Privacy Policy for Voxio

Last Updated: September 2026

At Voxio, we take your privacy and the security of your data extremely seriously. This Privacy Policy outlines how we collect, use, and protect your information when you use our Chrome Extension and backend services.

1. Information We Collect

Account Information: We collect your name, email address, phone number, address, and intended use case when you register via Google OAuth or standard email registration.
Microphone Audio & Speech Data: Your microphone audio is processed by the browser's built-in Web Speech API (which may transmit audio to Google's servers for transcription depending on your browser). The resulting transcribed speech content is then transmitted to our servers to provide the core dictation functionality, and optionally for medical coding (ICD-10) enrichment for clinical users.
Device Information: We collect a unique Device UUID to enforce single-session limits and prevent account sharing.
Usage Telemetry: We collect the number of words dictated during use for product analytics and usage measurement. This information helps us understand service usage and improve Voxio. Privacy by Design: Voxio does NOT collect, track, or store the website domain, URL, browsing history, or page address where dictation occurs.

2. How We Use Your Data

To provide real-time, general-purpose speech-to-text dictation across any website.
To provide optional medical coding assistance (ICD-10) for clinical users.
To manage your subscription, billing, and account access.

3. Data Protection and Security

All data transmitted between the Voxio Chrome Extension and our servers is encrypted using industry-standard TLS (HTTPS). We do not store raw audio files on our servers after transcription is complete.

4. Third-Party Sharing and Processors

We do not sell your personal data or user data to third parties. We explicitly use the following trusted infrastructure processors strictly for operating the service:

Google OAuth: To securely authenticate your account and streamline registration (receives your basic profile and email).
Browser-Native Speech Provider (e.g., Google): Your browser's built-in Web Speech API transmits your microphone audio directly to its own provider's servers to generate the transcription. Voxio does not control this provider.
Google Cloud (GCP): Hosting our backend infrastructure and database.
Razorpay: Secure payment processing for subscriptions.

5. Healthcare Compliance (HIPAA) & Data Retention

Important Clinical Notice: Voxio is not HIPAA-compliant for Protected Health Information (PHI), and clinical users must not dictate PHI into the system.

Voxio converts audio to text utilizing your browser's native Web Speech API (e.g., Google Chrome's built-in speech recognition). This means your browser transmits your audio directly to its own provider's servers. Voxio does not control how the browser or its provider processes, stores, or retains your raw audio data. Additionally, Voxio's own backend infrastructure is not currently covered by a Business Associate Agreement (BAA). Please note that executing a BAA with Voxio for our backend services does not automatically make the entire dictation workflow HIPAA-compliant due to this reliance on external, browser-level speech transmission.

Account Deletion & Data Retention: When you request to delete your account, your account is deactivated and you are given a 14-day grace period to recover it. After 14 days, your account and personal information are permanently erased from our databases. Usage telemetry (such as dictation word counts and language settings) and internal system audit logs are retained for a maximum of 30 days before being automatically purged to ensure strict data minimization.

6. Contact Us

If you have any questions about this Privacy Policy, or to request data export or deletion, please contact Voxio through the support channel provided with your account or service.