Before your video visit · your information
Your visit, and your privacy
When you have a video visit on Gale, the names — yours, your child’s, your clinician’s — are removed on your own device before the note reaches the cloud. Your clinician still sees them. One limit, stated plainly: on an iPhone the audio is transcribed on your device and never leaves it, but on the web the audio goes to Google’s transcription service with the names still spoken in it — under the healthcare agreement we signed in July 2026.
What happens during your visit
- 1
You talk; Gale listens
The visit is transcribed into text so your clinician doesn’t have to type and look away from you.
- 2
Your identifiers are removed — on your device
Before that text is sent anywhere, Gale finds the identifiers in it and replaces each with a neutral placeholder, like [name] or [date]. This happens on your own device, not on a server.
- 3
The cloud only ever sees the placeholders
The cleansed text — names already gone — is what’s sent to draft the note. The system that writes the note never receives your name, your number, or your address.
- 4
Your clinician’s note is re-assembled on your device
The placeholders are filled back in with the real names locally, so your clinician’s record reads normally. The key that does this never leaves the device.
What’s kept, and what’s thrown away
The audio
discarded
Used only to turn speech into text, then dropped. It is never stored. On iPhone, that transcription happens entirely on your device and the audio never leaves it. On the web it goes to Google’s transcription service, with the names still spoken in it, inside the healthcare agreement we signed in July 2026.
The raw transcript
never stored
The word-for-word transcript stays on the device for your clinician’s working view. It is never written to our database.
The note
de-identified
What’s kept is the clinical note your clinician writes and edits. The version that helps Gale improve carries no identity at all — no name, no record number.
What we strip out
Gale removes the full set of identifiers a record must lose to be considered de-identified under HIPAA’s Safe Harbor standard — eighteen categories, in plain terms:
How we make sure
Stripping identifiers from free-flowing speech is hard, so Gale does it in layers — each one a net under the last:
We already know your details
From your record, Gale knows your name, date of birth, phone, address, and chart number — so it removes those exactly, every spelling and format, with near-certainty.
We recognize the patterns
Phone numbers, Social Security numbers, emails, dates, and record numbers have shapes. Gale catches them by shape, and checks each one so it doesn’t over-remove ordinary text.
We catch names by where they sit
A name introduced by “this is…” or “my daughter…” is caught by its position in the sentence, not by a list — so a name we’ve never seen is still removed.
A final safety net sweeps the rest
Before anything leaves the device, a last deterministic pass force-removes any identifier still standing. It’s the belt-and-suspenders step real de-identification systems use.
We hold this to a measured standard, not a promise: an automated test runs the cleanser over hundreds of synthetic visit transcripts and enforces a hard rule — not a single direct identifier(name, Social Security number, record number, phone, email, address, full date) may slip through. It also confirms nothing identifiable survives into the text that’s sent to the cloud.
What you choose to share
Separately from the visit itself, you decide what your clinician sees ahead of time. From your home page you can share your reason for the visit, your history, or your medications — and turn anything off. You see exactly what they’ll see before you send it. Sharing with your own clinician is a choice you make; the cleansing above is about keeping your identity out of the cloud that drafts the note.
Go to your home →The honest part
No automated system that reads human speech is perfect, and we won’t claim otherwise. That is exactly why the protections are layered, why the raw audio and transcript are never stored, and why what Gale keeps to improve care carries no identity at all. The strongest version runs entirely on your device — already true on iPhone, and where we’re taking the web.
And today, every visit here is a synthetic demonstration — no real patient, no real data — until the formal healthcare privacy agreements (a signed BAA on HIPAA-eligible infrastructure) are in place. That’s a legal line we hold, not a setting.
Gale is software; licensed clinicians practice medicine. This page explains how your information is handled; it is not legal advice.