Privacy Policy

Last updated: 4 July 2026. This policy covers the OUI RadDictate Chrome extension, mobile app, and web account pages ("the Service"), operated by OUI Technologies ("we", "us").

What the Service is for

OUI RadDictate lets a signed-in clinician dictate radiology reports and have them transcribed by our secure cloud service, then place the text into the web-based radiology/hospital information system (RIS/HIS) they are using. Because clinicians use many different web-based RIS/HIS, the extension can operate on the site the clinician is working in; it does not act on other sites on its own. To place the report where you are typing, the extension reads which text field is focused (including a field inside a frame of the same RIS/HIS page) and writes the dictated report into it — it does not read, collect, or transmit other content from the pages you visit.

Information we process

• Account details — the email address you sign in with (via Google Identity Platform) and your organization/role settings.
• Dictated audio — the audio you record. It is sent to the transcription provider to produce text and is not stored by us after transcription. Optional local backups may be kept on your own device — see "Data stored on your device" below.
• Report text — the transcribed report, stored end-to-end encrypted so your history syncs across your devices: it is encrypted on your device with a key derived from your password, and we store only ciphertext we cannot read.
• Templates & settings — report templates and preferences you save.
• A device identifier — a random per-install ID used only to enforce your subscription's device limits and detect account sharing.
• Usage & security data — counts of requests/minutes for your quota, and network metadata such as IP address and browser type for security and abuse prevention.

How we use it

• To authenticate you and provide transcription, formatting, and cross-device history.
• To enforce subscription limits (minutes, expiry) and prevent credential sharing.
• To secure the Service and investigate misuse.

We do not sell your data or use it for advertising.

Service providers

We use Google Cloud as our processor — Vertex AI (Gemini) for transcription, Firestore for storage, Identity Platform for sign-in, and Cloud Run for hosting — under Google's Cloud Data Processing Addendum. Google does not use your prompts or responses to train its models. Data is stored in Google's Singapore region; transcription requests are processed by Google's Vertex AI service.

Patient information

The Service is intended for de-identified report content. Do not enter directly identifiable patient information (such as names or medical-record numbers) into the cloud path unless your institution's privacy and data-processing requirements permit it. Stored report content — including any report label you attach — is end-to-end encrypted on your device and is not readable by us (see "Information we process" above). Dictated audio is always encrypted in transit (TLS); the transcription service must momentarily process the audio itself to convert speech to text — it is handled transiently for that purpose only and is not retained.

Data stored on your device

Some data stays on the device you use — it is not sent to us:

• Recording backups (Chrome extension) — when the Backup option is on (it is on by default), the extension keeps a local copy of each dictation on your computer: the raw recording, the pause-compacted recording that was transcribed (WAV files), and the transcript text. These are stored in the browser's private storage for the extension, never uploaded by us, and remain until you delete them. You can review, export (Archive), or delete them at any time from the extension's Recordings tab, and turn Backup off entirely.
• Audio backups (mobile app) — the mobile app can keep your recordings on the phone the same way; manage or delete them in the app's Audio backups section.
• Sign-in session and encryption key — your sign-in token and the device-held encryption key that unlocks your end-to-end-encrypted history.

Anyone with access to your signed-in device profile could open these local files — use your institution's device security (OS login, disk encryption) accordingly. Uninstalling the extension/app removes its local storage.

Security

All traffic is encrypted in transit (TLS); stored data is encrypted at rest. Each user's reports are isolated to their own account, and access is controlled by verified sign-in.

Retention & your choices

By default, report history is automatically deleted after 14 days; in the app's settings you can shorten or lengthen this (1–60 days) or turn auto-delete off, in which case history is kept until you or your administrator delete it. Recorded audio is not retained by us after transcription; local backups on your device (above) are under your control in the app. To access, export, or delete your data, contact your administrator or us at the address below.

Contact

Questions or requests: arqam@ouitech.net.

We may update this policy; material changes will be reflected by the date above.