How it works
What happens to the recording
An ambient scribe's honest answer to the only question patients actually ask. Two retention windows, and why one would have been wrong.
The question a patient asks about ambient documentation is never about model accuracy. It is: where does the recording go, and who can listen to it later?
The answer should be short enough to say out loud in an exam room. Ours is: it is deleted as soon as the note exists, and never later than the next day.
Why the audio goes first
Raw audio is the worst thing in the system to hold on to. It is the only artifact that carries tone, hesitation, and everything said in the room that never belonged in a chart — and once it has been transcribed, nobody has a reason to open it again. It is maximum sensitivity paired with zero remaining utility, which is the exact profile of something that should not exist.
So it does not. The recording is destroyed when the note is finalized, and a sweep enforces a 24-hour ceiling for the case where a note never gets finalized at all.
Why the note stays a week
The obvious next move is to give everything the same short window, and it is wrong. The person entering and reviewing the visit for billing is not the person who was in the room, and they do not work on the clinician’s clock. Give them 24 hours and you have built a system that deletes the thing they need before they need it.
So there are two windows: audio, destroyed at finalization with a 24-hour ceiling. The drafted note, the dictation, and the appointment label, seven days.
The part that is a real engineering lesson
You cannot express two windows as one storage rule.
Cloud object storage expires objects with lifecycle rules that match on a key prefix. Every object belonging to one visit shares a prefix — that is what makes a visit a visit. So a single rule cannot say “delete this object in a day and that one in a week,” and if you write it as though it can, it will quietly apply the shorter window to everything.
We know because we did it. A single one-day expiration rule was deleting the biller’s note on the audio’s schedule, silently, and the bucket configuration read as though it were correct the whole time.
The fix was to stop asking storage to enforce policy it cannot express. Both windows now live in application code, where “why” and “how long” sit next to each other and can be tested. The storage layer stores.
Retention is a policy decision. Policy decisions belong somewhere a person can read them.