Disclosure

We disclose information to: (a) subprocessors that host, send email/SMS, process payments, provide infrastructure, or otherwise help us operate the Platform, under contractual confidentiality and data-protection terms; (b) the clinic that owns the relevant workspace, for Clinic Data and account activity in that clinic; (c) professional advisors under confidentiality; (d) authorities when required by law or to protect rights, safety, and security; and (e) a successor in a merger, acquisition, or asset transfer, subject to continued protection of personal information.

A current list of material subprocessors is available on request at privacy@scribeberry.com, and may be provided to clinic subscribers under their Supplemental Agreement.

6. Cross-border transfers

We may process and store information in Canada and in other countries where we or our subprocessors operate. Where Clinic Data is subject to Canadian health privacy requirements that restrict storage or access, we will describe hosting locations and safeguards in the applicable Supplemental Agreement or security documentation provided to the clinic.

When information is transferred across borders, we use contractual and technical safeguards appropriate to the transfer.

7. Retention

We retain platform account and authentication data for as long as the account is active and for a reasonable period afterward for security, dispute resolution, and legal compliance.

Clinic Data retention for care and professional record-keeping is directed by the clinic. After a clinic subscription ends, we follow the return/deletion process in the Subscriber Terms and any Supplemental Agreement. Backup copies may persist for a limited period before deletion.

Audit and security logs are retained for a period appropriate to security and compliance needs.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, logging, and staff training. No method of transmission or storage is completely secure; please use strong unique passwords and protect your devices.

9. Your choices and rights

Staff and clinic administrators can update many account details in the staff portal. Patients can update certain portal profile fields where enabled by the clinic.

Depending on your jurisdiction, you may have rights to access, correct, or delete personal information, or to withdraw consent where processing is consent-based. For Clinic Data and clinical records, exercise rights with your clinic. For Scribeberry-held platform authentication or website data, contact privacy@scribeberry.com. We may need to verify your identity and may redirect clinic-record requests to the relevant clinic.

Cookie choices are described in our Cookie Policy.

10. Children

The Platform is used by clinics that may serve minors. Clinic accounts are for adults acting in a professional or guardian capacity. Patient portal accounts for minors should be created and managed according to the clinic's policies and applicable law. Scribeberry does not knowingly collect platform account information directly from children for marketing purposes.

11. Changes

We may update this Notice by posting a revised version with a new "Last updated" date. Material changes will be highlighted by notice on the Platform or by email to clinic administrators where appropriate.

12. Contact

Privacy inquiries: privacy@scribeberry.com.

Security incidents: security@scribeberry.com.

Scribeberry Inc., Canada.

If you are in Canada and are not satisfied with our response regarding Scribeberry's own platform practices, you may contact the Office of the Privacy Commissioner of Canada. Clinic-record complaints should follow your clinic's privacy policy and the applicable provincial commissioner or regulator.