Security and privacy
Your patients’ stories never sit on our servers.
No transcript, narrative, PCR field or audio is stored in the vitalvoice database. There isn’t a place for it. This page shows where every part of a call goes, who can see it, and what we commit to in writing, for the IT and legal teams who sign off.
The short version
Four numbers your team can hold us to.
0
Places in our database for clinical content
Transcripts, narratives, PCR fields and audio are processed and discarded. No table has a column that could hold them.
BAA Exhibit D.1
24 h
To tell you about a breach
HIPAA allows up to 60 days. We give initial notice within 24 hours of confirming your PHI was involved, and a detailed report within five business days.
BAA §4.4
0
Models trained on your calls
Not ours, and not our AI provider’s. Our provider runs under a BAA with zero data retention.
BAA §5.1–5.2
1 shift
How long calls usually stay on an iPad
Most departments set auto-wipe to run at shift change, so transcripts and narratives are cleared at the end of every shift. With no schedule set, they clear after 90 days.
BAA Exhibit D.2
The worst case
If our database were stolen tomorrow, no patient’s story would be in it.
Most security pages describe how well a vendor guards its copy of your patient data. We decided not to keep one. The patient data that’s easiest to protect is the data that was never stored.
What a thief would find
Facts about calls
- When each call started and ended
- Which mode and languages were used
- App version and template chosen
- Post-call ratings
- Department settings and the audit log
What they wouldn’t
Anything about a patient
- Not stored: Transcripts
- Not stored: Narratives and PCR fields
- Not stored: Audio
- Not stored: Patient names or details
- Not stored: Where the call happened
- Not stored: Questions asked of your protocols
Only your department could tie what’s left back to a call, by matching it against your own dispatch records. We still protect it as PHI under the BAA.
Follow one call
From the first word on scene to the signed chart.
Here is every place a call goes in online mode, in order. In offline mode, steps one and two happen on the iPad too, and nothing is sent anywhere.
- 01
The crew speaks on scene
A medic opens Ambient Scribe. Audio travels from the iPad straight to our AI provider over an encrypted peer connection. vitalvoice issues a short-lived key for that connection and never carries the audio itself.
- 02
vitalvoice drafts the narrative
The iPad sends the transcript to our API, which passes it to the AI provider and returns the draft in your template. Nothing is written to disk. Audio sent for final transcription is held in memory once, then overwritten with zeros on every exit path.
- 03
The call is kept on the iPad, encrypted
The transcript and draft are stored on the device, encrypted under a key held in the iOS Keychain. vitalvoice doesn’t hold that key, so our staff cannot open what is on your devices.
- 04
The medic reviews and signs
Every narrative is a draft until a member of your crew corrects it and signs it in your documentation platform. The signed chart lives in your ePCR, not with us.
- 05
The iPad clears itself on your schedule
Most departments time auto-wipe to shift change, so the transcripts and narratives from one shift are gone before the next crew picks up the iPad. A grace period keeps unsynced work from being lost. With no schedule set, local copies clear after 90 days.
Where everything lives
Three places, and only one of them is ours.
This is the same data map that sits behind the exhibits of our BAA. We built it by reading the code and the database schema, not from a policy document.
01 · Your iPads and browsers
The call itself
Encrypted under keys vitalvoice doesn’t hold. Wiped on your schedule.
- Transcripts and interpretation
- Draft narratives and PCR fields
- Medical-necessity review
- Audio waiting for final transcription, sealed with AES-GCM-256, excluded from device backups and purged once the transcript is final
- Encounter Flow progress, deleted with its call
02 · Passes through, never kept
Work in progress
Processed for the length of one request, then gone. Nothing written to our disks.
- Transcript text, to draft narratives and extract PCR fields
- Short audio windows, for final transcription
- Questions to Ask the Protocols, which are never logged
- Live audio, which goes device to provider and never touches our servers
Our only file storage holds Guides and logos. There is no bucket for patient data.
03 · What vitalvoice keeps
Facts about the call
Encrypted in the US. None of it is clinical.
- A session record
- Start and end time, duration, mode, languages, app version and template chosen. It also notes whether the call reached four milestones: interpretation connected, a line was interpreted, the final transcript finished, and a draft was written. No clinical content.
- Capture quality numbers
- Volume peaks, silence and retry counts for each audio window. No words, no audio.
- A post-call rating
- A 1–7 score and an optional comment. Comments that look like a birth date, record number, phone or email are rejected before they are saved.
- A tamper-evident audit log
- Who did what, and when. Kept for at least six years.
- Your department’s settings
- Name, enabled modes, templates, wipe schedule and approved email domains.
Why we still treat the session record as PHI. It contains no clinical content, but a start time and a language could be matched against your own dispatch records to identify a call. So we protect it as PHI under the BAA, and we tell you so.
