Last update: August 18, 2026

Introduction

CliniScripts (“Company,” “we,” “our,” or “us”) is fully committed to protecting your privacy and ensuring the security of your information. This Privacy Policy outlines how we handle your data when you use our website (the “Site”), CliniScripts web platform, and CliniScripts mobile app.

This Privacy Policy describes the types of information CliniScripts may collect, access, process, use, disclose, retain, and delete in connection with our services, as well as the choices and rights available to you.

By using our Site or services, you acknowledge and agree to the terms of this Privacy Policy. If you do not agree, please refrain from using our services.

For healthcare professionals and organizations using CliniScripts to process information about their patients, the healthcare professional or organization remains responsible for obtaining any consent, authorization, or other permissions required under applicable privacy and healthcare laws before recording, uploading, or otherwise processing patient information through CliniScripts.

1. Information We Collect and Process

CliniScripts is designed to minimize the collection and retention of personal information. However, in order to provide and secure our services, we may process certain information, depending on the features you use.

Information You Provide

Depending on how you use CliniScripts, we may process (not store) the following:

• Account and contact information, such as your name, email address, and other information required to create or manage your account.
• Information you voluntarily provide when contacting our support team or communicating with us.
• Clinical information, audio, text, transcripts, notes, summaries, or other information submitted to or generated through the CliniScripts services for the purpose of providing transcription, summarization, documentation, and related functionality.
• Information associated with appointments and scheduling when you use the CliniScripts Calendar Integration.

CliniScripts does not use clinical or patient information for advertising, marketing, or unrelated commercial purposes.

Audio, Transcripts and Generated Notes

When you use CliniScripts’ clinical documentation functionality, audio, video, image, text, or other information may be transmitted to and temporarily processed by CliniScripts and its authorized service providers for the purpose of providing transcription, summarization, and documentation services.

Unless otherwise stated in this Privacy Policy or agreed with you, raw audio and other temporary processing data are not intended to be retained after the applicable processing session is completed.

Technical and Usage Information

To operate, secure, troubleshoot, and improve the Site and services, CliniScripts may process limited technical information, such as device, browser, application, security, error, and service usage information.

Where technically required for a specific service function, temporary technical identifiers or session information may also be processed.

2. No Sale of Personal Information

CliniScripts does not sell personal information or clinical/patient information.

We do not disclose clinical or patient information to third parties for advertising, behavioural profiling, or unrelated marketing purposes.

Where third-party service providers are used to provide, host, secure, or support the CliniScripts services, those providers may process information solely as necessary to perform the services on our behalf and subject to applicable contractual and privacy obligations.

3. Information Processing

Real-Time Processing

Any audio or data provided by the user may be processed in real-time or near-real-time solely for the purpose of providing transcription, summarization, documentation, scheduling, and related services.

CliniScripts may use third-party infrastructure, cloud services, and technology providers to support these functions. Such providers are authorized to process information only as necessary to provide the applicable services and are subject to contractual obligations relating to confidentiality and data protection.

AI Processing

CliniScripts uses artificial intelligence and machine-learning technologies to provide certain transcription, summarization, and clinical documentation functionality.

Clinical and patient information submitted through CliniScripts is processed only for the purpose of providing the requested services and is not used by CliniScripts to train, fine-tune, or develop general-purpose artificial intelligence or machine-learning models.

Where third-party AI or technology providers are used, CliniScripts requires those providers to process applicable information only for the services they provide to CliniScripts and to maintain appropriate privacy and security safeguards.

No Retention

CliniScripts is designed to minimize data retention. Certain information, such as account information, calendar information, appointments, or information intentionally saved within the CliniScripts platform ONLY authorized by the client, may be retained for as long as necessary to provide the services or as otherwise described in this privacy policy. By default, we do not save any client info or transcription.

Temporary clinical processing data, including audio used for transcription, is deleted following completion of the applicable processing, subject to any specifically disclosed retention period.

4. Information Sharing and Disclosure

Service Providers and Subprocessors

CliniScripts may use carefully selected third-party service providers and subprocessors to operate, maintain, secure, and provide the services. These providers may include cloud hosting providers, infrastructure providers, AI/transcription providers, security providers, communications providers, and other technology vendors.

Where such providers process personal or health information on behalf of CliniScripts, CliniScripts requires appropriate contractual, confidentiality, privacy, and security protections consistent with applicable law.

Legal Requirements

CliniScripts may disclose information where required or permitted by applicable law, regulation, court order, subpoena, or other lawful process, or where disclosure is reasonably necessary to protect the rights, safety, security, or property of CliniScripts, our users, or others.

