Privacy Policy

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Full name
• Email address
• Password (stored in encrypted form only)
• Profession/role
• Organisation name (if applicable)

3.2 Clinical Documentation

When you use our Service to create clinical documentation, we process:

• Audio recordings of sessions (temporarily, for transcription purposes only)
• Transcripts generated from audio recordings
• Clinical notes generated by our AI system
• Client/patient information you choose to record
• Session metadata (date, type, duration)

3.3 Technical Information

We automatically collect certain technical information:

• IP address
• Browser type and version
• Device information
• Usage patterns
• Session timestamps

Security and abuse protection. Our public forms (sign-up, contact and demo call requests) may include an automatic check that the form is being used by a person and not an automated program. To run it, our security and abuse protection provider receives your IP address and technical information about your browser and device. It does not receive what you type into the form. It uses this only to tell people apart from automated abuse. This information is processed in Australia and the United States, and may pass through other countries on the provider's global network.

3.4 Payment Information

For paid subscriptions, payment processing is handled by a PCI DSS compliant third-party payment processor. We do not store complete credit card details.

Student access. If you take up free student access, we use your account email address (a university or TAFE address) and, if you choose to upload one, a screenshot of your student portal, an enrolment confirmation or a transcript. We use them only to check that you are eligible. We review an uploaded document by hand and delete it once we have made a decision, or after 60 days if it has not been reviewed. We keep the decision, the dates of your student access and who reviewed it as part of our account records.

3.5 Information We Do NOT Collect

We do not collect:

• Biometric data (facial recognition, fingerprints, voice biometrics)
• Location data (GPS tracking, geolocation)

3.6 Enquiries Through Our Websites

When you send an enquiry through an enquiry form on groundedscribe.com, we collect your name, email address, the school or organisation you work for, your role, and your message, and anything else you choose to add, such as a phone number, your state and sector, team size, topics of interest and good times to call. When you ask for a guide from our library pages, we collect your email address and, if you give them, your school and role. We use these details only to respond to your enquiry or send the guide. Your enquiry is delivered to our team by email through our email service provider, which processes it in the United States. We keep enquiry records for as long as we need them to deal with your enquiry and any follow-up, and delete them on request. We do not add you to a mailing list unless you ask us to.

3.7 Descant (schools)

Descant, our school product, has its own privacy policy at descant.com.au/privacy (version 1.0, effective 27 September 2026). It applies to school workspaces we host, at descant.com.au or groundedscribe.com addresses, and to descant.com.au. Our commitments to schools are unchanged.

4. How We Use Your Information

4.1 Service Delivery

• Process audio recordings to generate transcriptions
• Generate AI-powered clinical notes from transcripts
• Store and retrieve your clinical documentation
• Provide access to assessment tools and templates

4.2 Account Management

• Create and manage your user account
• Authenticate your identity when you log in
• Process subscription payments
• Provide customer support

4.3 Service Improvement

• Analyse aggregate usage patterns to improve our Service
• Identify and fix technical issues
• Develop new features and functionality

4.4 Communication

• Send essential service notifications
• Respond to your enquiries and support requests
• Provide important updates about our Service

4.5 What We Do NOT Use Your Information For

We do not:

• Sell your personal information to third parties
• Use your data for marketing purposes without consent
• Create user profiles for advertising
• Train AI models on your clinical data
• Share your data with third parties for their own purposes
• Engage in behavioural profiling or tracking for advertising or third-party data sharing (see Section 11 for the aggregate engagement metrics we collect on our public marketing pages only)

4.6 Automated Processing and Decisions

Some features use computer programs that act on personal information. None of them makes a clinical, diagnostic, eligibility or disciplinary decision about a person.