Offline mode
No signal, nothing sent.
In offline mode, speech recognition and interpretation run entirely on the iPad. The call never leaves the device, so there is nothing in transit to protect and no provider in the picture.
Crews switch to it automatically in a canyon or a basement. Departments that want the strictest posture can set it as the only mode.
Controls your department holds
Your policy, set in your settings.
The decisions that shape your exposure belong to your administrators, not to us.
Auto-wipe schedule
Set it to run at shift change and every transcript and narrative clears at the end of each shift. You choose the interval, the local time, the timezone, and how long unsynced work is held first.
Offline-only mode
Keep every call on the device. Speech recognition and interpretation run on the iPad with nothing sent anywhere.
Which modes crews see
Turn Dictate, Ambient Scribe, Translate + Scribe and Guides on or off for the whole department.
Device membership
Remove an iPad from your department and it loses access to your configuration and reporting.
Browser access
Revoke a person and their browser deletes its locally held calls the next time it connects. Offline reopening expires at the end of a shift.
Reporting viewers
You approve the email domains that may view department reporting. Reporting shows totals only: no comments, transcripts, per-device detail or location.
For your IT team
Protected at every layer.
Each control below is verified in our code and infrastructure configuration, and the BAA commits us to it. Our organizational controls are monitored continuously and published in our trust center.
In transit
TLS 1.3, with TLS 1.2 as the floor
Every connection from devices to our API, and from our API to providers, on AWS-managed certificates with certificate transparency logging.
On our servers
Encrypted, private, protected from deletion
The database is encrypted at rest, unreachable from the public internet, and has deletion protection on. The AWS audit trail is encrypted under our own KMS key.
On the iPad
Keys stay in the Keychain
Calls are kept in an encrypted store keyed from iOS secure storage. Audio is sealed with AES-GCM-256, protected until first unlock, and never backed up.
In the browser
Keys that can’t be exported
Local calls are encrypted with AES-GCM-256 under non-extractable WebCrypto keys. Crews unlock with a PIN checked against an Argon2 verifier.
Audit
A log that shows tampering
Each entry is chained to the one before it with SHA-256. The database itself limits what an entry may contain, so call content cannot enter the log.
Logs and analytics
Built to forget identifiers
Session and user IDs are salted and hashed before they reach application logs. A denylist in code keeps transcripts, questions, locations and IDs out of analytics.
Crash reports
Personal data collection off
Error reporting runs with personal data collection disabled, and a scrubber cleans every event before it leaves the device.
Location
United States only
Your PHI is stored and processed in the US, in AWS us-west-2. It does not leave the country without your written consent.
People
Least privilege, reviewed quarterly
Administrative access is role-restricted, logged and reviewed at least every quarter, and removed promptly when a role changes.
For your legal team
Protecting your department, in writing.
Bringing in a new vendor shouldn’t bring in new liability. Our Business Associate Agreement puts each promise on this page into a numbered clause your counsel can point to.
Where a risk can only be managed on your side, the agreement says so plainly, so nobody finds out the hard way.
If something goes wrong
- Initial notice within 24 hours of confirming your PHI was involved. We won’t delay confirmation to finish an investigation.
- A detailed report within five business days, with what you need for your own notices under 45 CFR §164.404–410.
- Never later than 60 days after discovery, the outer limit HIPAA allows.
BAA §4.4–4.6
How AI is allowed to touch your data
- No training or fine-tuning on your PHI, by us or by any AI provider.
- No AI provider receives PHI without a BAA in place, and no provider keeps it past the response.
- No human review by the provider except to investigate a security incident or where law requires.
- Everything vitalvoice writes is a draft. Your crew reviews and signs it, and you own both the PHI and the output.
BAA §5
Who else is involved
- A published list of every provider, split by whether it may ever see PHI.
- At least 30 days’ notice before any new provider that may handle PHI, and the right to object.
- Every provider that handles PHI is bound to protections at least as strong as ours.
BAA §4.7, §7
Your rights over the records
- Access to records we hold within 10 business days; amendments and accounting of disclosures within 20.
- Audit records kept for at least six years.
- Every requirement of 45 CFR §164.504(e) mapped to the section that meets it.
BAA §4.8–4.13, Exhibit E
When you leave
- Your PHI returned or destroyed within 30 days, at no charge.
- A written certificate of destruction on request.
- Our obligations survive for as long as we hold anything of yours.
BAA §10, §13.3
What we ask of you
- Set device passcodes and encryption, and report a lost or stolen iPad promptly.
- Keep PHI out of support email, feedback comments, Guides and Flows.
- Keep your list of approved reporting domains current, and remove people who leave.