Business Transfers

If CliniScripts is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, information may be transferred as part of that transaction, subject to applicable privacy and legal requirements.

Aggregated or De-Identified Information

CliniScripts may create aggregated or de-identified information that cannot reasonably be used to identify an individual. Such information may be used for legitimate business purposes, including understanding service usage, measuring performance, maintaining security, and improving the CliniScripts platform, provided that the information has been appropriately de-identified.

CliniScripts does not use identifiable patient/clinical information for these purposes.

5. Google User Data

Cliniscripts integrates with Google Calendar to provide scheduling functionality.

Our collection and use of information received from Google APIs will comply with applicable Google API policies and Google’s Limited Use requirements.

Data We Access

When you connect your Google account to Cliniscripts, we request the following OAuth scopes:

• …/auth/userinfo.email — your Google account email address, used solely to identify which Google account is connected to your Cliniscripts account.
• …/auth/calendar.events — read and write access to events on your primary Google Calendar.

We do not access your contacts, Drive, Gmail, profile photo, or any other Google service unless a future feature specifically requests additional permissions and you provide the required authorization.

How We Use This Data

The data is used exclusively to provide the features you have enabled in the Cliniscripts Calendar Integration settings:

• Import only: We read events from your Google Calendar and display them in Cliniscripts so you can see all scheduling in one place. Events from Google are shown as read-only.
• Export only: When you create, update, or cancel an appointment in Cliniscripts, we write the corresponding change to your Google Calendar.
• Two-way sync: Both of the above.

You can change the sync direction or disconnect Google Calendar at any time from the Calendar Integration panel inside the app.

You can also enable optional privacy filters that further restrict what is written to Google Calendar:

• Mark events as “Busy” only (no titles or details)
• Replace patient names with generic placeholders such as “Therapy appointment”
• Show imported external events as “Busy” only inside Cliniscripts

How We Share This Data

We do not sell, rent, or share Google user data with third parties for advertising, analytics, or marketing purposes.

We do not use Google user data to train any AI or machine-learning model.

Google user data may be processed by CliniScripts’ authorized infrastructure and service providers solely as necessary to provide the Google Calendar integration and related CliniScripts functionality. Such providers are subject to appropriate contractual and security requirements.

The entities that may process Google user data include:

• Google, as the source and provider of the Google services;
• CliniScripts and its authorized infrastructure/service providers, as necessary to provide the integration; and
• You, as the authenticated user.

CliniScripts does not use Google user data for advertising or unrelated commercial purposes.

6. How We Store and Protect This Data

We implement technical and organizational safeguards designed to protect information against unauthorized access, use, alteration, disclosure, or destruction.

Current security measures include:

• OAuth access tokens and refresh tokens are encrypted at rest using AES encryption before being written to our database (Google Cloud Firestore).
• Tokens are stored only on our backend servers and are never sent to the user’s browser or any client device.
• All traffic between your browser, our servers, and Google’s APIs is transmitted over HTTPS (TLS 1.2+).
• Access to our production database is restricted to authorized engineering personnel, audited, and protected by multi-factor authentication.
• Calendar events imported for display are not persisted server-side; they are fetched live from Google Calendar each time the calendar view is loaded.
• Appointments you create in Cliniscripts (which we write to Google Calendar) are stored in our database alongside your other Cliniscripts data.

No method of transmission or electronic storage is completely secure. While CliniScripts takes reasonable and appropriate measures to protect information, we cannot guarantee absolute security.

7. Data Retention and Deletion

CliniScripts retains information only for as long as reasonably necessary to provide the services, comply with legal obligations, resolve disputes, maintain security, and enforce our agreements.

Google Calendar

• Disconnect at any time: You can disconnect Google Calendar from inside the Cliniscripts app at any time (Calendar → Calendar Integration → Manage → Disconnect). When you disconnect, Cliniscripts immediately calls Google’s token revocation endpoint to invalidate the OAuth grant, and deletes the encrypted tokens from our database. Cliniscripts can no longer access your Google data from that moment on.
• Account deletion: If you delete your Cliniscripts account, all associated data — including any remaining Google tokens, calendar metadata, and appointments — is deleted from our systems.

Clinical Information

Temporary audio and processing data used to generate transcripts and summaries are deleted in accordance with our applicable retention procedures.

Information that you intentionally save within your CliniScripts account, such as generated clinical notes or appointment information, may remain available until you or your authorized organization deletes it or your account is terminated, subject to applicable legal and contractual retention requirements.

