Security & data handling
Where the recording goes, and how long it stays.
A page written to be read by the person who has to sign the business associate agreement, not by a search engine. Every number below is taken from what the software does, not from what we would like it to do.
Who is who
Your practice is the covered entity. SimaNotes LLC is a business associate. That is the whole legal structure, and it decides everything else on this page.
It means patients’ rights over their health information run against your practice, through your Notice of Privacy Practices — not against us, and not through anything on this website. Our handling of that information is governed by the business associate agreement we sign with you. We do not use it for anything that agreement does not permit, and we do not train models on it.
Two retention windows, because there are two readers
Audio and the note it produced are not the same risk and are not kept for the same time.
| What | Kept | Why that long |
|---|---|---|
| Raw audio | Destroyed when the note is finalized; 24 hours maximum | The recording is the largest breach surface in the system and, once transcribed, it has no reader. Keeping it longer buys nothing and risks everything. |
| Draft note, dictation, appointment label | 7 days | The person entering and reviewing the visit for billing needs a working week to do it. One shared window would have expired the biller’s note on the audio’s clock. |
Both windows are enforced in the application, by a job that sweeps and deletes — not by a storage lifecycle rule. Storage rules match on a key prefix, and every object for a visit shares one, so a single rule cannot hold two different windows. This distinction is the sort of thing that only matters until the day it does.
The chain, end to end
| Stage | Where it runs | Protection |
|---|---|---|
| Capture | The clinician’s own laptop, in the browser | Buffered locally so a crash does not lose the visit; uploaded over TLS |
| Storage | Amazon S3 | Encrypted at rest with a customer-managed key; private, no public access |
| Transcription | Deepgram, medical speech model | Speaker-separated; a subprocessor, under written agreement before any practice records — see below |
| Drafting | Claude, via Amazon Bedrock | Runs inside the same cloud account — no separate model vendor in the path |
| Access | Every API route | Authenticated per user, and authorised per visit: a signed-in user cannot reach a visit that is not theirs |
What we deliberately do not do
- No analytics or tracking — not on this website, and not in the extension.
- No training on your data. Visit content is used to produce your note and nothing else.
- No writes to the chart at all. A section goes to the clipboard; the clinician pastes it, or it does not go in.
- No recording without a spoken consent step. Florida requires the consent of everyone recorded, and the workflow is built around that rather than around a form.
We will not process patient audio for a practice until all of the following are true, in writing:
- A signed business associate agreement between your practice and SimaNotes LLC.
- Signed agreements with each subprocessor above, on the account your data will actually use.
- Your patient consent language reviewed by your own counsel and live in your intake workflow.
Development and demonstration work is done on synthetic visits — invented patients, invented histories — precisely so that none of the above has to be rushed.
Questions a security review would ask that this page does not answer: ask them directly. We would rather answer them than have you infer.