Privacy Policy

Clinicians are physical therapists and practice staff who create an account, record visits, and manage patients. Patients are invited into the patient portal by their clinic to follow a home program, log exercises, answer check-ins, and send form-check videos.

When a clinic enters or generates information about a patient, SpeakSOAP processes it on the clinic’s behalf. The clinic decides what goes in, who on its team can see it, and when it is deleted. If you are a patient with a question about your records, your clinic is the right first call; we will help them help you.

Account information. Your name, email address, and password. Passwords are stored as a one-way hash, never as plain text. For clinicians, also your practice’s name and your role in it (admin or member).

Requests for access. If you ask for access on our homepage, we keep what you tell us there (your name, work email, phone, role, clinic, and anything you write) and use it only to contact you about SpeakSOAP.

Clinical content clinicians create. Transcripts of visit recordings, the SOAP notes drafted from them and the edits you make, home exercise programs, suggested billing codes, visit summaries, appointments, and a writing style guide that SpeakSOAP learns from how you edit its drafts.

Patient records the clinic enters. A name, diagnosis, goals, tracked measures such as pain, and optionally an email address so the patient can use the portal. Until a practice accepts SpeakSOAP’s Business Associate Agreement, its clinicians refer to patients by a nickname in the chart and don’t enter contact details; a legal name, date of birth and insurance member ID may still be kept on a patient’s billing details so the practice can issue superbills. A patient’s email is used only for their portal: the invite, sign-in and care emails. A full identity and contact details in the chart (legal names, date of birth, sex, phone, address and emergency contact) are kept once the practice has accepted the Business Associate Agreement, and are covered by it.

Portal activity from patients. Which exercises were done and when, answers to check-in questions, free-text notes, timezone (so a log lands on the right day), and form-check videos you choose to send.

Intake answers. Before a first visit a patient may fill in an intake form for their clinic: their main concern, where it hurts, medications and health history.

Video visits. Audio and video pass live between the clinician and the patient and are not recorded. Messages typed in the visit’s chat are kept. When both people turn transcription on, the visit is transcribed as it happens and the transcript becomes part of the clinician’s note; the patient’s browser holds transcript lines waiting to send for no more than twenty-four hours. The patient may also be asked where they are joining from, so the clinician can check they are licensed there.

Bookings and payments. Visits a patient books online, when their clinic offers it. When a clinic takes patient payments through SpeakSOAP: the patient’s name and email, the visits being paid for and their amounts, and a card the patient chooses to save. Card numbers are entered into and held by Stripe, never SpeakSOAP.

Media. Exercise demonstration videos and photos uploaded by clinicians, and form-check videos uploaded by patients.

Voice recordings. Clips recorded during a visit are sent to our transcription provider and are not retained as clinical records on our servers. The Amazon Transcribe path temporarily places encrypted input and output in private Amazon storage, deletes both after the request, and has a one-day automatic expiration as a backstop. A retry copy may stay in the clinician’s browser until transcription succeeds and is then removed. Browser recovery records expire after twenty-four hours and are also removed when the note is signed, the session is discarded, the user signs out, or the user clears recovery data on that device.

Usage and technical data. Counts of AI notes, transcription seconds, model tokens, and storage used, which we meter to apply plan limits and understand our costs; ordinary server logs such as IP address, browser type, and timestamps; and anything you send through the in-app feedback widget, including optional screenshots and screen recordings, and anything you dictate into it (the recording is turned into text by our transcription service and not kept). Screenshots and recordings are taken by SpeakSOAP of its own page only, never your screen or other windows, and patient information is always blurred in them. Feedback is stored with the rest of SpeakSOAP on Amazon Web Services, read only by our team, and deleted after ninety days; backup copies of screenshots and recordings are removed within a further 35 days.

To run the service: turn speech into notes, programs, and code suggestions; deliver programs and reminders to patients; keep the clinician’s writing style; show progress between visits.

To apply plan limits, keep accounts secure, respond to support requests, and fix problems.

To support each clinic’s account. Our team can see counts of how a clinic uses SpeakSOAP, such as its patients, notes, visits and patient portal activity, by clinician. These counts never name or list a patient, and each time our team looks at them is logged.

To improve SpeakSOAP using aggregate usage patterns. We do not use patient content for advertising, and we do not sell personal information.

To notify our own team. A new signup, a request for access, an upgrade request, a marketplace publication, or a piece of feedback posts a message to a private channel our team reads. A signup message includes the clinician’s name and email. A request for access message includes the name, work email, role and the clinic’s answers, never the phone number or what was written. A marketplace message includes the collection’s exercise names. A feedback message says only that feedback arrived: never what it says, the page it came from, or any screenshot or recording. No patient information is ever posted to that channel.

