Freed Privacy & Security
Clinician and patient trust is of the highest priority at Freed. We hold ourselves accountable to a HIPAA-compliant data storage and processing protocol for all data captured and shared through our platform.
Internal Personnel Security
All Freed employees are required to:
Undergo background checks before being hired
Complete annual security awareness training on HIPAA, privacy, and information classification
Compliance
Freed conducts regular risk assessments to ensure policies remain up-to-date and relevant
Our CTO is responsible for Privacy and Security
Secure Development Lifecycle
All software changes are reviewed for compliance
Freed practices infrastructure-as-code. All infrastructure changes are reviewed before deployment
All engineers complete secure development practices training
Cloud Hosting and Availability
All hosting services and data is stored and processed within Microsoft’s Azure secure data centers
Freed has a HIPAA-compliant Business Associate Agreement with Microsoft
Freed leverages Azure’s high-availability infrastructure to ensure the data is always accessible
Confidentiality and Data Encryption
All data is encrypted at-rest and in-transit using standard encryption schemes
Vendor Management
All Vendors who may process patient information are required to be HIPAA compliant and sign BAAs with Freed
Freed regularly reviews vendor security practices to ensure continued high standards
Artificial Intelligence
All AI models are HIPAA-compliant and don’t retain data
Protected health information is never used for AI training purposes- Feedback entered directly into the Freed Scribe product does not train the AI. Instead, this feedback is reviewed by the Freed Scribe team and shared with the product group to guide improvements.
Freed Scribe does not use identifiable patient data, including audio, transcripts, and notes, for training, fine-tuning, or improving its AI models or any third-party models.
Only de-identified, aggregated data may be used for product and model improvement. This data is de-identified under HIPAA Safe Harbor standards (45 C.F.R. §164.514), with all 18 identifiers removed and replaced with generic values.
Freed Scribe works with subprocessors such as Microsoft Azure, OpenAI, Anthropic, Baseten, and Fireworks, all of which operate under Business Associate Agreements (BAAs) that enforce zero-data-retention and no-training requirements. Google Cloud and AWS are used exclusively for de-identified data. Additionally, audio transcription is performed using Freed Scribe's in-house Automatic Speech Recognition (ASR) model.
Since identifiable patient data is not used for AI training, there is no need for an account-level opt-out mechanism. Protections are enforced contractually through BAAs and de-identification standards, ensuring robust privacy safeguards without requiring user intervention.
Patient Information
Patient information is encrypted at-rest and in-transit
Patient recordings are temporarily saved in a secure and HIPAA-compliant manner until note summaries and quality checks are complete, and then they are automatically deleted (see Audio Recording Retention below)
Patient notes can be manually deleted at any time or set to automatically delete after 30 days
Audio Recording Retention
In most cases, audio recordings are deleted after they have been processed, with a few important details to keep in mind:
Standard recordings: Once processed, audio recordings are soft deleted, meaning they are no longer accessible through Freed under normal circumstances. They remain recoverable by our Engineering team for up to 48 hours for troubleshooting purposes, after which they are permanently deleted.
Recordings retained for troubleshooting: In certain cases, recordings may be temporarily retained to investigate audio or transcription issues. These recordings are kept for a maximum of 14 days before being permanently deleted.
The 14-day retention period is a fixed system setting and cannot be adjusted for individual visits, users, or organizations.
If your patient consent language references how long recordings are kept, we recommend accounting for the maximum possible retention period of 14 days, even though the vast majority of recordings are permanently deleted within 48 hours of processing.