Privacy Notice

1. Who we are and the closed pilot

Susurrus AI, Inc. is a Delaware corporation (our certificate of incorporation was signed and filed on 24 October 2026; State acceptance is pending). You dictate into our web application, and it transcribes your speech and drafts a report in your own template. Every output is a draft that you review, edit, and sign.

We offer Susurrus today as a closed pilot for about 30 to 50 invited radiologist testers on the web edition over 3 to 6 months. Access is by invitation only. Early access before the official closed pilot is free; the pilot itself will be charged at cost, and we will tell you before any charge. Practice contracts, practice administrators, and a Windows application for practices wait for a separate HIPAA review.

• Drafting tool, not an archive: Because we delete cases automatically after 3 or 7 days, you must copy every final report into your own reporting system.
• Officers: Nicholas Lariccia, MD, founder, is our HIPAA security officer. Jose, a radiologist and co-founder, is our second officer and emergency-access person.

2. Patient information, HIPAA, and your authority

Protected health information (PHI) you enter under our Terms of Service is handled under HIPAA. Every outside service that receives dictation audio or report text has signed a HIPAA Business Associate Agreement (BAA) with us. A switch in the live application (our "HIPAA lock") keeps every service without a BAA turned off.

Right after your first two-step sign-in, before using Susurrus, you must tick a required checkbox reading "I agree to the Terms of Service and Business Associate Addendum". Every part of the application enforces this check and refuses access until you accept the current version. We record your account, the document version, and the time of acceptance, and we ask you to accept any new version at your next sign-in.

• If you can bind your practice: If you are a covered entity or business associate under HIPAA, or are authorized to sign for one, the Business Associate Addendum in Part 2 of our Terms of Service is that organization's BAA with Susurrus AI, Inc.
• If you cannot bind your employer or group: If you read for a hospital, radiology group, or teleradiology organization that you cannot bind, ticking the checkbox does not create a BAA with that organization. Under our Terms of Service, you must get that organization's permission before entering its patients' information into Susurrus, and you are responsible for having that permission.
• Incidents and breaches: Tell us at once if you think someone else has used your account. Under our Business Associate Addendum, we report any successful security incident without unreasonable delay, and any breach of unsecured PHI without unreasonable delay and within 60 calendar days of discovery.

3. Signing in and account security

Every person has an individual account by invitation only. Do not share your sign-in. Sign-in with Google is not used.

• Passwords: Your password must have at least 10 characters, including a number and a special character, enforced by our sign-in service in Microsoft Azure. Our sign-in service keeps only a one-way scrambled form (a hash) of your password, never the password itself.
• Two-step sign-in (Duo): A Duo push to your phone is required for every account, administrators and testers alike, set up at your next sign-in. Duo (Cisco) sees your username (your name), phone details, internet address, browser type, and sign-in time. Duo offers no BAA and receives no patient information or case content.
• Automatic sign-out: Computers with no use for 12 hours are signed out, and everyone signs in again every 30 days.

4. What we collect and store

We store the following in Microsoft Azure:

• Account: Your email address, a username made from your name (changeable in Settings), and your Terms acceptance record.
• Setup: Your templates, saved phrases, reporting style and the rules you have written for it, settings, and AI choices.
• Cases: The text you dictate or type, the draft report, the signed report, any prior report text you add, and your Consult conversation for that case.
• What Susurrus learns from you: While "Learn from my reports" is on (it is on unless you turn it off in Settings), when you copy a report, the sentences the app wrote, how you changed them, your dictation, and the case history are kept with the case and sent to OpenAI to learn your reporting habits. Long-term, we keep only the habits themselves, words you have taught it to hear, and a private note describing your style, never whole cases. When the learner is unsure about a habit, our team may look at a short excerpt without your name to improve the learning. Turning learning off deletes the kept material.
• My desk daily totals: For each day and exam type, how many reports you signed, their work RVUs, your reading times, and how many had a sentence the writer wrote changed by you. They never include case text, case numbers, or the time of day.
• Problem reports: When you report a bug, we keep your note and, if you choose, the case it came from. An idea is kept without a case.
• Template files: Kept for 30 days so we can set your templates up, then deleted. Only the Susurrus team can open them.
• Usage records (without case text): Simple counts of which features were used and whether they worked, and the names of guidelines asked for that were not in the library. For calls made on a key that Susurrus provides, we also record which service and model was used, how large the call was, and its estimated cost to track monthly spending limits.

5. Dictation audio and speech services

Your browser records your dictation and sends the audio to three BAA-covered speech-to-text services, which each turn it into text; Susurrus compares their answers to choose the words. We never write audio to logs and normally keep only the resulting text as part of your case.

Testing exception: We can keep recordings of a tester's dictation, with what the services heard and the finished report, to test and improve speech recognition. This happens only for an account where we switched it on with that person's agreement, and it is off for everyone today.

