Private session notes on iPhone: transcription that never leaves the device

ScribeKit records and transcribes on your iPhone, with no upload, no account and no transcription server, so the app itself sends the session audio to no one. (Your iPhone's own iCloud Backup is a separate question, covered under Backups below.) That is the whole claim. This page is not legal advice: no app is "HIPAA compliant" by itself, and ScribeKit offers no BAA because its developer never receives the audio. Confirm any workflow with your compliance officer or professional body before you record a client.

I make ScribeKit, and I am a developer, not a clinician or a lawyer. What follows is what the regulators and vendors say in their own words, linked so you can check them, plus how my app actually stores data, including the part that is still your job.

Is there a HIPAA compliant transcription app?

Not in the sense the search implies. HHS does not certify software. Its FAQ on the Security Rule says "there is no standard or implementation specification that requires a covered entity to 'certify' compliance," and that "HHS does not endorse or otherwise recognize private organizations' 'certifications' regarding the Security Rule" (HHS FAQ). Compliance is something a practice does, across its people, devices, policies and vendors. A "HIPAA compliant" badge on an app tells you about one piece at most.

The question that matters for a tool is whether its maker becomes your business associate. HHS defines a business associate as "a person or entity that performs certain functions or activities that involve the use or disclosure of protected health information on behalf of, or provides services to, a covered entity" (HHS, Business Associates). Its Health App Use Scenarios (February 2016) put the test as whether the developer "creates, receives, maintains or transmits protected health information (PHI) on behalf of a covered entity."

For cloud services HHS is strict. Its guidance on HIPAA and cloud computing says a provider that stores health information for you is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data," and that the "conduit" exception is limited to transmission-only services. So a cloud transcription service that holds your session audio needs a BAA with you.

An app that never receives the data is in a different position: there is no PHI on the developer's side to sign for. That does not end your obligations. It moves them onto your phone, which is where the rest of this page goes.

Why is cloud transcription a third-party disclosure?

When you upload a session to a transcription service, a copy now lives on that company's servers and often its suppliers' servers too. What happens next is set by its policy, not by you. Many services are careful, and a cloud tool with a signed BAA is a legitimate choice. It is still a third party.

If you are weighing a cloud service, its privacy policy and terms answer the questions that matter: whether recordings or transcripts are used to train its models, which subprocessors store them, how long they are kept, and whether it signs a BAA on the plan you would actually use. If your practice wants a cloud service with speaker labels and a BAA, that is a legitimate route; read those answers before the first session goes up.

Clients notice the difference. NPR reported on 26 May 2026 that therapists are adopting AI note tools (Therapists are using AI to take notes. Is it a useful tool or a breach of trust?). One client "wanted to understand where her words would go, whether they would stay local or be processed somewhere in the cloud," and later found a session had been recorded after she had said she was not comfortable with it. "The trust was gone," she told NPR. The same piece cites a KFF survey in which about 77% of Americans worry about how AI systems would store and use their health information.

On-device transcription removes the vendor from that conversation. It does not remove the need for the conversation.

How does ScribeKit handle session audio?

Here is exactly what the app does today.

• Transcription. The speech model ships inside the app and runs on the iPhone or iPad. ScribeKit has no transcription server, no account, no analytics and no crash reporter. You can check this yourself with the Airplane Mode test in how to check if a transcription app is really offline.
• Network use. When the phone is online, ScribeKit contacts RevenueCat when it opens or returns to the foreground to check whether you have Pro. That sends an anonymous ID and purchase history, never audio or text. It also goes online when you buy or restore Pro through Apple, and when you choose to download an optional Whisper model.
• Storage. Recordings and transcripts are stored in the app's own storage on the device. There is no ScribeKit cloud sync.
• Backups. This is the honest part. Today, that app storage is included in your iPhone's normal iCloud Backup and in backups to a computer, like most app data.

That last point matters for clinicians. Apple's iCloud terms (revised 14 September 2026) say that if you are a covered entity or business associate, you agree not to use iCloud "to create, receive, maintain or transmit any 'protected health information'" or in a way that would make Apple your business associate. Read that clause with your compliance officer.

You can keep ScribeKit out of iCloud Backup now, using iOS's own per-app setting. Apple's article Manage your iCloud storage on your Apple device gives the steps:

1. "Open the Settings app, tap your name, then tap iCloud."
2. "Tap Storage or tap Manage Account Storage."
3. "Tap Backups, then tap the name of the device that you're using."
4. "Turn off any apps that you don't want to back up." Find ScribeKit in the list.
5. "Tap Turn Off to confirm."

