Privacy Policy
Effective Date: February 2026
Introduction
We take the privacy and security of your health information seriously. This policy explains how we collect, use, and protect your data.
BCS Ventures, LLC operates Soaply (soaply.app), a healthcare documentation platform that processes protected health information (PHI) on behalf of healthcare providers. Soaply acts as a Business Associate under the Health Insurance Portability and Accountability Act (HIPAA) and maintains Business Associate Agreements (BAAs) with its infrastructure and service providers. We are committed to following HIPAA best practices and continuously strengthening our compliance posture.
Information We Collect
We collect only the information needed to provide our clinical documentation service.
We collect the following types of information to provide and improve our service:
- Account information (name, email address)
- Audio recordings uploaded for transcription
- Generated SOAP notes and clinical documentation
- Patient information including names, visit types, and progress data
- Usage data and analytics
- Payment and billing information
How We Use Your Information
Your data is used solely to provide the documentation service you signed up for. We never sell your data or use it for marketing to third parties.
We use the information we collect to:
- Provide AI-powered transcription and SOAP note generation
- Process and store your clinical documentation
- Maintain patient records and visit history
- Improve our services and user experience
- Communicate with you about your account
- Process payments and manage subscriptions
We do not use your clinical data for marketing, advertising, or any purpose other than providing and improving the Soaply service. Your data is never sold to third parties.
Data Processing and AI
Your audio is processed by AI services that do not use your data for training.
Audio recordings are processed using third-party AI speech-to-text and text generation services for transcription and SOAP note generation. These services process data under data processing agreements with zero-training commitments. Your clinical data is never used to train, fine-tune, or improve any AI models. Data is processed solely for the purpose of generating your clinical documentation.
Data Storage and Security
Your data is encrypted and stored on secure, compliant infrastructure.
Patient data is stored on Amazon Web Services (AWS) infrastructure in US-based data centers. We implement the following security measures:
- Encryption in transit using TLS 1.2 or higher
- Encryption at rest using AES-256
- Row-level security ensuring complete data isolation between users
- Industry-standard authentication with secure session management
- Time-limited signed URLs for file access
Access to data is restricted to your account only. No other user can view or access your clinical documentation, patient records, or audio files.
HIPAA Compliance
We follow HIPAA best practices and maintain agreements with our service providers to protect your health information.
Soaply operates as a Business Associate under HIPAA. We maintain Business Associate Agreements (BAAs) with our infrastructure and service providers to ensure appropriate handling of protected health information. We implement administrative, physical, and technical safeguards appropriate to the sensitivity of the health information we process, including:
- Encryption of all data in transit and at rest
- Access controls and user authentication
- Data isolation between user accounts
- Secure data processing agreements with third-party services
We are committed to continuously strengthening our compliance posture and working toward the highest standards of health information protection.
Data Retention
Your clinical documentation is retained as long as your account is active. You can request deletion at any time.
Account data is retained for the duration of your account. Clinical documentation including SOAP notes and patient records is retained as long as your account is active. Audio file retention policies may be configured through your account settings. You may request deletion of your data at any time by contacting us.
Your Rights
You have full control over your data. You can access, export, or delete it at any time.
You have the right to:
- Access, correct, or delete your personal data
- Export your clinical documentation
- Opt out of non-essential communications
- Close your account and request data deletion
Third-Party Services
We use trusted service providers to deliver our platform. Each provider operates under agreements to protect your data.
We use third-party services for cloud infrastructure, authentication, AI processing, and payment handling. We maintain data processing agreements and, where applicable, Business Associate Agreements with each service provider. Each provider has its own privacy policy governing how they handle data. We select providers that meet our security and compliance requirements.
Changes to This Policy
We will notify you of any material changes to this policy.
We may update this policy from time to time. We will notify you of material changes via email or in-app notification.
Contact Us
Questions about this policy? Contact us at privacy@soaply.app.
BCS Ventures, LLC