Privacy Policy - SpeechSage

How SpeechSage collects, uses, and protects personal data across its website and AI assistant services.

1. Introduction and Scope

SpeechSage, Inc. ("SpeechSage," "Company," "us," "we," or "our") is committed to protecting the privacy of personal data. This Privacy Policy describes how we collect, use, disclose, and protect personal data through our website, AI assistant services, mobile applications, and all other online and offline interactions (collectively, our "Services").

This Privacy Policy applies to information we collect about:

• Individual consumers and website visitors ("Visitors")
• Healthcare practices, clinics, and other business customers who subscribe to our Services ("Practice Customers")
• Patients and callers who interact with our AI assistant system on behalf of Practice Customers ("Callers")

Important: This Privacy Policy does not apply to Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Our processing of PHI is governed by our Business Associate Agreements ("BAAs") with Practice Customers and our separate Notice of Privacy Practices. If you are a patient or caller, please consult your healthcare provider's Notice of Privacy Practices for information about how your health information is handled.

We may update this Privacy Policy from time to time. Any updated version will be effective when posted, and the "Last Updated" date above will be revised. If we make material changes, we will notify affected parties by email or through our Services.

2. Sources of Personal Data

We collect personal data from the following sources:

Directly From You

When you visit our website, create an account, subscribe to our Services, contact us, or communicate with us via email, phone, or chat.

From Callers via Our AI Assistant

When patients or other individuals call a healthcare practice that uses our AI assistant service, we collect voice data, call metadata, and information provided during the call (such as name, phone number, reason for calling, and appointment preferences).

Automatically and Through Cookies

When you interact with our website, we may automatically collect information through cookies, pixels, analytics tools, and similar technologies. See Section 9 (Cookies and Tracking Technologies) for details.

From Third Parties

We may receive personal data from scheduling systems, electronic health record (EHR) platforms, calendar integrations, and other third-party services that our Practice Customers connect to our Services. We also collect data via Google sign-in when you use that feature.

From Practice Customers

Healthcare practices may provide us with information about their operations, staff, and scheduling preferences to configure our Services.

3. Types of Personal Data We Collect

Depending on how you interact with our Services, we may collect the following categories of personal data:

• Identifiers: name, email address, phone number, username, and device identifiers (e.g., IP address, cookie IDs)
• Contact Data: mailing address, business contact information
• Voice and Audio Data: voice recordings of calls handled by our AI assistant, and transcripts generated from those recordings
• Call Metadata: date, time, duration, and routing information for calls
• Technical Data: IP address, browser type and version, operating system, device information, and other technical identifiers
• Usage Data: information about how you use our website and Services, including pages visited, features used, and interaction patterns
• Scheduling and Appointment Data: appointment requests, scheduling preferences, and related information provided during calls or through integrations
• Commercial Data: subscription and billing information, transaction history, and service usage records
• Google Account Data: information provided through Google sign-in, subject to Google API Services User Data Policy
• SMS/Communication Data: phone numbers, message content, opt-in status, and consent records related to appointment reminders and notifications
• Non-Precise Geolocation: approximate location derived from IP address

4. How We Use Personal Data

We use personal data for the following purposes:

To Provide and Operate Our Services

This includes operating our AI assistant, processing and routing calls, generating transcripts and call summaries, scheduling appointments, sending SMS and email appointment reminders, managing Practice Customer accounts, and processing payments.

To Improve and Develop Our Services

This includes analyzing service performance, debugging and resolving technical issues, improving our AI models and voice processing accuracy, and developing new features.

To Communicate With You

This includes responding to inquiries, providing customer support, sending service-related notifications, and (with consent) marketing communications. You can unsubscribe from marketing emails via the unsubscribe link or respond "STOP" to text messages.

For Legal, Safety, and Compliance Purposes

This includes complying with applicable laws and regulations (including HIPAA where applicable), responding to legal process, enforcing our terms and policies, protecting the safety and security of our Services, and detecting and preventing fraud.

For Business Transactions

In connection with a merger, acquisition, sale of assets, or other corporate transaction, your personal data may be transferred as part of that transaction.

