Privacy Policy

This Privacy Policy describes how Notes ("we," "us," or "the Platform") collects, uses, and safeguards information when behavioral health practices and their clients use our EHR and practice management software.

1. Information we collect

We collect account information from practices and providers (such as name, contact details, and license information), and protected health information (PHI) entered by practices to document and manage client care, including scheduling data, clinical notes, billing records, and messages exchanged through the secure portal.

2. How we use information

Information is used solely to provide, maintain, and improve the Notes platform on behalf of the practices we serve — including scheduling, documentation, claims submission, telehealth delivery, and client communication. We do not sell PHI or use it for advertising purposes.

3. HIPAA & Business Associate Agreements

Notes operates as a Business Associate under HIPAA for the practices that use our platform to store or transmit PHI. A signed Business Associate Agreement (BAA) is provided automatically with every account, outlining our shared responsibilities for safeguarding client information.

4. Data security

Data is encrypted in transit and at rest. Access to PHI is restricted by role-based permissions, and all access is logged for audit purposes. Infrastructure is hosted with US-based providers that maintain healthcare-grade security controls.

5. Data retention & deletion

Practices control retention of their clinical records in line with applicable state and licensing board requirements. Upon account closure, practices may export their data, after which records are retained or deleted according to the timelines specified in the practice's service agreement.

6. Your rights

Clients of a practice using Notes should direct requests about their personal health information to their provider or practice, who controls that data as the HIPAA Covered Entity. Practices may contact us directly regarding their account information.

7. Contact us

Questions about this policy can be sent to [email protected].