Transcription. Voice clips are transcribed by Amazon Transcribe. The audio and the resulting text are processed for that purpose.

Drafting. SOAP notes, exercise and program suggestions, code suggestions, a check of each drafted note, pre-visit summaries and the clinician’s in-app assistant are drafted by the GPT-5.6 Luna model, run on Microsoft’s Azure OpenAI Service or on Amazon Bedrock depending on the clinic’s controlled rollout setting. We do not send patient information to Anthropic’s or OpenAI’s own services. The model receives the visit transcript, the patient’s short name (a nickname, or a first name and last initial), diagnosis, goals, recent history including what the patient logged and wrote in check-ins, and the clinician’s style guide. Every draft waits for the clinician to review and sign; nothing is filed automatically.

Marketplace checks. When a clinician publishes an exercise collection, the selected drafting model reads the exercise names and descriptions to flag anything that does not look like a plausible therapeutic exercise.

We use these providers through their business APIs, whose terms state that customer data submitted through the API is not used to train their models. SpeakSOAP never uses patient information to train, fine-tune or otherwise improve AI models, whether its own or a provider’s.

SpeakSOAP runs on Amazon Web Services in the United States. The database and media storage are encrypted at rest, and all traffic to and from SpeakSOAP is encrypted in transit.

Our service providers, and what each one handles:

• Amazon Web Services: hosting, database, video and photo storage, sign-in, voice transcription, video transcoding, video visits, and AI drafting through Amazon Bedrock.
• Microsoft Azure: AI drafting of notes, programs, codes, and summaries through the Azure OpenAI Service.
• Google Workspace: email delivery.
• Stripe: payments, only for practices that take patient payments through SpeakSOAP, through the practice’s own Stripe account. Stripe holds the patient’s name, email, invoices and any saved card, and emails invoices to the patient.
• Discord: the private channel where our team is told about signups, requests for access, upgrade requests, and marketplace publications, and that new feedback arrived. It never receives patient information or feedback content.

We do not use third-party analytics or advertising trackers on SpeakSOAP.

Optional Google Calendar connection. A therapist can connect their Google account to keep appointments in sync. We use their Google account identity and email to identify the connection, list calendars so they can choose which to connect, and read and update events in the selected visits calendar. Other selected calendars supply busy times only. The visits calendar can import event titles, times and, when the practice has enabled full records, descriptions, locations, attendees and Google Calendar or Meet links. We store connection credentials encrypted and retain linked event details as appointment records. Automatic patient linking is on by default and can be turned off: an attendee email must match one active patient in the same practice. You can explicitly remember a patient choice for matching calendar names or repeating series and forget saved choices in connection settings. Ambiguous matches require review. Matching does not create patient contacts or invitations.

By default, SpeakSOAP creates private Google events titled “Appointment” with their times. A therapist with full records enabled can explicitly choose Appointment details for a clinic-approved calendar. That shares the patient’s calendar name, visit type, optional appointment title, appointment notes and location with Google and people permitted to view those event details. Changes to these fields sync both ways. SOAP notes, diagnoses, contact details and invitations are not exported. Disabling detail sharing stops future detail updates; it does not erase what was already shared.

You can disconnect in Calendar → Google Calendar or revoke SpeakSOAP in your Google Account connections. Disconnecting removes stored credentials and the busy-time cache and stops sync; existing appointments, imported details and Google events remain. Our usual record retention and deletion rules apply to imported appointment records. Google Calendar data is used to provide these scheduling features, never for advertising, sale or training general-purpose AI models. SpeakSOAP’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

YouTube videos. A clinic can link an exercise to a YouTube video. No preview picture is loaded, so showing it never contacts YouTube. Pressing Play loads YouTube’s embedded player (YouTube API Services), which sends YouTube the viewer’s IP address, the kind of device and browser they use, the video, and that it is played on SpeakSOAP. YouTube handles that under the Google Privacy Policy. In the patient portal of a practice that has accepted SpeakSOAP’s Business Associate Agreement, the player loads only after you sign a separate permission, which you can withdraw at any time in your portal’s Settings. Without it, the video opens on YouTube itself, and nothing from SpeakSOAP goes with it.