• AssemblyAI (through our server): Receives dictation audio and custom vocabulary words you taught Susurrus to hear; kept 1 day. Its training and benchmarking opt-out is switched on; its BAA lets it de-identify and use de-identified data and offer data aggregation.
• OpenAI (through our server): Receives dictation audio under our OpenAI BAA with modified retention.
• Soniox (directly from your browser): Receives dictation audio and custom vocabulary for the live speech-to-text preview; processed in real time and not stored.

6. AI services

When you ask for a draft, reword a sentence, add a prior report, ask Consult, run quick checks, or copy a report with learning on, our server sends only the text that task needs to our BAA-covered AI services. Every API key, ours or one you enter, is encrypted on our server before it is stored, and it is never shown back or written to logs.

• OpenAI: Drafts, rewords, and checks report text (including choosing applicable guidelines, sorting dictation into report sections, and checking a prior report's summary against the report) and learns your reporting style, using HIPAA-eligible services under our OpenAI BAA with modified retention.
• Anthropic (Claude): Reads prior reports, powers the Consult question-and-answer helper, and provides a slower, more careful drafting option (and writing or rewording where picked in Settings) under our Anthropic BAA, with HIPAA-eligible prompt caching on.
• No vendor training: Under their API data-control terms, neither OpenAI nor Anthropic trains its models on our API data.

7. Dates and how models never receive dates in text

Until our dictated-dates update ships, our browser and server screener still shortens exact dates in dictation to the year (and holds prior-exam dates in browser memory so only the time interval, such as "14 months ago", leaves your browser). With our dictated-dates rule, you may dictate or type dates into your observations and reports while keeping dates out of AI text model calls:

• Stored under BAA: Dates you dictate or type are stored with your case in our Azure database under Microsoft's BAA.
• Tagged before AI calls: Before any AI call, each date in the text is replaced by a tag carrying its time interval, and the real date is put back when the answer returns. The AI services therefore never receive a date in text.
• Audio and logs: Spoken dates still reach the speech services as audio under their BAAs. Dates are never written to logs.

8. Where data is kept and how it is protected

All case content and accounts are hosted in Microsoft Azure in the Central US region under Microsoft's HIPAA BAA (Microsoft Product Terms): the web application, sign-in service, PostgreSQL database, file storage, Key Vault, email (Azure Communication Services), and logs (Azure Monitor). Code hosting (GitHub), our domain registrar, and our uptime checker receive no case content.

• Private network and encryption: Data in transit uses TLS 1.2 or newer. The PostgreSQL database is closed to the public internet and reachable only from Azure's private network. The database, files, backups, and Key Vault are encrypted at rest by Azure with Microsoft-managed keys that never leave Azure. Service passwords and keys are kept only in Key Vault.
• Logs without case text: Logs and error records stay in Azure and carry account numbers, timings, and error codes—never case text, audio, dates, or keys.
• Backups: Azure keeps point-in-time database backups for 35 days, with a copy in a second US region (geo-redundant). Separately, an encrypted copy of the database is made each night and kept for 14 days in Google Cloud Storage (US) under a retention lock and a Google Cloud BAA. Only a private key held by our security officer (with a backup held by our second officer) can read the nightly copy.

9. How long data is kept

We keep each category of data only for the periods below:

• A case (dictation, draft, and signed report): 3 days after you sign the report; otherwise 7 days after the last change (reopening and signing restarts the 3 days; keeping as a draft restarts the 7 days). A case attached to an open problem report is kept until the report is reviewed.
• Random case number (no text): 30 days, so your other devices learn the case is gone.
• Fingerprint (hash) of each signed report (no text): 400 days, to show it was not changed later.
• Record of who opened which case number (no report text): 400 days.
• Problem-report notes: 90 days after the report is closed.
• Template files sent for set-up: 30 days.
• Feature-use counts: 7 days.
• Templates, phrases, settings, learned style, and My desk daily totals: Until you delete or clear them, or until your account is deleted.
• Dictation recordings kept for testing speech recognition: Off for everyone today; if switched on for an account with that person's agreement, kept until deleted (never automatically).
• Deleted files in Azure file storage (such as recordings): Recoverable for about 14 days at most (7 days as a previous version, then 7 days soft-deleted), then gone.
• Logs (no case text): 30 days.
• Database backups: 35 days (Azure); 14 days (the encrypted nightly copy in Google Cloud).
• At the speech and AI services: AssemblyAI 1 day; Soniox not stored; OpenAI and Anthropic under each BAA's retention terms (OpenAI with modified retention).

10. How case data is used

We use case content to run the service for you, including learning your reporting style while learning is on. We use only de-identified cases to test, benchmark, and improve our own service, including our instructions and models. We never use identified case content for this.