5. Artificial Intelligence and Data Processing

SpeechSage uses artificial intelligence to power our AI assistant service. This section describes how personal data is processed in connection with our AI features.

Types of Data Our AI Processes

• Voice audio from incoming calls to Practice Customers
• Transcripts and text generated from voice processing
• Call content, including caller-provided information such as names, phone numbers, symptoms, appointment requests, and other details shared during a call
• Scheduling data from connected EHR and calendar integrations

Third-Party AI Service Providers

We use third-party AI service providers for voice recognition, speech processing, natural language understanding, and related AI functionality. These providers may include large language model providers, speech-to-text services, and cloud infrastructure providers. We maintain Business Associate Agreements (BAAs) with our AI service providers that handle data which may contain PHI, ensuring HIPAA-compliant processing.

Our third-party AI providers are contractually prohibited from using your data for their own purposes, including training their models on your data, except as necessary to provide the services to us and as permitted under our agreements.

How AI-Processed Data Is Shared With Practice Customers

Call transcripts, summaries, and relevant caller information are shared with the Practice Customer whose phone line received the call. This is a core function of our service and is governed by our service agreements and BAAs with Practice Customers.

Your Choices

Callers interacting with our AI assistant may be informed at the beginning of the call that the call is being handled by an AI assistant and may be recorded. If you do not wish to interact with the AI system, you may request to leave a voicemail or call back during staffed hours, depending on the Practice Customer's configuration.

6. How We Disclose Personal Data

We may disclose personal data to the following categories of recipients:

• Practice Customers: Call transcripts, summaries, appointment requests, and caller information are shared with the healthcare practice whose phone line the caller contacted. This is a core service function.
• AI and Technology Service Providers: Third-party providers that help us deliver AI functionality, including voice processing, transcription, natural language understanding, cloud hosting, and infrastructure services. All providers handling potentially sensitive data operate under BAAs.
• Scheduling and Integration Partners: EHR systems, calendar platforms, and other tools connected by Practice Customers, to facilitate appointment scheduling and related workflows.
• Communication Service Providers: SMS platforms, email delivery services, and telecommunications providers that help us deliver appointment reminders and notifications.
• Payment Processors: Third-party payment services that process subscription payments on our behalf.
• Professional Advisers: Lawyers, accountants, auditors, and insurers as necessary for our business operations.
• Law Enforcement and Government Bodies: When required by law, legal process, or to protect the rights, safety, or property of SpeechSage, our customers, or others.
• Corporate Transaction Parties: In connection with a merger, acquisition, or sale of assets.

We require all third-party service providers to respect the security of personal data and to process it only for specified purposes and in accordance with our instructions. We do not sell personal data.

7. SMS and Mobile Information

SpeechSage may send SMS appointment reminders and notifications to Callers on behalf of Practice Customers. The following applies to SMS and mobile data:

• Your mobile information will not be sold or shared with third parties for promotional or marketing purposes.
• All categories above exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties except as necessary to deliver the messaging service.
• We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign.
• We may share your SMS opt-in or consent status with third parties that help us provide messaging services, including platform providers, phone companies, and other vendors who assist with text message delivery.

This commitment applies to any method of transfer. "Sharing" includes non-sale transfers (e.g., between affiliates or partner businesses) and is prohibited under 10DLC except where necessary to deliver the messaging service you opted into.

8. Data Retention and Deletion

We retain personal data only as long as necessary to fulfill the purposes described in this policy, or as required by law. The following outlines our general retention practices:

Data Type | Retention Period

Account Information | Duration of account + 30 days after deletion

Voice Recordings & Transcripts | As configured by the healthcare practice, or upon request for deletion. Default retention periods apply per service agreement.

Call Summaries & Metadata | Duration of the practice's service agreement + 30 days

Google User Data | Duration necessary to provide services; deleted within 30 days of account deletion or upon request

SMS Consent/Opt-In Data | Duration of opt-in + as required by telecom regulations

Website Analytics Data | As configured in our analytics tools (typically 14-26 months)

You may request deletion of your data at any time by contacting us at contact@speechsage.ai. Upon receiving a valid request, we will delete your personal data within 30 days, except where we are legally required to retain certain information (for example, to comply with HIPAA retention requirements or other applicable laws).

