Privacy Policy

1. Introduction

Notermed ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our medical transcription and documentation platform.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide when using our services, including:

• Name and contact information (email, phone number)
• Professional credentials and practice information
• Account login credentials
• Billing and payment information

2.2 Protected Health Information (PHI)

In the course of providing our services, we process Protected Health Information on behalf of healthcare providers. This includes:

• Audio recordings of patient-provider conversations
• Transcriptions of medical consultations
• Generated clinical notes and documentation
• Patient demographic information

2.3 Usage Information

We automatically collect certain information when you use our platform:

• Device information and browser type
• IP address and location data
• Usage patterns and feature interactions
• Performance and error data

3. How We Use Your Information

We use the information we collect for the following purposes:

• To provide and maintain our transcription and documentation services
• To process and complete transactions
• To improve our service — using aggregate usage patterns only. Patient health information (recordings, transcripts, and notes) is never used to train AI models — ours or anyone else's.
• To communicate with you about your account and our services
• To comply with legal obligations and enforce our agreements

4. Data Security

We implement comprehensive security measures to protect your information:

• TLS encryption for all data transmission
• AES-256 encryption for data at rest
• Role-based access controls, isolated per clinic
• Audit logging of every access to patient data
• All patient data hosted in United States AWS regions under a Business Associate Addendum

5. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations. Specifically:

• Account information: Retained while your account is active
• Audio recordings: Retained under your clinic's retention policy and deleted at your clinic's direction
• Clinical notes: Retained according to your organization's policies
• Access audit records: Retained for the life of the account to support HIPAA audit requirements (these record who accessed what and when — never patient data itself)

6. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

• Right to access your personal information
• Right to correct inaccurate information
• Right to delete your information (medical records are deleted at your healthcare provider's direction, consistent with their legal retention obligations)
• Right to data portability
• Right to opt out of marketing communications

7. Third-Party Services

Patient health information is shared with exactly one service provider: Amazon Web Services, which hosts our platform in US regions under an executed HIPAA Business Associate Addendum. No other third party has access to patient data. Non-PHI operational providers (such as payment processing) are bound by confidentiality agreements.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

9. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at: