Privacy Policy

This Privacy Policy explains how Notenra Medical Intelligence, Inc. (“NOTENRA”, “we”, “us”) collects and handles information through our website at notenra.com and our clinical documentation, coding, billing, and payroll services (the “Services”).

This policy therefore covers two groups: visitors to our website, and the administrators and clinicians who hold accounts with the Services. Section 4 explains separately, and for transparency only, how we handle PHI under our provider agreements.

We do not purchase personal information from data brokers, and we do not collect sensitive personal information about website visitors beyond what is listed above.

We use the information described above for the following purposes, and not for unrelated purposes without telling you first:

• To provide, maintain, and support the Services for your practice
• To authenticate users and enforce role-based access controls
• To respond to demo requests, sales enquiries, and support tickets
• To maintain audit logs required for security and compliance
• To monitor service performance, diagnose faults, and prevent abuse
• To invoice your practice and administer your subscription
• To send service and security notices relevant to your account
• To comply with legal obligations and enforce our agreements

Marketing communications

We send marketing email only to business contacts who requested information or whose practice has a relationship with us. Every marketing message includes an unsubscribe link, and unsubscribing does not affect service or security notices that we must send you as an account holder.

When a healthcare provider uses the Services, NOTENRA acts as a Business Associate under the Health Insurance Portability and Accountability Act. We execute a Business Associate Agreement with every practice before any PHI is processed, and that agreement — not this policy — defines our permitted uses and disclosures of PHI.

Our commitments regarding PHI

• We use and disclose PHI only as permitted by the applicable Business Associate Agreement and by law
• We apply the minimum necessary standard to every use and disclosure
• We do not use PHI to train third-party or shared foundation models
• We do not sell PHI under any circumstances
• Encounter audio is processed to produce the clinical note and is then discarded
• Access to PHI is role-restricted and recorded in immutable audit logs
• We notify the affected practice of any breach of unsecured PHI in accordance with the HIPAA Breach Notification Rule and the terms of the applicable agreement

The Services use automated systems to draft clinical documentation and propose codes, followed by review from qualified human reviewers. We want to be precise about what that means for privacy:

• Automated drafting operates on the clinical content of an encounter to produce a draft for review
• Human reviewers are personnel or contracted professionals bound by confidentiality obligations and trained on HIPAA requirements
• Reviewers access only the encounters assigned to them, and every access is logged
• The reviewing clinician or coder does not make treatment decisions; the responsible clinician retains authority over the final record
• No automated decision is made about a patient that produces a legal effect without human involvement
• Patient data is not used to train third-party or shared models, and we do not permit our model providers to retain it for their own purposes

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We disclose information only in these circumstances:

A current list of subprocessors that may handle PHI is available to customers on request at privacy@notenra.com.

We maintain administrative, technical, and physical safeguards appropriate to the sensitivity of the data we handle, including:

• Encryption in transit using TLS 1.3 and at rest using AES-256
• Role-based access control with least-privilege provisioning
• Immutable audit logging of access to clinical data
• SOC 2 Type II audited controls
• Background screening and confidentiality obligations for personnel with data access
• Documented incident response and breach notification procedures

No system is perfectly secure. We cannot guarantee absolute security, but we commit to notifying affected practices promptly where a breach occurs, in accordance with HIPAA and applicable state law.

Retention depends on the category of data and on the obligations attached to it:

Depending on where you live, you may have the right to request access to the personal information we hold about you, to correct inaccuracies, to request deletion, to obtain a portable copy, and to appeal a refusal of any of these requests.

For residents of California and other US states with privacy statutes

We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing to opt out of in those categories. You may still exercise access, correction, deletion, and portability rights, and we will not discriminate against you for doing so. You may use an authorised agent, and we will verify the request before acting on it.

How to make a request

Email privacy@notenra.com with the nature of your request. We will acknowledge within the period required by applicable law and will verify your identity before disclosing or deleting anything. Note that information held as PHI on behalf of a provider must be requested through that provider.

Our website uses cookies and similar technologies that are strictly necessary for the site to function, together with analytics that help us understand how the site is used.

• Essential cookies maintain your session and security state and cannot be disabled
• Analytics cookies help us measure traffic and improve the site
• We do not use third-party advertising or cross-site tracking cookies
• Your browser can block or delete cookies, though essential cookies are required for the Services to work

We honour Global Privacy Control signals where our systems receive them. Cookies are never used inside the authenticated clinical application to profile patients.

The Services are operated from the United States, and information is processed and stored there. If you access the Services from another country, you are transferring information to the United States, where data protection law differs from that of your own jurisdiction.

The Services are provided to healthcare organisations and their personnel, and our website is not directed at children. We do not knowingly collect personal information directly from children through the website.

Clinical records processed on behalf of a provider may relate to patients of any age, including minors. That information is handled as PHI under the applicable Business Associate Agreement and under HIPAA, together with any additional protections that state law affords to minors' records.

We may update this policy as the Services or the law change. When we do, we will revise the “last updated” date at the top of this page. Where a change materially reduces your rights or expands our use of personal information, we will give notice through the Services or by email before it takes effect.

Changes to our handling of PHI are governed by the amendment provisions of the applicable Business Associate Agreement, not by this notice.

For privacy questions, requests, or complaints about how we handle information, contact us at:

• Privacy enquiries and rights requests: privacy@notenra.com
• Security and incident reports: security@notenra.com
• General enquiries: hello@notenra.com
• Postal address: Notenra Medical Intelligence, Inc., [STREET ADDRESS], [CITY, STATE ZIP]

If you are not satisfied with our response, you may have the right to complain to your local data protection authority or, for HIPAA matters, to the US Department of Health and Human Services Office for Civil Rights.