Last Updated: October 28, 2026
Lamics, Inc. ("Lamics," "we," "us," or "our") is committed to protecting the privacy and security of your information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our AI-powered healthcare communication and clinical documentation services, including our Voice Agent and Lamics Scribe (AI Scribe), available through the web portal, Chrome extension, and iOS and Android apps (the "Services").
PHI we process on behalf of a healthcare provider is also governed by the Business Associate Agreement (BAA) we sign with that provider. If this Privacy Policy and a BAA conflict, the BAA controls. This Privacy Policy should also be read together with our Terms of Service.
Lamics Scribe helps licensed healthcare professionals record clinician–patient visits, transcribe them, and draft clinical notes using templates. Clinicians are responsible for obtaining patient consent to recording and for reviewing and editing generated notes before use.
Transcription and AI note generation use AI and transcription subprocessors under Business Associate Agreements. Data is encrypted in transit and at rest. We do not run ads, sell data, or use PHI for advertising. Model evaluation uses de-identified data or data provided with consent, and organizations can opt out of model evaluation entirely. Other uses and disclosures are described in Sections 2 and 3 below.
The iOS and Android apps keep audio on your device only until it is uploaded. Local audio is deleted once the upload is confirmed. Uploaded audio is retained according to your organization's policy of 7, 30, or 90 days; the default for users without an organization is 90 days. A short storage soft-delete period follows. Transcripts and notes are retained under the customer agreement. Customer offboarding includes verified export before destruction, subject to the retention requirements in Section 5.
You can request deletion of your account and associated data by emailing support@lamicsai.com from your account email. We verify your identity and complete deletion within thirty (30) days of verification, except for data that must be retained by law or under the customer's agreement or BAA. Practice PHI follows the practice's instructions and legal retention obligations. See our Account and data deletion page for the request link, deletion scope, and retention exceptions.
As a Business Associate under HIPAA, we collect and process PHI on behalf of covered entities (healthcare providers). This includes:
We collect information from healthcare providers who use our Services:
We automatically collect certain information when you use our Services:
We collect information from your communications with us:
We use the information we collect to:
We use de-identified and aggregated data to:
We use account and business information to:
We may use information for other purposes with your explicit consent, such as marketing communications (which you can opt out of at any time).
Important: We do not sell, rent, or trade PHI or any personal information to third parties for their marketing purposes.
We share information with trusted third-party service providers who assist us in operating our Services. All such providers are bound by contractual obligations to protect your information and comply with HIPAA:
We may disclose information when required by law, such as:
If Lamics is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice and ensure continued protection under HIPAA.
We may share information with your explicit authorization or as directed by the covered entity we serve.
We implement industry-standard security measures to protect your information, including:
We maintain comprehensive HIPAA compliance programs, including:
In the event of a breach of unsecured PHI, we will notify affected covered entities without unreasonable delay, as required by HIPAA and within the notification period set out in our Business Associate Agreement with that covered entity.
We retain information for the following periods (or as specified by the covered entity):
When data is deleted, we use industry-standard secure deletion methods:
Upon request, we will provide covered entities with copies of their data in standard formats (JSON, CSV, HL7, etc.) to facilitate data portability. Customer offboarding includes verified export before destruction.
Individual users, including Lamics Scribe app users, can request deletion of their account and associated data by emailing support@lamicsai.com from their account email with the subject "Account deletion request." No login is required to access the Account and data deletion page. We verify identity before deletion and apply the thirty (30) day timeline and retention exceptions below. Organization data is handled under the practice's instructions, customer agreement, BAA, and legal retention obligations.
Customers may request deletion of their account, practice, or patient data at any time, including upon termination of the Services:
Patients who want their information deleted should contact their healthcare provider. The provider, as the covered entity, will instruct us to take any required action under our Business Associate Agreement.
As a covered entity using our Services, you have the right to:
If you are a patient whose information is processed through our Services, your rights under HIPAA are exercised through the healthcare provider (covered entity), not directly with Lamics. Please contact your healthcare provider to exercise your HIPAA rights.
You may opt out of marketing communications at any time by:
Note: You cannot opt out of essential service communications (e.g., security alerts, billing notices).
Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. However, we may process PHI for pediatric patients on behalf of covered entities as part of our healthcare services. Such processing is governed by HIPAA and our Business Associate Agreement.
Our Services are provided from the United States. If you access our Services from outside the United States, your information will be transferred to, stored, and processed in the United States.
We take appropriate measures to ensure that international data transfers comply with applicable data protection laws.
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). However, PHI covered by HIPAA is exempt from CCPA.
For non-PHI information, California residents have the right to:
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will post the updated Privacy Policy on our website and update the "Last Updated" date.
For material changes, we will provide notice via email or through our Services at least thirty (30) days before the changes take effect.
Your continued use of the Services after changes become effective constitutes acceptance of the updated Privacy Policy.
Our Services may contain links to third-party websites or integrate with third-party services (e.g., EMR systems). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.
If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:
Lamics, Inc.
Privacy Officer
Email: support@lamicsai.com
For HIPAA-related requests or to exercise your rights under HIPAA, please contact your healthcare provider directly.