Privacy Policy

Introduction

Problem Solver Software LLC ("we," "us," or "our") operates ParrotPadMD, a HIPAA-compliant voice-to-text service. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.

Information We Collect

Account Information

When you create an account, we collect:

• Email address
• Name (if provided via social login)
• Authentication provider information

Usage Information

We collect aggregate usage data including:

• Number of minutes transcribed per month
• Features used
• The website domain (for example, your EHR's web address) where the browser extension's dictation was used, so we can prioritize compatibility. We record the domain only — never the page address, title, or content — and it is stored without any account identifier.
• Whether a dictation session came from the browser extension or the Scratchpad (in a browser tab or installed as an app), and whether the device is a phone, a tablet, or a computer. These are counted as totals, with no account identifier and no text.
• Error logs (without PHI)

Audio and Transcription Data

Dictation into your EHR: we do NOT store your dictation audio or the text you dictate at the cursor. Audio is processed in memory and immediately discarded. The text is sent directly to your application and never stored on our servers.

Scratchpad notes: notes you write or dictate in the Scratchpad are saved encrypted in your account as they change, so you can open them on another device. They stay until you delete them, or until the retention period you choose ends.

Encounters (visit recordings): the recording is held only until transcription completes and is then deleted. The transcript and any clinical notes you generate are stored encrypted in your account so you can review, copy and delete them. They are removed when you delete them or your account, and copies remain in our provider's database backups for up to seven days after that.

Assistant voice questions and the website demo: audio you speak to the help assistant or in the 60-second dictation demo goes through the same pipeline as dictation — processed in memory, never stored. The demo transcript appears only in your browser and is never sent anywhere else; we count only session totals (number and length), with no audio, text, or account attached.

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card number. We receive only:

• Last 4 digits of your card
• Card brand and expiration
• Billing address

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and send related information
• Send technical notices and support messages
• Respond to your comments and questions
• Monitor and analyze usage patterns
• Detect, investigate, and prevent fraudulent transactions

Chrome Extension Data Practices

The ParrotPadMD Chrome extension requires certain permissions to function. Here's exactly what we access and why:

Data We Access

• Microphone Audio: Captured only when you click the dictation or record button. Dictation audio is streamed directly to our speech-to-text providers — AssemblyAI and Google Cloud Speech-to-Text, each under a Business Associate Agreement — for transcription and is never stored. Encounter recordings are uploaded for transcription and deleted as soon as it completes.
• Active Tab: We detect the focused text field to insert your dictated text. We do not read or collect any page content.
• Clipboard: Used when the extension cannot type into a page directly. In some editors it places your dictation or note on your computer's clipboard and pastes it for you. When it cannot confirm that the text arrived, it leaves the text on the clipboard and a notice tells you to paste it. Either way the text stays on the clipboard afterward, and we cannot clear it. If your Mac shares its clipboard with your other Apple devices (Universal Clipboard), the text can reach them too. We only put your own transcribed text there. We never collect or send anything from your clipboard.

Data We Store Locally

• Your authentication token (to keep you signed in)
• User preferences and settings
• Custom text macros you create

Data We Do NOT Collect

• Browsing history or web activity
• Page content, or text you type into other websites and applications
• Personal files or documents
• Dictation audio (processed in real time, never stored) or text dictated at your cursor (sent directly to your application, never stored)
• Encounter recordings beyond transcription (deleted once the transcript exists, with no recoverable copy kept). Encounter transcripts, generated notes and Scratchpad notes are stored only in your account, encrypted, until you delete them

Third-Party Services

The extension communicates only with:

• Google Cloud Speech-to-Text: For audio transcription (covered under Google Cloud's BAA)
• AssemblyAI: For audio transcription, both live dictation and visit recordings (covered under AssemblyAI's BAA, processed on US servers, never used to train models). A visit recording is fetched by AssemblyAI from our storage, and the transcript it produces is deleted from our AssemblyAI account as soon as we have it. Their own retention settings are the fallback if that delete does not land, and we have asked them in writing to confirm those settings
• Google Cloud (Firestore, Cloud Run, Cloud Functions): For backend processing, account settings, and usage records (covered under Google Cloud's BAA)
• Vertex AI (Google Cloud): For AI note features — processed statelessly within our Google Cloud environment and never used to train models
• Google Cloud Identity Platform (Firebase Authentication): For secure sign-in — handles your account credentials only, never patient information (covered under Google Cloud's BAA)
• Stripe: For subscription management (PCI-DSS compliant; no PHI)

HIPAA Compliance

ParrotPadMD is designed for HIPAA compliance. We:

• Offer a Business Associate Agreement (BAA) to all users
• Never store dictation audio or transcripts — text goes straight to your cursor. Encounter recordings are deleted after processing; encounter transcripts and notes you choose to save are stored encrypted in your account
• Never use PHI for AI model training
• Process all audio through HIPAA-compliant infrastructure
• Maintain encryption for all data in transit

Data Sharing

We do not sell your personal information. We may share information with:

• Service Providers: AssemblyAI and Google Cloud (speech processing), Stripe (payments)
• Legal Requirements: When required by law or to protect rights
• Business Transfers: In connection with any merger or acquisition

Data Security

We implement appropriate technical and organizational measures to protect your data:

• TLS encryption for all data in transit
• SOC 2 Type II compliant infrastructure
• Regular security assessments
• Access controls and audit logging

Your Rights

You have the right to:

• Access your personal information
• Correct inaccurate data
• Delete your account and associated data
• Export your data
• Opt out of marketing communications

Data Retention

We retain account information for as long as your account is active. You can delete your account and everything in it yourself, from the Security section of your account page, or ask us to.

Records are kept for different periods, and here is each one. Visit transcripts, clinical notes and Scratchpad notes are kept until you delete them or your account is closed, unless you choose on your account page to have them deleted automatically once 30 or 90 days have passed since they were created (for Scratchpad notes, since they were last changed). Deletion completes within about two days after that point. Usage records, which hold a duration and no content, are kept for as long as the account, because they are the billing history. Access logs, which record who read which record and when, are kept for six years, because HIPAA requires a business associate to keep them that long. Deleting a record removes it from your account at once, and copies of it remain in our provider's database backups for up to seven days before they age out on their own.

Children's Privacy

Our service is not intended for users under 18 years of age. We do not knowingly collect information from children.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last Updated" date.

Contact Us

If you have questions about this Privacy Policy, please contact us: