Privacy Policy

Speekr is a Delaware corporation headquartered in the United States. Our Privacy and Security Officer can be reached at raj@speekr.app.

Account information. For each clinician and Practice member: name, email address, professional role and specialty, Practice name, role in the Practice (owner, admin, or member), and sign-in identifiers. If you choose "Continue with Google," we receive your name and email address from Google. Billing details are collected and processed by our payment processor, Stripe; we do not store card numbers.

Patient records (PHI, provided by the Practice). Patient name, date of birth, diagnoses, clinical history, and treatment goals, together with the records a clinician uploads or pastes, such as prior reports, evaluations, and session notes exported from the Practice's own electronic health record.

Information Speekr derives (PHI). Treatment dates and visit counts, measurements and other clinical observations, the structure and wording of reference reports (templates), draft documents with their supporting sources and automated checks, clinician edits, approved documents, and documentation due dates.

Technical and usage information. IP address, browser user agent, timestamps, and logs generated by our infrastructure to operate and secure the Service. Our application logs record identifiers only, never patient names or clinical text. To see how Speekr is used, we count visits: a random identifier kept in your browser's local storage, how long a page is on screen, whether a sign-up or log-in button was clicked, and, once you are signed in, your account. We use no cookies or third-party analytics for this, and never record page contents or patient information.

We do not record therapy sessions, and we do not collect information directly from patients.

• to provide, operate, maintain, and support the Service;
• to extract clinical information from uploaded records, learn the format of a Practice's reports, check whether the records for a reporting period are complete, and draft documentation for a clinician to review, edit, and approve;
• to track documentation due dates and send reminders, which contain no patient-identifying information;
• to authenticate users, enforce access controls, and detect and prevent abuse, fraud, and security incidents;
• to keep an audit trail of activity involving PHI, as required by HIPAA (45 C.F.R. § 164.312(b));
• to communicate with Practices about their account and the Service;
• to comply with legal obligations.

We do not use PHI to train or improve any AI or machine-learning models. Drafts are generated with Amazon Bedrock, which does not use the inputs or outputs it processes for us to train models. We do not sell personal information or PHI, and we do not use it for advertising.

We share information only with the following subprocessors:

• Amazon Web Services, Inc. — hosting, database and file storage, background processing, sign-in, text extraction from scanned documents (Amazon Textract), and AI model inference (Amazon Bedrock). AWS is the only subprocessor that receives PHI, and does so under a Business Associate Agreement with Speekr. Data is processed in the United States (us-east-2).
• Stripe, Inc. — subscription billing. Stripe receives account and billing information only, never PHI.

If you sign in with Google, Google receives the fact of your sign-in under its own privacy policy. It receives no PHI. We will give Practices at least thirty (30) days' advance notice of any new subprocessor that will process PHI.

All PHI is stored and processed in the United States, in AWS's us-east-2 region. PHI is kept only in our database and in encrypted file storage; it is not copied into logs, analytics, or email.

• Encryption. The database and file storage are encrypted at rest with keys we manage in AWS Key Management Service. All connections use TLS.
• Network isolation. The database runs in an isolated private network with no access to or from the public internet.
• Practice isolation. Each Practice's records are separated from every other Practice's by checks in the application and, as a second layer, by row-level security in the database.
• Access control. Within a Practice, every active member can work with every patient, so that clinicians can cover for one another. Only owners and admins can invite or remove members, and removing a member ends their access immediately. Our services run with least-privilege permissions, and links to files expire after five minutes.
• Audit logging. Clinical changes, visit-count corrections, record access, and approvals are recorded with the user's identity and a timestamp in an append-only log. Each approval records exactly who approved the document.
• Integrity. Approved documents cannot be changed or silently overwritten.
• Authentication. Users sign in with email or with Google, through Amazon Cognito. If you use Google, we strongly encourage two-factor authentication on your Google account.

We keep PHI while the Practice's account is active. When a clinician leaves a Practice, the Practice's records remain with the Practice and the clinician's access ends. A Practice that cancels can export its records first; afterwards, Speekr returns or destroys PHI as set out in the Business Associate Agreement, except where the law requires us to keep it. Data that has been de-identified in accordance with 45 C.F.R. § 164.514 may be retained.

Speekr is not directed to children and we do not knowingly collect information directly from children. Many clinicians who use Speekr treat minors; in those cases, information about minor patients is provided to Speekr by the Practice, which is responsible for having the authorizations HIPAA and state law require to do so.

If you are a patient (or the parent or guardian of a patient) whose Practice uses Speekr, your rights to access, amend, and restrict your PHI and to receive an accounting of disclosures are exercised through your Practice, which is the Covered Entity. Please contact your Practice directly. If you contact Speekr, we will forward your request to the Practice and help it respond.

In the event of a Breach of Unsecured PHI, Speekr will notify the affected Practice without unreasonable delay and in no event later than thirty (30) calendar days after discovery, and will cooperate with the Practice's notification obligations to affected individuals and to the U.S. Department of Health and Human Services.

We may update this Privacy Policy from time to time. When we make material changes, we will update the version number and date above and notify Practices by email or in the product. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

Questions about this Privacy Policy or Speekr's privacy practices can be directed to raj@speekr.app.