Security, privacy and regulatory compliance

01Scope

This document describes the security, privacy and compliance practices Plexo applies to the information it processes on behalf of the healthcare institutions that use it.

It applies to all Plexo products, including Scribe and Billing.

02Ownership and use of information

• The institution retains ownership of all information processed in Plexo.
• Plexo uses that information solely to provide the contracted service.
• The information is not used to train artificial intelligence models, whether our own or third parties'.

03Audio and retention

• Audio is processed solely to generate the clinical documentation and is deleted once it has been generated.
• Plexo is used with the patient's informed consent, in accordance with each institution's policies.

04Encryption

• In transit: all connections are encrypted with TLS.
• At rest: stored information is encrypted with AES-256.

05Access control and auditing

• Access is assigned by role, for example physician, audit, billing and administration. Each profile can only access the information its function requires.
• The system logs every view and every change to a record, with user, date and time.
• That audit log cannot be altered.

06Human oversight

• Plexo does not sign clinical documentation or submit claims to payers without approval.
• Every output requires approval from a clinician or an authorized member of the institution.

07Data hosting

In the cloud

Information is hosted in regions that comply with the regulations of the institution's country.

On-premise

Plexo can be deployed on the institution's own servers or private cloud, so that data and its processing remain within its network. Deployment, monitoring and updates are coordinated with its IT team.

08Interoperability

Integration with the institution's systems uses the HL7 and FHIR R4 standards. Information is recorded in the institution's clinical record and is not scattered across external tools.

09Regulatory framework

Plexo was designed with reference to the following personal data and health information protection regulations:

10Evaluation and contact

At the institution's request, we share security and architecture documentation, answer its security questionnaires and set up a meeting with its IT and compliance teams.