Business Associate Agreement

Last updated: September 23, 2026

This Business Associate Agreement (“BAA”) is entered into between the subscriber accepting it during onboarding (“Covered Entity”) and Scribe (“Business Associate”) and applies to Pro and Team plans.

1. Permitted uses

Business Associate may use and disclose protected health information only to provide the documentation service described in the Terms of Service, and as required by law.

2. Safeguards

Business Associate maintains administrative, physical, and technical safeguards including encryption in transit and at rest, per-user access controls enforced at the database level, audit logging of note access, and automatic deletion of audio after processing and transcripts after 30 days.

3. Subcontractors

Business Associate ensures that any subcontractor that creates, receives, maintains, or transmits protected health information on its behalf agrees to the same restrictions in writing. Free-plan transcription may be performed by a provider that has not signed a BAA and is therefore not covered by this agreement.

4. Reporting

Business Associate will report any use or disclosure not permitted by this BAA, including breaches of unsecured protected health information, without unreasonable delay and within 30 days of discovery.

5. Individual rights

Business Associate will make protected health information available to Covered Entity as needed to satisfy individual access, amendment, and accounting requests. The app provides export and deletion for every note.

6. Term and termination

This BAA remains in effect while Covered Entity maintains a paid subscription. On termination, Business Associate will delete all protected health information within 30 days unless retention is required by law, in which case protections continue for as long as the information is retained.

7. Acceptance

Acceptance is recorded with a timestamp when the subscriber checks the BAA box during onboarding.