Privacy Policy

We treat data in two entirely separate categories:

Account Data:

Information belonging to you (the clinician, administrator, or healthcare clinic) used to set up, bill, and manage your Oye Scribe account.

Patient Data / Protected Health Information (PHI):

The audio, transcripts, and clinical summaries generated during patient visits. We do not own, sell, or exploit this data. Our relationship to this data is governed strictly by HIPAA, state medical privacy laws, and the Business Associate Agreement (BAA) or Data Processing Addendum (DPA) we execute with your practice.

Oye Scribe is engineered as an offline-first application to maximize patient privacy and data localization.

Local Processing:

Audio recording, storage, transcription, clinical entity extraction, and de-identification occur locally on your authorized iOS device. Raw audio and identifiable patient information (PHI) are not streamed to, or stored on, our servers.

Data Minimization:

Because processing happens on the device, we do not receive or retain patient audio recordings on our servers. Raw audio remains encrypted on your device and is purged according to your configured on-device retention settings. The only data that leaves the device is content you review and choose to share — for example, de-identified text delivered to your EHR.

Because Oye Scribe is an offline-first application operating on mobile hardware (such as iOS devices), a critical portion of data security rests entirely on you, the healthcare provider.

Provider Safeguards:

As a Covered Entity under HIPAA, you are solely responsible for ensuring the physical and digital security of any device running Oye Scribe. This includes enforcing strong device passcodes, enabling biometric authentication (Face ID/Touch ID), and utilizing Mobile Device Management (MDM) or remote-wipe capabilities where appropriate.

Lost or Stolen Devices:

ARCA VISION LABS LLC is not responsible or liable for any data loss, data breaches, unauthorized access, or HIPAA violations resulting from lost, stolen, unlocked, compromised, or unencrypted user hardware. If you lose a device containing local clinical data, it is your responsibility to execute your clinic's internal security incident response and breach notification protocols.

In compliance with Texas Health and Safety Code Section 181.154, we provide notice that Protected Health Information (PHI) processed by Oye Scribe is subject to electronic disclosure to your clinic's Electronic Health Record (EHR) system or authorized device.

No Unauthorized Disclosures:

Neither Texas law nor federal law allows us to electronically disclose a patient's PHI to any outside person or commercial entity without separate, explicit authorization from the patient.

No Sale of Data:

ARCA VISION LABS LLC does not sell, license, or lease patient health data to third parties under any circumstances.

ARCA VISION LABS LLC operates as a Business Associate under HIPAA regulations. We maintain technical, administrative, and physical safeguards designed to protect PHI within our software infrastructure. However, our compliance framework assumes that you, the Covered Entity, configure the software appropriately, maintain secure local hardware environments, and execute a standard Business Associate Agreement (BAA) with us prior to utilizing Oye Scribe with actual patient encounters.

If you operate in California or serve California residents, special state rules apply:

Patient Data & The CMIA Exemption

Patient Data and Protected Health Information (PHI) processed by Oye Scribe are regulated under HIPAA and the California Confidentiality of Medical Information Act (CMIA). Consequently, this patient data is exempt from the California Consumer Privacy Act (CCPA/CPRA) framework.

Clinic Account Data Under the CCPA/CPRA

For the personal data we collect to manage your clinic's business account (e.g., administrator emails, billing names), ARCA VISION LABS LLC acts as a "Business" under the CCPA/CPRA.

Your Rights:

California account holders have the right to Know, Access, Correct, and Delete their business account information.

No Selling or Sharing:

We do not "sell" your account information, nor do we "share" it for cross-context behavioral advertising.

For more detail, see our California Notice at Collection at https://oye.is/privacy/california

If you process clinical data within the European Economic Area (EEA) or the United Kingdom:

The Clinic is the Data Controller:

Your healthcare clinic controls the collection of patient data and establishes the lawful basis for processing.

Oye Scribe is the Data Processor:

We act strictly as a data processor on your behalf, handling patient data solely based on your written instructions and our Data Processing Addendum (DPA).

Data Subject Rights:

Because Oye Scribe does not directly manage or control patient identity indexes, patients looking to exercise their GDPR rights (access, erasure, rectification) must contact their healthcare provider directly.

Our full Data Processing Addendum is available at https://oye.is/dpa

To provide and maintain the Oye Scribe service, we collect limited personal data from medical providers, including:

Identity & Contact Data:

Name, clinical affiliation, email address, and professional credentials.

Billing & Transaction Data:

Payment details processed securely via our third-party payment processor (we do not store raw credit card numbers).

Technical & Usage Data:

Log files, device types, iOS operating system versions, and application performance metrics to troubleshoot bugs and improve app stability.

For any Patient Data or PHI interacting with our software environment, ARCA VISION LABS LLC enforces strict data protection mechanisms:

Encryption:

All data is encrypted at rest on the device (leveraging iOS hardware encryption standards). Raw audio and PHI are not transmitted off the device; any data that does leave the device — such as de-identified text you choose to share, diagnosis-code requests, or account data — is encrypted in transit using TLS 1.3.

No Unauthorized Training:

We do not use your patients' private clinical audio, transcripts, or notes to train public, foundational artificial intelligence models.

Workforce Compliance:

All ARCA VISION LABS LLC personnel and engineering contractors undergo mandatory background checks and healthcare privacy training within their first 60 days of onboarding.

Oye Scribe relies on machine-learning models that run locally on your device to do its work. These models process your audio and text on-device; they do not send your audio or patient data to third parties.

WhisperKit:

On-device speech-to-text, used to transcribe the recorded encounter.

OpenMed models:

On-device models, used for clinical entity extraction and de-identification.

Optional diagnosis-code assistance

If you choose to enable it, Oye Scribe can generate suggested diagnosis codes. This feature is off unless you turn it on. When you use it, only de-identified text — never raw audio or identifiable patient information (PHI) — is sent to a third-party frontier AI model to produce the codes.

The de-identified text may be sent to one of several third-party frontier model providers, which may include, but are not limited to:

• Anthropic (Claude)
• OpenAI

[PLACEHOLDER] Each listed provider handles and retains the de-identified text it receives under its own terms (for example, whether the text may be used to train models, and how long it is retained). Confirm and disclose each provider's data-handling terms with counsel.

If you have any questions about this Privacy Policy, wish to report a security issue, or need to execute a Business Associate Agreement (BAA) / Data Processing Addendum (DPA), please contact us:

Corporate Entity:

ARCA VISION LABS LLC, Austin, Texas 78748

Privacy Requests & Compliance:

privacy@oye.is

General Support:

support@oye.is

Online Support Portal:

https://oye.is/support