Apple notes that turning an app off "removes all of its information from iCloud," so any earlier ScribeKit data in that backup goes too. If you back up to a Mac or PC instead, ScribeKit's data is in that backup; Apple's page About encrypted backups explains the "Encrypt local backup" option. Apple also offers Advanced Data Protection, under which "iCloud Backup and everything inside it is end-to-end encrypted." That is Apple's feature and Apple's description; it does not change the terms quoted above.

An in-app "Exclude recordings from iCloud Backup" setting is planned for an upcoming update. Until it ships, use the steps above.

Two smaller things. Deleting a transcription moves it to a Recycle Bin, which empties itself after 30 days; deleting from the bin removes the audio file too. And ScribeKit Pro includes a Recent Transcriptions widget that shows titles and a text preview on the Home Screen and the Lock Screen, where it is visible without unlocking, so leave it off a phone you use for sessions.

How do I turn a recorded session into notes privately?

A workflow that keeps the iPhone as the only copy until you decide otherwise:

1. Prepare the phone. A strong passcode, current iOS, ScribeKit switched off in iCloud Backup as above. Airplane Mode during the session if you want certainty.
2. Get consent first. Explain what is recorded, where it is stored, how long you keep it, and that the client can say no. Record the consent the way your practice requires (see the next section).
3. Record. Recording keeps running with the screen locked, and Pause and Stop are on the Lock Screen and in the Dynamic Island. Pause for anything the client asks to keep off the record.
4. Transcribe. It happens on the phone when you stop. The built-in model covers 25 languages and detects which one is spoken. ScribeKit titles each transcription from its first words, so use Rename Title to give it something neutral.
5. Write your note. Read the transcript, tap any line to hear the audio behind it, and copy the passages you need with Copy Text or Copy Timestamped. Paste into your EHR or notes system. From that moment the EHR holds that text under its own terms.
6. Delete. Delete the transcription, then empty it from the Recycle Bin, or set Settings, Auto-delete to 7, 30 or 90 days. Auto-delete moves older items to the Recycle Bin the next time ScribeKit opens; favorites are never auto-deleted, so don't favorite session recordings.

The limits: the transcript is a record of words, not a clinical note, and every model makes mistakes with names, accents and crosstalk. Check anything you rely on against the audio. Session length matters too. The free version takes recordings up to 30 minutes and 10 new transcriptions a month; ScribeKit Pro removes the monthly limit and allows up to 3 hours, or 90 minutes while a Whisper model is active. Pro also adds Whisper models for more than 100 languages, each a one-time download. Details are on the ScribeKit page.

Do I need client consent to record a therapy session?

Your professional body and the law both have a say, and they differ by place, so this section only points you to sources.

Professional codes are usually stricter than recording law. The American Psychological Association's Ethical Principles of Psychologists and Code of Conduct, Standard 4.03, says: "Before recording the voices or images of individuals to whom they provide services, psychologists obtain permission from all such persons or their legal representatives." Counselors, social workers and therapists outside the US have their own codes; read yours, and ask your licensing board or professional association if a code is silent on AI tools.

Recording law is separate. In the US, some states let one party to a conversation consent to recording and others require everyone's consent. The Reporters Committee for Freedom of the Press keeps a Reporter's Recording Guide with "a summary of each state's laws governing the recording of phone calls and in-person conversations." It is written for journalists, but it is a clear map of the state rules. Other countries have their own laws.

Whatever the law allows, the NPR story above shows what a recording without real consent costs: the client left. Ask, explain, and accept a no.

What does ScribeKit not do?

Plainly, so you can choose something else if you need it:

• No progress notes. No SOAP or DAP notes, no summaries, no treatment plans. ScribeKit is a transcriber, not a clinical documentation tool.
• No speaker labels. It does not separate your voice from the client's. You can edit a segment to add a label.
• No live transcript. Text appears after you stop recording.
• No EHR integration. You copy text out yourself.
• No call recording. It records through the microphone and imports audio files; it does not record phone calls. Imports are audio only, not video.
• No BAA, and no compliance claim. See above.
• No Mac app and no Apple Watch app. iPhone and iPad only.

If you want a wider view of on-device options, I compared the approaches in offline transcription on iPhone. If the trade-offs above fit your practice, ScribeKit is free to try, with no account to create.