Privacy Policy · SOAPscribe AI
Last updated: August 24, 2026
Data controller: Diego Emiliano Battipiedi
Contact: hola@corefide.com
Summary in three sentences
SOAPscribe has no servers. All processing happens in your browser, and your session content travels only between your computer and the AI provider you contract with your own API key.
Neither the developer of SOAPscribe nor any third party connected to this extension can read, store or access the content you process.
There is no analytics, no tracking, no user accounts.
1 · Who is responsible
This extension is developed and maintained by
Diego Emiliano Battipiedi, based in Yautepec, Morelos, Mexico.
For any question regarding this policy, write to hola@corefide.com.
2 · What data the extension handles
2.1 · Data you enter
| Data | Purpose | Where it lives |
|---|---|---|
| Session material | Generate the clinical note | In memory, discarded on close |
| Patient alias | Head the document | In memory, discarded on close |
| Session number, duration, format | Document metadata | In memory, discarded on close |
| Clinician name | Sign the document | In memory, discarded on close |
None of this is written to disk. When you close the side panel, it is gone.
2.2 · Data the extension does store
Only two things, both on your own computer:
| Data | How | Where |
|---|---|---|
| Your Gemini API key | Encrypted with AES-GCM 256-bit | chrome.storage.local |
| Whether you accepted the legal notice | A true/false value | chrome.storage.local |
The extension uses chrome.storage.local and never chrome.storage.sync. The difference matters: anything stored in sync travels to Google's servers and is replicated across every device where you are signed in. Your encrypted key never leaves this computer.
2.3 · Data that is NOT handled
- No name, email or identifying information is collected
- No user accounts, no registration
- No analytics or telemetry of any kind
- No cookies, history, bookmarks or tabs are read
- No scripts are injected into the pages you visit
- No advertising, no advertising identifiers
3 · How your API key is protected
Your key is encrypted before being stored, with a password only you know:
| Parameter | Value |
|---|---|
| Key derivation | PBKDF2 with 600,000 iterations, SHA-256 |
| Salt | 16 random bytes, different on every save |
| Encryption | AES-GCM 256-bit |
| Initialisation vector | 12 random bytes, different on every save |
| Authentication tag | 128 bits |
| Implementation | crypto.subtle, the browser's native API |
The 600,000 iterations follow the OWASP Password Storage Cheat Sheet recommendation. They make decryption take roughly one second, which renders brute-force password guessing impractical.
Your password is stored nowhere. Not on your computer, not anywhere. If you forget it, the encrypted key is unrecoverable and you will have to enter your Gemini key again. This is intentional: if the password were stored, encrypting would serve no purpose.
4 · Where your data goes
When you press "Generate note", this happens:
` Your browser ──────────────► Google (Gemini API) ◄────────────── `
That is all. There is no intermediate step. No SOAPscribe server processes your data, because SOAPscribe has no servers.
The connection is made to https://generativelanguage.googleapis.com and to no other domain. It is the only network permission the extension declares, and you can verify this in the manifest.json of the installed package.
Your relationship with Google is direct
The content you process is sent to Google using your own API key. That means the contractual relationship over that data is between you and Google, not between you and SOAPscribe.
You are responsible for reviewing and accepting Google's terms:
- Gemini API Terms of Service
- Google Privacy Policy
- Data use terms for the service tier you contract
Important for clinical use: the free tier of Google AI Studio may use submitted content to improve its models. If you process information subject to professional confidentiality, consider a paid tier or Vertex AI with a data processing agreement, where such use is excluded.
5 · The permissions the extension requests, and why
| Permission | What it is used for |
|---|---|
storage | Store your encrypted key on this computer |
sidePanel | Show the side panel where you work |
contextMenus | The "Generate SOAP note" right-click option |
activeTab | Read only the text you select, and only when you use that option |
generativelanguage.googleapis.com | Send your request to Gemini with your key |
The extension does not request <all_urls>, tabs, cookies, history, webNavigation or downloads.
activeTab is the narrowest permission available for reading page content: it activates only when the user explicitly triggers an extension action, and only grants access to the tab they are on at that moment.
6 · Health data and professional confidentiality
SOAPscribe is intended for healthcare professionals documenting clinical sessions. The content you process may constitute special category data under Article 9 of the GDPR.
What the extension does to protect it
- Does not store it on disk
- Does not transmit it to any server of ours
- Does not share it with third parties other than the AI provider you choose
- The prompt instructs the model to replace real names with generic labels
such as [FAMILY MEMBER] or [LOCATION]
What remains your responsibility
- Use an alias, never the patient's real name. The extension reminds you
on screen, but cannot prevent it.
- Verify that the generated note contains no identifying data before filing or
sharing it.
- Comply with the regulations that apply to you: GDPR in the EU, HIPAA in the
United States, Law 25 in Quebec, and the ethical obligations of your professional body.
- Choose an AI service tier compatible with your confidentiality obligations.
What SOAPscribe does not claim
This extension is not certified as medical software and is not declared HIPAA-compliant. It is designed so that it can fit into workflows meeting those requirements when used with an AI provider offering the corresponding contractual guarantees, but that assessment is yours to make.
7 · Your rights
Because SOAPscribe collects and stores no personal data of yours on any server, there is nothing for us to provide, rectify or erase.
Even so:
To delete everything the extension stores, uninstall it from chrome://extensions. Chrome automatically removes all of its local storage, including the encrypted key.
To delete only the key, open Settings inside the panel and press "I forgot my password".
Regarding data you send to Google, exercise your rights directly with Google. We have no access to it and cannot act on it.
8 · Minors
SOAPscribe is a professional tool and is not directed at minors. No data from minors is knowingly collected.
If you document sessions with underage patients, the obligations over that data fall on you as the professional responsible for processing.
9 · Changes to this policy
If this policy changes, the date in the header will be updated and the new version published at this same address.
If any change affects how your data is handled, notice will be given inside the extension before it takes effect, as required by the Chrome Web Store disclosure policy since 1 August 2026.
10 · Contact
hola@corefide.com
For security matters: hola@corefide.com
<sub>SOAPscribe AI · Privacy Policy · Version 1.0</sub>