Privacy policy
Effective August 3, 2026 · Last updated August 31, 2026
Responder Worx ("Responder Worx," "we," "us") builds Traumix, an application that records patient care audio and returns a structured narrative. This policy explains what we collect, why, and what we do not do with it. It covers our website and the Traumix application.
Protected health information ("PHI") inside Traumix is handled under our Business Associate Agreement with your agency and the HIPAA notice below — not under this policy's general terms. Where the two differ for PHI, the BAA controls.
1. Who controls your data
For run audio, transcripts, and narratives, your agency (or you, if you subscribe as an individual provider) is the covered entity and data owner. Responder Worx acts as a business associate and processes that data only to deliver the service, at your direction.
2. What we collect
- Account data. Name, work email, agency, role, credential level, device PIN hash, and authentication records.
- Run content. Audio you record or upload, its transcript, the generated narrative, flagged events, and call timeline entries. This content routinely contains PHI.
- Service metadata. Timestamps, run identifiers, device and app version, sync and error logs, and the audit trail of who recorded, opened, edited, or accepted each run.
- Website data. Anything you type into the demo request form, plus basic request logs (IP address, user agent, pages viewed).
We do not ask for PHI in the demo request form and ask that you not include any.
3. Why we use it
- To transcribe your audio and generate, format, and deliver the narrative and call timeline.
- To authenticate you, enforce PIN and role restrictions, and produce the audit trail your QA process needs.
- To keep the service running: diagnostics, security monitoring, backups, and support you request.
- To bill your agency and meet our own legal and accounting obligations.
4. What we never do
- We do not sell or rent your data, and we do not share it for advertising.
- We do not use your recordings, transcripts, or narratives to train third-party models.
- We do not use PHI to train or fine-tune our own models except where your agency has separately authorized it in writing.
- We do not access run content except as needed to provide or troubleshoot the service, and access is logged.
5. Subprocessors
We use a limited set of vendors for cloud hosting, storage, speech-to-text, and language processing, including:
- AssemblyAI, for speech-to-text transcription of recorded audio
- Amazon Web Services (AWS Bedrock), running Anthropic's Claude model, for generating the clinical narrative from the transcript
Each subprocessor is bound by a written agreement with confidentiality, security, and, where PHI is involved, HIPAA Business Associate terms, including a prohibition on training on your data. A current list of subprocessors is available on request at privacy@responderworx.com.
6. Security
Audio is encrypted on the device before upload and remains encrypted in transit and at rest. Access is restricted by account, role, and device PIN, and administrative access is limited to personnel who need it. We maintain logging, monitoring, and an incident response process. No system is perfect; if we discover a breach of unsecured PHI we notify your agency without unreasonable delay and within the timeframes HIPAA requires.
7. Retention and deletion
Your agency sets the retention period for source audio, including delete-on-accept, where the audio file is destroyed the moment the provider accepts the transcription and narrative. Narratives, timelines, and audit records are retained for the period your agency configures or the period your state's records law requires, whichever is longer. On termination we return or destroy the data as directed in the BAA.
8. Your choices and rights
Patient requests for access, amendment, restriction, or an accounting of disclosures go to the covered entity — your agency — and we support the agency in fulfilling them. Providers can access and correct their own account information in the app or by contacting us. If your state grants you additional privacy rights over non-PHI personal information, contact us and we will honor them.
9. Recording consent
Traumix records audio during patient care. Recording law varies by state, and some states require the consent of all parties. Your agency is responsible for confirming that its use of Traumix complies with agency policy, state recording law, and medical direction. Responder Worx does not provide legal advice on this point.
10. Children
Traumix is not offered to consumers and is not intended for use by anyone under 18. Pediatric patients may appear in run content as PHI; that content is handled under the BAA like any other PHI.
11. Changes
If we make a material change we will update the date above and notify agency administrators before it takes effect.
12. Contact
Privacy questions: privacy@responderworx.com. Mailing address available on request.