Privacy Policy

1. Introduction

Scribemarrow, Inc. ("the Company," "we," "us," or "our") operates the website scribemarrow.com (the "Service"). Scribemarrow provides ambient AI clinical documentation software designed for independent outpatient physician practices. This Privacy Policy explains what information the Company collects through this marketing and information website, how we use it, and the choices you have. It applies to information collected through scribemarrow.com and through direct communications with us.

A note on scope: this Policy covers scribemarrow.com, the Company's public-facing website -- the pages you are reading now. The Scribemarrow clinical documentation application used by physician practices operates under separate customer agreements and a Business Associate Agreement ("BAA") that governs protected health information. Patient visit audio and clinical notes processed through the Scribemarrow application are PHI subject to HIPAA and handled under those agreements, not under this Policy.

The Company is based at 1222 Demonbreun Street, Suite 900, Nashville, TN 37203 and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, email address, phone number) when you fill out a contact form, request early access, or subscribe to updates;
• Practice information you choose to share (practice name, specialty, EHR platform, number of providers) when requesting a product evaluation;
• The content of any messages you send us.

We do not collect patient information, clinical notes, or visit recordings through this website. That data is handled exclusively within the Scribemarrow application under the BAA and applicable HIPAA requirements.

2.2 Information Collected Automatically

When you visit scribemarrow.com, we automatically collect limited technical information:

• IP address and approximate location (city and region level, not precise coordinates);
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 5).

2.3 We Do Not Knowingly Collect Children's Data

scribemarrow.com is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

We use the information we collect to:

• Respond to inquiries and provide requested information about Scribemarrow's products and services;
• Operate, maintain, and improve this website;
• Manage the early-access program and communicate with practices about onboarding, product updates, and support;
• Send service updates and (with your consent where required) marketing communications about Scribemarrow;
• Understand how healthcare professionals find and evaluate Scribemarrow, in order to improve our marketing and outreach;
• Detect, investigate, and prevent fraud or abuse;
• Comply with legal obligations.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (such as web hosting, email delivery, and site analytics) under contractual confidentiality terms;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties. We do not share practice contact information with other healthcare technology vendors for marketing purposes.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, remember preferences, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described, to comply with legal or accounting obligations, and to resolve disputes. Inactive marketing-list contacts are purged after 24 months of no activity. Server access logs are retained for 90 days and then aggregated. Contact form submissions are retained for as long as the inquiry remains active and for a reasonable period thereafter.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information collected through this website, including TLS encryption in transit, restricted-access databases, and least-privilege access controls. The Scribemarrow clinical application maintains additional security controls appropriate for PHI under HIPAA. No system is perfectly secure; we cannot guarantee absolute security of information transmitted over the internet.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access to, correction of, and deletion of personal information we hold about you, as well as the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. Tennessee Residents (TIPA)

Under the Tennessee Information Protection Act ("TIPA"), Tennessee residents have the rights described below.

9.1 Your TIPA Rights

• Right to Confirm and Access personal data we process about you.
• Right to Correct inaccuracies, taking into account the nature of the data and processing purposes.
• Right to Delete personal data we have collected from or about you.
• Right to Data Portability in a portable format where technically feasible.
• Right to Opt Out of targeted advertising, sale, and profiling for significant decisions.

9.2 How to Exercise

Email [email protected]. We respond within 45 days; one 45-day extension is available with notice.

9.3 Appeal

You may appeal a denial by replying to our response. Unresolved appeals may be reported to the Tennessee Attorney General.

10. California Visitors

If you are a California resident visiting from another state, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA / CPRA request, email [email protected] with the subject line "California Privacy Request."

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

12. Contact

Questions, requests, or complaints about this Policy can be sent to: