Privacy
There are two ways to use NDIScribe: the iPhone app, and this website, which a support worker can sign in to from any browser on any device including an Android phone. Unsigned drafts stay on your device unless a signed-in worker deliberately chooses Review with AI. In the iPhone app, manual drafting, review and signing remain available offline without a usage cap. In a browser they are not: the unsigned draft is kept in that browser's own storage on that device so that closing the tab does not lose it, and everything else, signing included, needs a connection to this service at the moment it happens.
AI review is available in a new workspace unless somebody switches it off. It is not off until an owner turns it off, so an organisation whose policy is that no draft text leaves Australia has to act rather than assume. An organisation can switch AI review off for its whole workspace. Only the workspace owner can change that setting, in the provider workspace, and while it is off the service refuses every AI review request from every worker in that organisation regardless of what any app offers or what any worker has consented to on a device.
When Review with AI is chosen, NDIScribe shows a disclosure and records consent for that verified user before the first send. NDIScribe then sends the draft text and selected support type to an external writing assistant solely to create an editable writing suggestion, five-item documentation checklist and wording flags. NDIScribe does not ask the assistant for a score, verdict, confidence, legal conclusion, clinical conclusion or compliance result. The worker must review and may change every word before signing. NDIScribe does not log the prompt or output in application logs. The assistant is an external recipient and may process the submitted text outside Australia under its own data-handling terms, so the user and organisation must be authorised to send it. The country is the People's Republic of China: the assistant is an overseas recipient there, its published platform terms are governed by the law of the People's Republic of China, and it publishes no data residency commitment covering this traffic. We will not tell you the note is stored in China and we will not tell you it is not, because neither is established; what is established is the sentence above.
AI review is limited to 30 admitted requests per user per UTC day, 2,000 per organisation per UTC day, 20,000 across the service per UTC day, and one provider call at a time. A request that reaches the writing assistant and produces a reply counts towards those limits, including when NDIScribe then rejects that reply. A request that never reaches the assistant does not count towards them. Admission and signed review evidence are transient service records scheduled to expire after 48 hours. If a worker signs an assisted note, the immutable signed workspace record retains the final human text, editable suggestion, checklist, wording flags, consent version, provider, API model, model release and evidence digest as review provenance. Amendments are manual-only. These interactions may be declared to Apple as product interaction and other user content used for app functionality.
When a signed-in worker chooses Sync now while the app is open, NDIScribe exchanges workspace participant labels, assigned shifts and immutable signed records between that iPhone and the shared practice workspace. A worker signed in through a browser has no separate sync step, because there is nothing to reconcile: every screen reads from and writes to the shared practice workspace as it is used, and the only thing held on that device is the unsigned draft described above. Labels, shift locations and signed note text are entered by users and may identify a person even though the app prompts users to use short, de-identified participant labels. Workers can access shared participant labels, shifts assigned to them and their own signed records. Owners and managers can access the team directory, shifts, signed records, worker attribution, review provenance and filing history for supervision and export.
A filing declaration is an internal ledger entry created only when an authorised user explicitly declares that exact record versions were filed in an external system. Preparing an export does not prove that a browser download, save or print completed. A declaration does not send a record to the NDIS Commission, PRODA or another records system. Downloaded or printed copies remain wherever the manager saves them.
Amazon Web Services hosts the shared workspace service in its Sydney region and Amazon Simple Email Service delivers one-time passcodes. A passcode is scheduled to expire after 10 minutes and an ordinary session after 30 days. Pseudonymous short-lived abuse-prevention counters and expired records may remain for a few days while automatic deletion completes.
Once deletion is accepted, normal account or workspace access is blocked immediately. Owner cleanup removes the online workspace, authentication data and synced records. Manager or worker cleanup removes that person's access, profile, sessions and membership while immutable signed workspace records remain. We use encryption in transit and at rest and do not sell personal information.
Stripe processes web subscription checkout and billing. It receives the account and payment details needed for checkout, which may include the owner's email, organisation name, billing address, tax identifier, billing interval and payment method. NDIScribe does not receive or store the full card number. We retain Stripe customer, subscription, price, invoice and transaction-status identifiers so we can provision the workspace, show billing status and respond to refunds or disputes. The number of people in a workspace is not sent to Stripe, because the price does not depend on it.
Contact mitsi@keenshift.ai.
Last updated 13 August 2026.