Privacy Policy

SyncEdge Solution (the "Company") is the data controller under Thailand's Personal Data Protection Act B.E. 2562 ("PDPA") for its users' account, payment and usage data and consent records in the SyncEdge Scripta service. For the content you record or upload (audio, transcripts and notes, including patients' health data), the clinician, clinic or organisation using the Service is the data controller, and the Company processes that content on its behalf as a data processor (Section 40 of the PDPA). Organisations can request a data processing agreement (DPA) from support@syncedge.tech.

• (a) Account data: email, display name, one-way hashed password, and Google/LINE account identifiers.
• (b) Content: uploaded audio files and transcripts, which may contain the voices and personal data of the individuals recorded.
• (c) Payment data: top-up history, and the last 4 digits and brand of your card (the Company does not store full card numbers — these are processed by Stripe).
• (d) Usage data: IP address, browser type, and system logs.
• (e) Consent records.

To provide the Service under our contract (contractual-performance basis); to maintain security and prevent fraud (legitimate-interest basis); and to meet tax and accounting obligations (legal-obligation basis). We do not use your content for advertising.

When you record or upload a patient visit, the recording, transcript and AI notes contain health data, which is sensitive personal data under Section 26 of the PDPA. For this data the clinician or clinic using the Service is the data controller and the Company is its data processor. The clinician must obtain the patient's explicit consent before recording, including to sending the data to service providers in the United States, and confirms it in the app for every visit; the app records who confirmed it, when, and which version of the consent wording was shown. Visit recordings cannot be shared by public link, and you can delete a recording with its transcript and notes at any time. If you link visits to a patient, Scripta stores the label you type inside your workspace to group that patient's visits. Deleting the patient deletes all of their visits. A workspace in HN-only mode accepts only a hospital number (HN) or similar reference as that label, never a name. Using an HN instead of a name reduces identification, but an HN is still personal data. In HN-only mode, AI notes are instructed to leave out the patient's name, national ID number, phone number and address, national ID and phone numbers transcribed as digits are removed from the transcript before it is stored, speakers can be named by role only, and the uploaded file's name is replaced. Names spoken during a visit remain in its audio and transcript.

Audio files are sent for transcription to a speech-to-text service provider (United States), and transcripts used for AI notes are sent to Anthropic, PBC (United States). Both are the Company's sub-processors. Data-protection standards in the United States may differ from those in Thailand. For a patient visit or an interview, the consent of the person recorded to this transfer (Section 28 of the PDPA) is collected in the app for every recording: the clinician or interviewer confirms that the person agreed after being told the data goes to the United States and that they may refuse (for a patient, without any effect on their care). For your own account data, you consent to the transfer when you sign up. Sub-processors: the speech-to-text service provider (transcription; United States); Anthropic, PBC (AI notes; United States); Stripe, Inc. (payments; United States); Resend (system email; United States); Cloudflare, Inc. (network and attack protection; United States; TLS connections end at Cloudflare's network, so data in transit, including recordings and transcripts, passes through it); and servers operated by SyncEdge.

• Audio files, transcripts and notes: for the life of your account or until you delete them, or as the workspace's retention settings allow (a workspace can have visit audio, transcripts and notes deleted automatically); when an account or workspace is deleted, data is held for 30 days and then permanently deleted or de-identified. A workspace owner can export its transcripts, notes and recording details (and, optionally, the audio) at any time.
• Payment documents and history: 5 years, as required by the Revenue Code.
• System logs: Scripta's system logs are kept for 60 days and then deleted. They record technical events — requests with the visitor's IP address and browser, errors, and sign-in attempts with the email address used. They never contain recordings, transcripts or notes.
• Consent records: account terms acceptances are retained as evidence for as long as legally necessary; per-recording consent records (who confirmed, when, and which wording, with no patient data or content) are kept for 5 years from the recording, also after the recording is deleted.

Note: content you upload into another party's workspace is under the control of that workspace's owner.

You have the right to access, obtain a copy of, rectify, erase, and restrict your data, to object to its processing, to request data portability, and to withdraw consent. You can delete your account yourself from the Settings page, or contact support@syncedge.tech (answered within 30 days). You also have the right to lodge a complaint with the Personal Data Protection Committee (PDPC).

Encrypted TLS connections, passwords stored as hashes (bcrypt), role-based access controls, and hashed storage of tokens.

If the Company becomes aware of a personal data breach affecting data it processes on a data controller's behalf, it notifies that controller without undue delay and within 48 hours of becoming aware of it, with the information available at the time. The controller (for example the clinic or hospital) notifies the Office of the Personal Data Protection Committee within 72 hours of becoming aware of the breach, as Section 37(4) of the PDPA requires, unless the breach is unlikely to result in a risk to people's rights and freedoms. For data the Company controls itself, such as account data, the Company notifies the Office on the same terms.

We use only the cookies necessary for signing in (httpOnly session cookies). We use no tracking or advertising cookies. To understand how the Service is used, we count page views and a few product events (such as sign-ups and started recordings) with Umami, a cookieless analytics tool that SyncEdge hosts itself. Umami does not store your IP address, and we remove query strings and replace record identifiers in page addresses before anything is sent. It never receives recordings, transcripts, notes or patient information.

The Service is not intended for use by anyone under 20 years of age on their own.

We post the updated version on this page along with its date. For material changes, we will notify you by email or in-app.

support@syncedge.tech

For its users' account, payment and usage data, SyncEdge Solution is the data controller under Thailand's PDPA. For recordings, transcripts and notes, including patients' health data, the clinician or organisation using Scripta is the controller and SyncEdge is its processor; organisations can request a data processing agreement. Audio is transcribed by a speech-to-text provider (United States) and AI notes are written with Anthropic, PBC (United States), as sub-processors. For patient visits and interviews, the recorded person's consent to this transfer is confirmed in the app for every recording. In HN-only mode the patient field takes a hospital number only (still personal data) and AI notes are instructed to omit patient identifiers; names spoken in a recording stay in its audio and transcript. SyncEdge notifies the controller of a personal data breach within 48 hours of becoming aware of it. Payments are processed by Stripe, Inc. (United States); we never store full card numbers. Deleted accounts are purged after a 30-day grace period; payment records are kept for 5 years as required by Thai tax law. Send data-subject requests to support@syncedge.tech (answered within 30 days); complaints may be lodged with the Thai PDPC.