Backups

Deleted information may remain temporarily in encrypted backup systems until those backups are overwritten or securely deleted in accordance with our backup-retention procedures.

8. Your Privacy Rights and Choices

Depending on your jurisdiction and applicable privacy legislation, you may have rights regarding the personal information we hold about you, including the right to:

• Request access to personal information we hold about you;
• Request correction of inaccurate or incomplete personal information;
• Request deletion of personal information, subject to applicable legal or contractual exceptions;
• Withdraw consent where processing is based on consent, subject to legal or contractual limitations;
• Disconnect third-party integrations, such as Google Calendar; and
• Submit a privacy complaint or request information about how your personal information is handled.

To exercise applicable privacy rights, please contact us using the contact information below. We may need to verify your identity before responding to a request.

If you use CliniScripts through a healthcare organization, clinic, employer, or other customer organization, certain requests relating to patient information may need to be directed to that organization, which may be the responsible custodian/controller under applicable privacy legislation.

9. Patient and Healthcare Information

CliniScripts is intended for use by healthcare professionals and organizations for clinical documentation purposes.

Healthcare professionals and organizations are responsible for ensuring that they have the appropriate authority, consent, and legal basis to collect, record, upload, and process patient information through CliniScripts.

Patients should direct questions regarding the collection or use of their health information by their healthcare provider to that provider where the provider is the applicable health information custodian or controller.

CliniScripts processes patient information only as necessary to provide the services and in accordance with applicable contractual and privacy obligations.

10. Privacy and Regulatory Compliance

CliniScripts is committed to implementing privacy and security safeguards appropriate to the nature and sensitivity of the information processed through the platform.

CliniScripts seeks to comply with applicable privacy and health-information laws in the jurisdictions in which its services are offered, including applicable requirements under Ontario’s Personal Health Information Protection Act (PHIPA) and, where applicable, the U.S. Health Insurance Portability and Accountability Act (HIPAA).

11. Cookies and Tracking Technologies

We do not use cookies or tracking technologies for the purpose of collecting personal information for advertising or behavioral tracking.

Certain cookies, local storage, session information, or similar technologies may be used where technically necessary to operate, secure, authenticate, or maintain the functionality of the Site or services.

12. Marketing Communications

CliniScripts may send you service-related communications, including account notices, security alerts, technical information, support communications, and other messages necessary to provide the services.

Where permitted by applicable law and where you have provided the required consent, CliniScripts may also send promotional or marketing communications. You may withdraw consent to promotional communications at any time by using the unsubscribe mechanism in the communication or contacting us.

13. Children’s Privacy

CliniScripts services are intended for use by healthcare professionals and other authorized adult users and are not directed toward children.

We do not knowingly collect personal information directly from children for the purpose of providing the services.

14. International Data Processing

CliniScripts and its service providers may process information in Canada, the United States, or other jurisdictions where our authorized service providers operate.

Where personal information is transferred or processed outside the jurisdiction in which it was originally collected, CliniScripts will take reasonable steps to ensure that appropriate contractual, technical, and organizational safeguards are in place and that the processing complies with applicable privacy laws.

15. Privacy Breach and Security Incidents

If CliniScripts experiences a security incident involving personal or health information, we will assess the incident and take steps required by applicable law, including containment, investigation, remediation, and notification where legally required.

Where notification is required, CliniScripts will notify the appropriate individuals, customers, regulators, or other parties in accordance with applicable privacy and health-information laws.

16. Changes to This Policy

CliniScripts reserves the right to update this Privacy Policy. Significant changes will be communicated via the Site or email notifications.

When we make material changes, we will update the “Last Updated” date above and, where appropriate, provide additional notice through the Site, application, or email.

We encourage you to review this Privacy Policy periodically to remain informed about how we handle information.

17. Contact Information

If you have any questions about this Privacy Policy, wish to exercise applicable privacy rights, or have a privacy-related concern, please contact us at:

Email: CliniScripts@markitech.ca

Address: 172 Westdale Road, Oakville, ON, L6L 4Z8, Canada

Phone: +1 (844) 462-7548 | +1 (416) 684-2678

Privacy-related requests and complaints may be submitted using the contact information above.

Threat Risk Assessment

https://cliniscripts.com/wp-content/uploads/2025/03/TRA-Summary-for-Cliniscripts.pdf

Privacy Impact Assessment

https://cliniscripts.com/wp-content/uploads/2025/03/PIA-and-TRA-Summary-Combined-for-Cliniscripts.pdf