1. Security Program
Scanbo AI maintains administrative, technical, and organizational safeguards designed to protect information handled through Ambient, RxShield, Relay, and related services. Controls and availability vary by product, region, and customer agreement.
2. Data Architecture
Ambient is designed as a documentation-assist tool. Ambient audio is processed in-session and raw audio is not retained beyond the authenticated session. RxShield drug queries are processed in-session and are designed not to retain PHI. These are product-specific controls and should not be assumed for every Scanbo AI service.
3. Encryption and Access
Scanbo AI uses TLS 1.3 in transit and encryption at rest where applicable. Access is limited by role and business need. Product configurations may support MFA, SAML 2.0 SSO, session controls, and region-appropriate processing.
4. Product Safeguards
Ambient supports no-audio-retention workflows and clinician note version history. RxShield supports source attribution, immutable Decision IDs, and audit trails. Relay transports and standardizes device and wearable data; it does not make clinical decisions.
5. Audit and Monitoring
We monitor services and infrastructure for security events and maintain processes for investigation, containment, and response. Product audit records may include timestamps, authorized user identifiers, note versions, Decision IDs, or integration events as applicable.
6. Testing and Disclosure
Scanbo AI products may undergo security reviews and third-party penetration testing. Critical vulnerabilities are prioritized for remediation. Report suspected vulnerabilities to [email protected] and do not include patient information in a report.
7. Enterprise and HIPAA BAA
For health systems and hospital procurement, enterprise agreements may include HIPAA Business Associate Agreements, custom service levels, dedicated infrastructure, and audit-log exports where applicable. Contact [email protected].
8. Customer Responsibilities
Customers are responsible for configuring accounts appropriately, protecting credentials, obtaining required patient notice and consent, limiting access to authorized users, and following applicable healthcare and privacy requirements.
9. Contact Us
For security, compliance, or product-specific control questions, contact [email protected]. For general inquiries, contact [email protected].