Practice Customers may configure voice recording retention periods through their service dashboard, subject to the terms of their service agreement.

9. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to collect information about your browsing activity. We use these technologies for:

• Essential functionality: Enabling core website features such as authentication and session management
• Analytics: Understanding how visitors use our website to improve performance and user experience (e.g., Google Analytics)
• Security: Detecting and preventing malicious activity

We do not currently use cookies for targeted advertising or interest-based advertising.

Your Cookie Choices

You can control cookies through your browser settings. Most browsers allow you to refuse or delete cookies. Please note that disabling cookies may affect website functionality. You may also opt out of Google Analytics by installing the Google Analytics opt-out browser add-on.

10. Google API Services User Data

Our application uses Google API Services. By using our service with Google sign-in, you acknowledge that we adhere to the Google API Services User Data Policy, including the Limited Use requirements. We access, use, store, and share Google user data only for the purposes described in this policy and as permitted by the user. Our use of Google user data is limited to providing and improving our service and will not be used for advertising or data mining beyond what is necessary to provide the service.

11. Data Security

We implement appropriate technical and organizational security measures to protect personal data, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls limiting data access to authorized personnel on a need-to-know basis
• Regular security assessments and monitoring
• Business Associate Agreements with all service providers that may process PHI
• Incident response procedures for detecting and responding to security events

While we maintain reasonable security safeguards, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your information.

12. Children's Privacy

Our Services and website are intended for individuals 18 years of age and older and are not directed at children under 18. We do not knowingly collect personal data from children under 18. Note that minors may be the subject of calls handled by our AI assistant (for example, a parent calling to schedule an appointment for a child); in such cases, the data is collected from the adult caller and handled in accordance with this policy and applicable HIPAA requirements.

If you believe we have inadvertently collected personal data directly from a child under 18, please contact us at contact@speechsage.ai and we will take prompt steps to delete the information.

13. External Links

Our website and Services may contain links to external sites or third-party services that we do not control, including scheduling tools, EHR platforms, and Practice Customer websites. We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies before providing them with your personal data.

14. Supplemental U.S. State Privacy Disclosures

California Shine the Light: If you are a California resident, you may opt out of sharing your personal data with third parties for their direct marketing purposes by emailing us at contact@speechsage.ai.

California Consumer Privacy Act (CCPA): SpeechSage does not sell personal information as defined under the CCPA. California residents have the right to request access to, deletion of, and information about the categories of personal information we collect. To exercise these rights, contact us at contact@speechsage.ai.

Other States: If you reside in a state with applicable consumer privacy legislation (such as Colorado, Virginia, Connecticut, or others), you may have additional rights regarding your personal data. Please contact us at contact@speechsage.ai to exercise any applicable rights.

15. HIPAA and Protected Health Information

SpeechSage provides AI assistant services to healthcare practices and may process information that qualifies as Protected Health Information (PHI) under HIPAA. Our handling of PHI is governed by:

• Business Associate Agreements (BAAs) between SpeechSage and each Practice Customer
• BAAs between SpeechSage and our third-party AI and infrastructure service providers
• HIPAA's Privacy Rule, Security Rule, and Breach Notification Rule

SpeechSage operates as a Business Associate under HIPAA. We maintain administrative, physical, and technical safeguards as required by the HIPAA Security Rule. We do not use or disclose PHI except as permitted or required by our BAAs and applicable law.

If you are a patient or caller, your rights regarding PHI (including the right to access, amend, and request restrictions on your health information) are governed by HIPAA and your healthcare provider's Notice of Privacy Practices, not this Privacy Policy.

16. Contact Us

If you have any questions about this Privacy Policy, our data practices, or wish to exercise your privacy rights, please contact us:

Email: contact@speechsage.ai

Address: 100 E 6th St, Sioux Falls, SD 57104

SpeechSage, Inc.