• speaksoap-session: keeps you signed in. HTTP-only, expires after the configured session period (never more than seven days) or when you sign out.
• speaksoap-activity: for clinicians, records when the device was last used, so a device left idle is signed out after an hour.
• speaksoap-trusted-device: for clinicians, marks a browser where you entered your emailed sign-in code, so the code isn’t asked for again on it for seven days. speaksoap-sign-in-code holds a sign-in in progress for a few minutes while you enter the code.
• tz: the patient portal records your timezone so exercise logs and check-ins land on the correct local day.
• Browser storage: your light or dark theme choice, your motion preference; for clinicians, owner-scoped session recovery data kept for no more than twenty-four hours (signing, discarding, signing out, or using the device-clear action removes it sooner); for patients, a video visit’s transcript lines waiting to send, for no more than twenty-four hours.
• speaksoap-remembered-account: only when you tick Remember me on this device as you sign in (it is off unless you turn it on), this device keeps the email, first name, account type and whether the account has a passkey, so the sign-in page can greet you and ask only for your password or passkey. The sign-in page shows the email masked. Nothing else is kept, and signing out does not remove it.Not you? on the sign-in page removes it, and so does signing in with the box unticked.

There are no advertising cookies and no cross-site tracking.

Within a practice. Every member of a practice can see all of that practice’s patients. Admins can additionally invite and remove therapists.

Patients. A patient sees their own program, reminders and what they have logged, notes their clinician writes for them (such as an evaluation summary or a discharge note), and their invoices and superbills. They do not see the clinician’s own clinical notes or a video visit’s transcript; they can ask their clinic for a copy of their records.

The exercise marketplace. If a clinician publishes an exercise collection, its exercise names, descriptions, and demonstration videos or photos become viewable by other SpeakSOAP practices that adopt it. Publishing is a deliberate action with its own confirmation. Patient videos are never part of the marketplace.

Service providers listed above, only to do the job described. Legal requirements, if we are required by law to disclose information, in which case we will tell the affected clinic where we are permitted to.

Account and clinical records may be retained as required by applicable law, clinic policy, contracts, legal holds, and legitimate security or operational obligations. Each clinic owns its retention schedule. Discharging a patient closes the chart but does not erase the clinical record. Verified export or deletion requests are handled with the clinic through a controlled process, and some records may need to be retained despite a request.

Patient form-check videos are kept for the number of days set by the clinic’s plan (ninety days on the free plan) unless the clinician pins one to keep it. Unpinned videos past that date are deleted automatically.

Clinician demonstration videos and photos stay until the clinician deletes them. If other practices adopted a published video, their copies keep working after the original is deleted.

Voice audio is not retained as a clinical record on our servers. Amazon Transcribe working objects are deleted after each request and have a one-day expiration backstop. Browser retry copies expire within twenty-four hours and are normally removed sooner after successful transcription.

When a practice leaves. Thirty days after a practice closes its account, or after its Business Associate Agreement with SpeakSOAP ends, we delete its records, except those the law requires us to keep, such as security audit logs, which stay protected for as long as we keep them.

Backups of the database and earlier versions of stored files are kept for a limited window, no more than ninety days, and then removed. Deleted data can persist in a backup during that window.

Security audit logs record who opened or changed which record, by account and record identifiers, not clinical text. They are kept for seven years in storage that cannot be altered or deleted.

Clinicians can edit records and discharge patients from within SpeakSOAP and remove eligible media. A practice admin can download all of the practice’s records at any time with Export records on the Privacy & security page under Practice, and can ask us at hello@speaksoap.com for a deletion review. A deletion request does not override a legal, contractual, security, backup, or clinic-record retention obligation.

Patients can stop reminder emails with the one-click link at the bottom of every reminder, or from settings in the portal. Your clinic can send you a copy of your records, to your portal’s Your records page or as an emailed link that asks for your date of birth. To correct or delete your records, to ask who they were shared with, or to close your portal access, contact your clinic. If you cannot reach them, write to us and we will help.

Encryption in transit and at rest, hashed passwords, and access scoped to each practice. Clinicians confirm a new device with a code sent to their email or with a passkey, and repeated wrong passwords lock password sign-in for a while. Access to records is logged. Invitation links for both clinicians and patients expire after seventy-two hours. Feedback captures always blur patient information. No system is perfectly secure; if you believe you have found a vulnerability or an exposure, email hello@speaksoap.com and we will respond quickly.

Clinicians are responsible for using SpeakSOAP in a way that meets their own obligations, including any consent needed to record a visit and have it transcribed and drafted by AI. SpeakSOAP’s Business Associate Agreement is accepted for a practice by one of its admins, when signing up or later on the Privacy & security page under Practice. Until a practice accepts it, its clinicians refer to patients by a nickname in the chart and don’t enter contact details. A patient’s email is used only for their portal: the invite, sign-in and care emails.

Patient portal accounts are created by clinics, not by patients themselves. A minor’s portal account is set up and used under the supervision of a parent or guardian, at the clinic’s discretion. We do not knowingly collect information directly from children.

When this policy changes in a way that matters, we will update the date at the top and, for material changes, tell clinicians by email before the change takes effect.

SpeakSOAP is operated by SpeakSOAP LLC, in Austin, Texas. Write to hello@speaksoap.com for anything in this policy.