- Have a qualified crew member review every draft before it is signed.
BAA §6, §13.2
Public Agency Rider
Written for fire districts, cities and counties.
Public agencies can add a rider that takes precedence over the rest of the agreement. It removes the terms that usually stall a public procurement review.
Your state’s law
Governing law and venue are your state and county, not ours.
No indemnity from you
Your agency takes on no obligation to indemnify, defend or hold vitalvoice harmless.
Immunity untouched
Nothing waives or limits any immunity or tort claims act protection you have.
Public records respected
We accept that the agreement may be disclosable, and we carry the burden of protecting anything we mark.
Subject to appropriation
Non-appropriation of funds is not a breach.
No term beyond your board
Nothing extends your obligations past the term your governing body authorized.
Subprocessors
Two providers may see PHI. We name all of them.
Every other service we use is kept away from PHI by design, with a technical control that enforces it.
May process PHI
Amazon Web Services
Hosting, database, logging and key management in us-west-2.
Covered by the AWS BAA.
May process PHI
OpenAI
Speech recognition, interpretation, drafting and extraction in online mode.
Covered by our BAA with OpenAI. Zero data retention. No training.
Never receives PHI
- Cloudflare R2
- Guide documents and department logos only
- Firecrawl
- Reads a published Guide document, never call content
- Resend
- Sign-in email links
- Mixpanel
- Product analytics behind a code-level denylist
- Sentry
- Crash reports with personal data collection off
- Expo
- App builds and updates
- Apple and Google
- App distribution and testing
- RevenueCat
- Subscription status
- logo.dev
- Department logo lookup
Offline speech recognition (WhisperKit) and offline interpretation (Google ML Kit) run on the device and send nothing.
For your vendor review
Ask every AI vendor these questions. Here are our answers.
Use them in any procurement review, ours included. A vendor that can’t answer one in a sentence is worth a closer look.
The question
vitalvoice
- Where are transcripts and audio stored, and for how long?
- Never on our servers. On your devices, encrypted, until the wipe at shift change.
- Can your staff read our patient content?
- No. It is encrypted under keys held on your devices, which we don’t have.
- Does your AI provider keep our data or train on it?
- No. Our provider works under a BAA with zero data retention and no training.
- Can it run with nothing leaving the device?
- Yes. Offline mode runs speech recognition and interpretation on the iPad.
- How quickly will you tell us about a breach?
- Within 24 hours of confirming your PHI was involved.
- Do we have to indemnify you?
- No. Our Public Agency Rider rules it out and leaves your immunities untouched.
- Can you show us where every field lives?
- Yes. Our data map was built from the code and database schema, and we’ll send it.
Straight answers
The questions your team will ask.
Is vitalvoice HIPAA certified?
Nobody is. HHS doesn’t issue or recognize a private “HIPAA certification.” What we do is sign a Business Associate Agreement with your department, meet the Security Rule as your business associate, and give your team the documentation to check our work.
Does our patient data go to OpenAI?
In online mode, yes: audio and transcript text go to OpenAI to be transcribed, interpreted and drafted, and the result comes straight back. OpenAI works under a BAA with us, keeps nothing after the response, and never trains on it. If you’d rather nothing leave the device, run offline-only.
Can vitalvoice staff read our narratives?
No. Narratives are kept on your devices under keys we don’t hold. Our founders have role-restricted database access to the limited records listed above, such as session times and post-call ratings, and every access is written to the audit log.
What happens if an iPad is stolen?
Its calls are encrypted at rest under a key in the iOS Keychain, so a device passcode is the main lock. Remove the iPad from your department to end its access, and with auto-wipe set to shift change, it holds at most one shift of calls. iPads join your department anonymously with a join code, so no crew member’s login is exposed.
Can you remotely wipe a browser?
Not in every case, and we won’t claim it. When you revoke a person, their browser deletes its local calls the moment it next connects. An offline browser can’t learn of that until it reconnects, which is why offline reopening expires at the end of a shift.
What if vitalvoice goes down mid-shift?
Crews keep working. Capture continues on the device, and local calls stay available. Our database is backed up with seven days of point-in-time recovery, and the BAA states our exact availability setup so your team can plan around it.
Can we review the agreement before a pilot?
Yes. Ask for the BAA, the public agency rider and our data-flow map. We answer security questionnaires and send architecture documentation once a year on request, or any time after an incident affecting your PHI.
Send us your security questionnaire.
We’ll send the BAA, the public agency rider and our data-flow map, and answer your questionnaire directly. Write to Ishan Ahuja, our CTO, who is responsible for security and HIPAA compliance, at ishan.ahuja@vitalvoice.ai.
Or review our live controls and compliance resources in the vitalvoice trust center.