ClinicNote ("ClinicNote," "we," "us," or "our") provides ambient documentation software for healthcare practices. This Privacy Policy explains what information we collect, how we use it, and the choices you have — including how we handle Protected Health Information (PHI) on behalf of the covered entities and practices we serve.
1. Information we collect
We collect information in three broad categories:
- Account information. Name, email, username, role, specialty, organization, and billing details you provide when you register.
- Encounter data. Audio recordings, transcripts, generated notes, and coding suggestions created during a patient visit. This data may constitute Protected Health Information (PHI) under HIPAA and is treated accordingly — see Section 3.
- Usage data. Log data, device information, and product analytics that help us operate and improve the service (e.g. session duration, feature usage, error reports).
2. How we use information
- To provide the core service: transcription, note generation, and coding suggestions.
- To operate your account, process billing, and provide customer support.
- To monitor system health, detect abuse, and improve model accuracy using de-identified data.
- To send service notifications (e.g. note ready, billing, security alerts).
We do not sell personal information or PHI, and we do not use PHI to train third-party AI models outside of the processing infrastructure covered by our Business Associate Agreement.
3. Protected Health Information & HIPAA
Where ClinicNote processes PHI on behalf of a covered entity or business associate, we act as a Business Associate under HIPAA and enter into a Business Associate Agreement (BAA) with that customer. PHI is:
- Encrypted at rest (AES-256, field-level) and in transit (TLS 1.2+).
- Accessible only to authorized personnel and systems on a need-to-know basis.
- Logged for every view, edit, and export, creating a complete audit trail.
- Deleted from audio processing immediately after note generation when Zero Data Retention is enabled on the account.
4. Data retention & deletion
Encounter data is retained for as long as your account is active, or as required by your organization's medical record retention policy, whichever is longer. You may request deletion of your account and associated data by contacting us at the address below, subject to any retention obligations under applicable law.
5. Cookies & similar technologies
We use strictly necessary cookies to keep you signed in and remember your preferences, and optional analytics cookies to understand product usage. You can accept or decline optional cookies from the consent banner shown on your first visit, and change your choice at any time by clearing your browser's local storage for this site.
6. Subprocessors & third parties
We use a limited set of infrastructure and payment subprocessors (cloud hosting, transcription compute, and payment processing) who are contractually bound to the same data protection standards described in this policy. A current subprocessor list is available on request.
7. Your rights & choices
Depending on your location, you may have the right to:
- Access, correct, or export your personal information.
- Request deletion of your account and associated data.
- Withdraw consent for optional data processing, such as analytics cookies.
- Object to certain processing or request that we restrict it.
To exercise any of these rights, contact us using the details in Section 10.
8. Children's privacy
ClinicNote is intended for use by licensed healthcare professionals and staff. It is not directed at children, and we do not knowingly collect personal information from anyone under 18.
9. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced by email or an in-app notice before they take effect. The "Last updated" date at the top of this page reflects the most recent revision.
10. Contact us
Questions about this policy or your data can be sent to privacy@clinicnote.com. For details on our security practices, see our Security page.