Service providers and retention
Effective Date: October 20, 2026
This page is part of our Privacy Policy. It describes the types of providers that help us run EMS SOAP and how long we keep each kind of information. For clinical information, our agreements with each agency govern if they differ from this page.
Service Providers
The clinical hosting, AI, and transcription providers described below process information under business associate agreements that limit their use of it to providing services to us. Our analytics and advertising tools are not given clinical records. Internal notifications may include trial text previews and blocked-message copies for security review. Automatic removal of identifying details may miss information; these copies are not presumed anonymous.
Agencies can request our current list of providers for vendor review by contacting brandon@emssoap.com. Provider disclosures and notices required by the applicable agency agreement and BAA continue to apply.
| Provider category | What it does for us | Information it may receive |
|---|---|---|
| May receive clinical information | ||
| Database, authentication, and storage providers | Database, sign-in, and file storage | Account information, clinical records, and imported patient care reports |
| Hosting and operational service providers | Application hosting, security, and operational logging | Information passing through the application, including troubleshooting records that can contain clinical information |
| AI and document processing providers | AI-assisted documentation, review, and document processing | Clinical information and uploaded documents sent for processing |
| Transcription providers | Converting voice recordings to text | Voice recordings sent for transcription |
| Business, analytics, and marketing tools | ||
| Analytics and session replay providers | Website analytics, masked session replay on selected public pages, and sign-up and sign-in events | Device, browser, and page information; user ID, email address, and IP-derived location at sign-up and sign-in |
| Advertising and measurement providers | Website advertising and conversion measurement | Cookie identifiers, device, page, and conversion information; may include email address for ad measurement |
| Website performance providers | Public website traffic and performance measurement | Page views and performance information |
| Video providers | Embedded video player on public pages | Device, browser, and video viewing information |
| Service email providers | Service email such as invitations and password resets | Name, email address, and message content |
| Marketing email providers | Marketing email | Name, email address, and email engagement |
| Scheduling providers | Demo and meeting scheduling | Name, email address, agency, and scheduling details |
| Sales contact management providers | Managing prospective customer relationships | Prospective customer contact details and sales notes |
| Service protection providers | Rate limiting and service status | IP addresses and request counts |
| Internal notification providers | Account, service, and security notifications | Account and service details; trial text previews and blocked messages for security review, with identifying details automatically removed where possible |
How Long We Keep Information
Some information may be kept longer when needed for security, compliance, or legal obligations, as permitted by our agreements. Contractual export periods, deletion requirements, and limits on backup retention continue to apply. Where a BAA requires notice that return or destruction is infeasible, we notify the agency and limit further use as that BAA requires.
| Information | How long we keep it |
|---|---|
| Original clinical text | Scheduled for removal after about four hours, or up to seven days by default for narrative quality review. Ongoing review, feedback, or recovery may extend retention. Scheduled removal may occur shortly after these periods. |
| Agency records, including narratives, review results, and feedback | Kept for the agency during the relationship. Export, return, and deletion at the end follow its agreement and BAA. |
| Imported patient care reports and their analysis | Kept as set out in our agreement with the agency that imports them. |
| Voice recordings | Not saved in our application storage. Temporary copies may remain in your browser while you use voice input. Our transcription provider processes recordings under our agreement with it. |
| Troubleshooting and operational logs, which can contain clinical information | About one year in our main logging system. Hosting providers may keep their own logs for shorter periods. |
| Security and audit records | As long as needed for security, compliance, and legal obligations. |
| Account information | While needed for the account, subject to applicable deletion requests and legal duties. Closing an individual account does not delete agency records. |
| Website analytics, session replay, and advertising data | Kept by each provider according to its retention settings. |
| Sales and marketing contact information | Until you ask us to remove it, or when it is no longer needed for the relationship. |
| Database backups | Removed information can remain until scheduled backup expiry, subject to the agency agreement and BAA. Retained PHI remains protected and its use restricted as those agreements require. |
Questions about this page can be sent to brandon@emssoap.com.