Security built for the exam room.
See what happens to a recorded visit, who can open it and when it's deleted. Compliance teams can request the full security packet.
Encrypted at rest
BAA included
SSO and SCIM
US/EU hosting
Security settings
Halvane Care
Encryption
AES-256 at rest
TLS 1.2+ in transit
Audio retention
Emergency department
At sign-off
7 days
30 days
Single sign-on (SAML)
Hosting region
US
Audit log
Today
Rafael Ortiz viewed a transcript
9:15 AM
Marcus Hale signed a note
9:42 AM
Audio deleted after signing
9:42 AM
The life of a recording.
Six steps from the consent prompt to deleted audio. Admins can change the timing of the last one.
Step 1
Consent
The patient sees a consent prompt on screen or hears it read aloud. If they decline, nothing is recorded.
Step 2
Capture
Audio is encrypted on the device as it records, then sent over TLS 1.2 or higher.
Step 3
Transcribe
The audio becomes a timestamped transcript in your hosting region. No one at Charted listens to it.
Step 4
Draft
Charted drafts the note from the transcript. Drafts and transcripts are encrypted at rest with AES-256.
Step 5
Sign
The clinician reviews, edits and signs. Only then is the note sent to the EHR.
Step 6
Audio deleted
Audio is deleted when the note is signed. Admins can keep it for up to 30 days for quality review.
Patients are asked first, every time.
A prompt before every visit
The prompt explains in plain words what is recorded and why. It's available in English, Spanish and Portuguese.
Pause or decline at any time
Patients can say no or ask to stop at any point. The clinician pauses with one tap, and care continues as usual.
Consent is logged in the note
The note records whether consent was given, when, and whether the recording was paused.
Ostrin Family Medicine
Visit with Dr. Leah Morrow
Before we start
Dr. Leah Morrow uses Charted to take notes during today's visit. The audio is deleted once the note is signed, and you can say no or ask to pause at any time.
Language
EN
ES
PT
Yes, you can record
No, thanks
What we never do.
Train models on your visits
Audio, transcripts and notes from your visits are never used to train our models or anyone else's.
Sell or share your data
We don't sell patient data, and we don't share it with advertisers or data brokers.
Keep audio longer than you set
Audio is deleted on your schedule, and every deletion is recorded in the audit log.
Write to the chart without a signature
Charted can't send anything to your EHR until a licensed clinician signs the note.
Admin controls.
Single sign-on
Sign in through your identity provider with SAML, and turn off password logins. Available on the Health system plan.
SCIM provisioning
Add and remove users automatically when people join or leave your directory. Available on the Health system plan.
Role-based access
Decide who can record, review, sign or export notes, by role and by department.
Audit log
Every recording, view, edit, signature and export is logged with a user and a timestamp.
Retention per department
Health system admins set how long each department keeps audio, from deletion at sign-off to 30 days, and whether transcripts are deleted at sign-off.
Hosting region
Data is hosted in US data centers. Health system plans can choose EU hosting when the account is set up.
How we check accuracy.
Clinician-reviewed releases
Practicing clinicians score every release against a library of synthetic and consented visits before it ships.
Uncertainty flags
Muffled audio and ambiguous statements are highlighted in the draft, so you confirm them before signing.
Transcript beside every note
Each sentence in the draft links to the moment in the visit it came from.
Charted is documentation support, not a diagnostic device. A licensed clinician reviews and signs every note.
Security questions.
Do you sign a BAA?
Yes, on every plan, before the first recorded visit. Health system customers can send their own BAA for legal review.
Where is our data hosted?
In US data centers by default. Health system plans can choose EU hosting instead. Data stays in that region, including backups.
Is visit audio used to train AI models?
No. Audio, transcripts and notes from your visits are never used for training, by us or by any vendor we work with.
What's in the security packet?
An architecture and data-flow overview, our security policies, a summary of the latest penetration test and a completed standard security questionnaire.
Who at Charted can see our notes?
No one by default. Support staff can open a note only when your admin grants temporary access, and each view is logged.
