Voice notes for legal and clinical work

For attorneys, clinicians, coaches, and other regulated professionals who need to evaluate where content is processed before any AI assistance touches it. Keeping transcription on-device means recording, transcript, and search all stay on the device by default.

On your device

When to keep transcription on-device

On-device, the transcript workflow is scoped to the current device. That's a small, specific technical claim, useful when professional duty rules (privilege, confidentiality, BAA scope) require you to know exactly where content lives before you say yes to AI features.

We don't claim that on-device transcription automatically satisfies HIPAA, GDPR, attorney-client privilege, or any other regulatory requirement. Compliance depends on your facts, contracts, policies, consent practices, and jurisdiction. The on-device path gives your compliance owner a narrower technical posture to evaluate: fewer moving parts, fewer external relationships, smaller surface.

How it works on your device

1. Confirm consent and recording rules before capturing the session or consultation.
2. Keep transcription on-device for the voice note and transcript.
3. Apply the note structure your practice requires before storing or exporting.
4. Send selected passages to a BYOK provider only if your provider terms and your organization's policy allow that transfer.
5. Don't switch this workflow to a cloud provider until the cloud terms and your organization's approval cover the content type.

With your own cloud key

For attorneys, clinicians, and other regulated professionals: when you bring your own cloud provider, jotty.pro routes audio to that AI provider under a BAA, DPA, or equivalent agreement your organization holds. We're a routing layer. The agreement is between your organization and the provider you choose.

When a cloud provider is the right call

If your organization has a Business Associate Agreement (HIPAA), a Data Processing Agreement (GDPR), or the equivalent arrangement your jurisdiction requires, and that agreement is with one of the providers we support, you can route transcription and summarization to them under your key.

We're not a party to that agreement; it sits between your organization and the provider. We route requests using the key your IT or compliance team supplies. We don't provision keys, don't sign BAAs ourselves, and don't act as a Business Associate on your behalf. Transcripts land in local DuckDB on the device, and we don't store them server-side under any configuration.

We don't claim that using a cloud provider automatically satisfies HIPAA, GDPR, attorney-client privilege, or any other regulatory obligation. That call belongs to your compliance owner, who has to evaluate the provider's terms, subprocessor list, data residency, and retention policy against your obligations.

How it works with your key

1. Pick a provider whose terms include a BAA (for HIPAA-covered content), a GDPR-compliant DPA, or the equivalent for your jurisdiction.
2. Your IT or compliance team provisions the API key with that provider and pastes it into the app. We don't issue or hold enterprise keys for you.
3. Capture the note. We route the audio to that provider for transcription, and optionally summarization, under their terms.
4. Review the transcript and summary inside the app before it goes into a client file, medical record, or legal document.
5. The final transcript persists in local DuckDB on the device, where your team's retention and legal-hold procedures can pick it up.

How it compares

Honest answers

Is on-device transcription automatically compliant?

No. Compliance depends on your facts, contracts, policies, consent practices, and jurisdiction. Keeping transcription on-device is a technical workflow your compliance owner can evaluate; it doesn't make the decision for you.

Can I use BYOK for summaries?

Only if your provider terms and internal policies permit sending that content to an external AI provider. The transfer is your decision, governed by your provider relationship. We give you the option; the call is yours.

When should I avoid sending this work to a cloud provider?

Avoid cloud providers for legal, clinical, or regulated content until your compliance owner has reviewed and approved the cloud terms (retention, deletion, processing, subprocessors) for that content type.

Is this app HIPAA-compliant when I use a cloud provider?

No, and we don't claim it is. We're a routing layer: we send audio to the provider your organization picks and store the transcript locally. We don't sign BAAs, don't store transcripts server-side, and don't act as a Business Associate. HIPAA coverage depends entirely on the BAA you hold with the chosen provider and on how your organization manages the key and the local DuckDB store.

Which providers can carry a BAA?

We support nine providers for cloud calls: OpenAI, Groq, Deepgram, HuggingFace, Ollama, X.AI, Google, Mistral, and DeepSeek. BAA availability varies by provider and account tier. Your compliance or legal team should confirm with the provider directly whether a BAA is available for the account type you use and which services it covers.

Where do transcripts ultimately live for legal hold?

Locally, in DuckDB on the device, no matter which provider you use. We don't transmit or retain transcripts server-side. Your legal-hold and records-retention workflows operate on that local DuckDB store. Your IT or records management team decides how to include it in litigation hold, export, or archival.