• De-identification first: Before a case is used to test or improve Susurrus, or shared with anyone, it is de-identified under HIPAA (the Safe Harbor method, which removes all 18 kinds of identifier, or an expert's written determination). Our identifier screener and date tagging run on every such case first, and our security officer confirms the result.
• No vendor training, sale, or marketing: Outside vendors may not train on our data, and their opt-outs stay on. We never sell your data or patient information, and we never use it for marketing or advertising.

11. Who at Susurrus can see your data

Testers reach only their own cases; our database enforces this. Development tools have no access to production data. People at Susurrus can see your data only in three situations:

• Open problem reports: An administrator can open a user's case only when the user sent it with an in-app problem report, and only while that report is open. Each look is recorded in a log that cannot be edited.
• Logged support look-ups (starting only after independent security review passes): Our security officer can look up one user's whole account, read-only, inside Azure on a read-only database role with reviewed, named queries to answer a support question. Each look-up needs the security officer's Microsoft two-step sign-in to Azure and a Duo push to the security officer's phone naming the person looked up. Report or dictation text appears only when an explicit, logged option is chosen. Every look-up is logged in Azure and locally, and results stay on the security officer's encrypted computer and are deleted after 7 days.
• Short learning excerpts: When the style learner is unsure about a habit, our team may look at a short excerpt without your name.

We do not check whether you have permission to enter an organization's patient information; we rely on your promise in our Terms of Service. If a hospital, practice, employer or regulator tells us that patient information in your account was entered without its permission, we may suspend your account, keep the affected cases secured and unused, and then delete or return them as that organization directs. We may tell it when your account was active, how many cases were affected, how the information was protected and when it was deleted.

12. Cookies and browser storage

Your browser keeps a copy of your cases (removed when you sign out) so nothing is lost if the connection drops, along with device preferences such as your theme and microphone.

• We use cookies only to keep you signed in, with no advertising or tracking cookies.

13. Waitlist, invitations, and tester profiles

If you join our waitlist or accept a pilot invitation, we store your answers in our Azure database to choose testers, contact you about the pilot, and shape the pilot. Only the Susurrus team can see your profile answers, and they are never sent to an AI service.

• Waitlist: We keep your name, email address, role (radiologist, trainee, or other), and any optional answers you give (subspecialty, imaging types, practice setting, reading volume, years in practice, reporting system, reading from home or on site, how you are paid, other tools, location, note, and whether we may contact you for occasional feedback or short studies). To limit repeated sign-ups, our server keeps a scrambled code made from your internet address for about two hours. Never enter patient information on the waitlist; our safety-net screener checks entries but cannot find everything.
• Invitations and tester profiles: When we invite you, we keep your name, email address, our note, any starting credit, and when the invitation was sent, accepted, or cancelled. The invitation link works once for 14 days for your email address, and we store only a scrambled form of it. Application emails are sent via Azure Communication Services without tracking pixels. After you accept, we reuse your waitlist answers and ask only what is missing. Profile answers are kept while your account exists and deleted with it; waitlist and invitation records are kept until we delete them, or you can ask us to delete them sooner.

14. Your choices, requests, and deleting your account

You can manage your data in the app or contact us at any time.

• In-app controls: Delete any draft from My desk; turn off "Learn from my reports" in Settings (which deletes kept learning material and unaccepted habits); clear My desk daily totals in Settings; or click "Download my data" to get one file of your templates, phrases, styles, rules, and settings (excluding cases, recordings, keys, and usage).
• Export, correction, and deletion requests: You can ask for your cases to be exported, corrected, or deleted. We do it, or tell you why we cannot, within 30 days.
• HIPAA individual rights: Because Susurrus deletes cases after 3 or 7 days, we are not a medical-record archive. Only while we still maintain PHI in a designated record set, under our Business Associate Addendum we make it available to the covered entity within 15 business days for access, incorporate directed amendments, keep information needed for an accounting of disclosures, and pass any request made directly to us by an individual to the covered entity within 5 business days.
• Deleting your account: Contact us to close and delete your account. This deletes your setup, cases, learned style, problem reports, speech-testing recordings, template files, profile answers, and usage records. Copies in backups age out within 35 days (Azure) and 14 days (Google Cloud nightly copy), and recovery copies of deleted files within about 14 days. We keep the signed-report fingerprint for 400 days, the record of who opened which case number for 400 days, server logs for 30 days, and the record of administrator actions, by account number only.

15. Never email case text or patient information

Our company email (Google Workspace) and email-forwarding service (ImprovMX) for our support and privacy addresses do not have BAAs.

• Never send patient information, dictation, or case text by email; always use the in-app reporting tools instead.

16. Changes to this page and contact

If this page changes, the date at the top changes with it. If we update our Terms of Service and Business Associate Addendum, we ask you to accept the new version at your next sign-in before you can continue using Susurrus.

• Contact: Susurrus AI, Inc., Nicholas Lariccia, MD, Security Officer. Email our privacy or support address for account or privacy requests, or see /.well-known/security.txt to report a security problem. Never include patient information or case text in any email; use the in-app reporting tools for any issue involving a case.