• AI-drafted notes: our AI drafts notes from a transcript or dictation. A person reviews every draft before it is finalised.
• AI document drafts and summaries: our AI drafts documents (such as reports and letters), and summaries of calls, voicemail messages and chat conversations. A person reviews a draft document before it is used; summaries are shown to staff as a starting point, not a record of fact.
• AI phone reception: where a practice turns it on, our AI receptionist can book appointments on the practice's behalf using the caller's details and the practice's settings. It can also decide not to book, holding the request for the practice to review, for example when it cannot confirm who the caller is.

4.7 Marketing Communications

As an account holder, you may occasionally receive emails about new features, product updates, and special offers relating to the Service. We rely on your existing relationship with us as the basis for these messages (consistent with the Spam Act 2003 (Cth)), and every such email includes a one-click unsubscribe link. You can opt out at any time from that link or from Settings → Notifications → Product News & Offers. Opting out never affects essential account emails (billing, security, trial status), which are not marketing and cannot be disabled while your account is active. We never sell your information or share it with third parties for their own marketing.

5. Data Storage and Processing

5.1 Australian Data Storage

5.2 AI Processing

Audio recordings are stored in Australia until they are processed, transcribed in Australia by a specialist provider, then deleted from our storage. Clinical note generation, note modification, and AI-assisted documentation are then processed in Australian data centres. A recording that cannot upload stays on your own device so you can retry.

Free-plan dictation works differently: it uses your web browser's own built-in speech recognition rather than our transcription provider. Depending on your browser, the browser maker may process that audio on its own servers, which may be outside Australia. Only the resulting text is sent to us.

AI phone reception is the one exception: a live call is carried, and its speech recognised and voiced, by our telephone provider in the United States, in real time. Any call recording, a voicemail included, is transcribed in Australia, and a call recording is then immediately and permanently deleted. Only the resulting text transcript and call summary are stored — encrypted, in Australia. The exception is a voicemail message a caller chooses to leave: it is kept in Australia for the practice to hear, and deleted at the end of the practice's retention period.

Safeguards we maintain:

• All AI providers that process your data hold SOC 2 Type II certification
• We delete session audio from our own storage once it is processed; a recording that cannot upload stays on your own device so you can retry
• Your data is never used to train, fine-tune, or improve AI models
• All data is encrypted in transit using TLS 1.3
• Providers operate under contractual terms (including data processing agreements) that include purpose limitation, security obligations, and breach notification requirements

5.3 Data Location Summary

5.4 Encryption

• In Transit: TLS 1.3 encryption for all data transmission
• At Rest: AES-256 encryption for all stored data
• Passwords: bcrypt hashing with salt (never stored in plain text)

5.5 Service Provider Certifications

Our service providers maintain independently audited security certifications appropriate to their service. Depending on the provider, these may include:

• SOC 2 Type II (independently audited security controls)
• ISO 27001 and IRAP (our Australian cloud infrastructure)
• PCI DSS Level 1 (payment card security, our payment processor)

Not every provider holds every certification, and these certifications are held by the providers — they do not mean Grounded Scribe itself is independently certified.

6. Disclosure of Personal Information

6.1 Third-Party Service Providers

We may disclose personal information to third-party service providers for the purposes of:

• Speech-to-text transcription services
• AI-powered note generation services
• Telephone and SMS services for AI phone reception
• Email delivery services
• Payment processing services
• Website analytics (public pages only)
• Security and abuse protection (checking that our public forms are used by a person)

These providers process data for the specified purpose only and maintain appropriate security certifications. Audio and transcript data is processed in real-time and not retained by the transcription and AI providers. Our records are stored in Australia; the email and SMS providers keep the messages they deliver for their own delivery records.

6.2 Legal Requirements

We may disclose your information if required by law or in response to valid requests by public authorities.

6.3 Business Transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any change in ownership.

6.4 No Sale of Data

We will not sell, rent, or trade your personal information to third parties for their marketing purposes.

6.5 Service Provider Safeguards

All service providers are bound by data processing agreements that include purpose limitation, security obligations, breach notification requirements, and restrictions on further sub-processing. We delete session audio from our own storage once it has been processed. No service provider uses clinical data for model training. Further details about our service providers are available to customers on request.

