An AI medical scribe collects only the information needed to generate clinical documentation, such as conversation transcripts, dictated notes and related visit context so it can produce structured summaries. It may also handle associated metadata (timestamps, speaker roles) that help with accuracy and workflow integration.

All protected health information (PHI) processed for clinical use is handled under HIPAA-compliant security (including encryption, access controls, audit logging) and business agreements like BAAs.

Sully.ai also follows broader security standards such as SOC 2 Type II and ISO 27001 to protect data. Data is not used for general AI model training unless explicitly permitted.