HIPAA Statement

Summary

This tool is not a covered entity, is not a business associate, and does not enter into business associate agreements. That is not a limitation of the product — it is a property of its architecture.

Client identifiers are removed inside your browser before any network request is made. Our servers receive redacted text only. Because protected health information (PHI) is never transmitted to us or stored by us, there is no PHI for a BAA to govern.

What leaves your browser

The redacted note text, the format you selected, and technical request metadata. The redaction preview shows you exactly what was replaced before you generate, and you can add names the pattern rules would not catch.

What does not leave your browser: your raw text, the generated note, and any document you export. Exports are produced locally as .docx files.

What we store

Account data: your email address, name if you provide one, and authentication records.

Metering rows: which format was generated, which model handled it, token counts, cost, latency, and outcome. These rows contain no clinical text.

Billing records: plan, amount, currency, and the payment provider transaction identifier. Card details are handled entirely by the payment provider.

Sub-processors

Cloudflare — hosting, database, and asset delivery.

OpenRouter — model gateway. Requests contain redacted text only. US-hosted model providers are used.

PayPal — payment processing and subscription billing.

Your responsibilities

You are the clinician and the record holder. You decide whether an external AI tool is permitted under your employer policy, your licensing board guidance, and your professional liability coverage.

Redaction reduces risk; it does not eliminate it. Free-text notes can contain identifying details that no pattern rule catches — a rare diagnosis in a small town, a distinctive job, a family configuration. Read the redaction preview, and write your notes the way you would want them read aloud in a deposition.

Every generated note must be reviewed and edited before it is signed. This tool drafts structure from your own words; it does not assess, diagnose, or make clinical decisions.

Questions to ask any AI documentation vendor

Does PHI reach your servers, and can you show me the request that leaves my browser?

Do you sign BAAs, and with which model providers?

Is my note text used for training, and can I opt out in writing?

How long are prompts and completions retained at the model provider, and where?

What happens to my data if I cancel?

Contact

Questions about this statement: support@soap.musepics.com.