8. Data Retention

8.1 Retention Periods

8.2 Subscription Cancellation

If you cancel your paid subscription or choose not to renew, your account reverts to the free plan. Your client records, session notes and assessments are retained and accessible within free plan limits; transcripts and voicemail messages continue to follow their retention periods (section 8.1).

8.3 Account Deletion

We do not automatically delete Grounded Scribe accounts or clinical notes. Some records are deleted automatically on a schedule you control (transcripts and voicemail messages; see section 8.1). Otherwise, account deletion only occurs when you explicitly request it by emailing us.

When you request permanent account deletion:

• We confirm your request and provide a 30-day export window
• You export your own data directly from within the application using self-service export tools (JSON, CSV, PDF formats) — we do not access or handle your clinical data during this process
• After the 30-day window, we manually and permanently delete all account data
• We send you written confirmation by email that deletion has been completed
• Audit logs may be retained for legal compliance purposes

For inactive accounts (12 months with no activity), we may contact you by email to confirm you wish to keep your account active. No data is deleted without your explicit written confirmation. See our Terms of Service for full details.

8.4 User-Controlled Deletion

Users can delete individual sessions, clients, and notes directly within the application at any time. Individual record deletions are processed immediately.

9. Your Rights

Under the Australian Privacy Principles, you have the right to:

9.1 Access

You can request access to the personal information we hold about you. You can view and download your data through the web interface in PDF, JSON, or CSV formats.

9.2 Correction

You can request correction of any inaccurate or incomplete information. You can edit and update information at any time through your account.

9.3 Deletion

You can request deletion of your personal information, subject to legal requirements.

9.4 Data Portability

You can request a copy of your data in commonly used formats.

9.5 Withdrawal of Consent

You can withdraw your consent at any time by closing your account.

9.6 Complaint

You can lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC).

12. Children's Privacy

Grounded Scribe's clinical platform is designed for use by adult professionals. Practitioners using it to document sessions involving minors are responsible for ensuring appropriate consent has been obtained in accordance with their professional obligations and applicable legislation.

Australia's Children's Online Privacy Code is due to be registered by 10 December 2026. We will update this policy to meet it where it applies to us.

13. Third-Party Service Providers (APP 8)

Transcription and clinical note generation are performed in Australia, and no audio or clinical records are stored overseas. Some services run in the United States: live AI-receptionist calls, SMS, email delivery, payments, website analytics and security and abuse protection. So limited personal information (such as a caller's voice during a live call, your email address or billing details) may be disclosed to recipients in the United States.

Countries: the main country outside Australia to which we disclose personal information is the United States. This covers phone and SMS delivery for AI phone reception (including the call's live speech recognition and voice), email delivery, payment processing, analytics on our public web pages and the automatic check on our public forms that you are a person. Address lookup, when you type an address, uses a global provider whose servers may be in the United States or elsewhere. If you connect your own calendar, event details go to your calendar provider, which you choose and which may store them in any country. Free-plan dictation uses your own browser's speech recognition, which the browser maker may process outside Australia.

We take reasonable steps to ensure all service providers handle personal information in accordance with the Australian Privacy Principles. These steps include:

• Selecting providers with independently audited security controls (SOC 2 Type II)
• Ensuring contractual protections are in place, including data processing agreements with purpose limitation and breach notification obligations
• Conducting due diligence on provider security practices and certifications
• Ensuring no clinical data is used for AI model training by any provider

A complete list of our sub-processors and their data handling practices is available to customers on request by contacting privacy@groundedscribe.com.

16. Complaints

If you believe we have breached the Australian Privacy Principles or have a complaint about our handling of your personal information, please contact us using the details below. We will investigate your complaint and respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

17. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, or want to access or correct your information, contact our Privacy Officer. We acknowledge privacy requests within 3 business days and respond within 30 days.