Draft clean SOAP notes from quick visit bullets.

Privacy and data protection

Last updated: November 2025

Protecting patient privacy and sensitive health information is central to the design of NoteyDoc. This page explains, in plain language, how information is handled by the NoteyDoc browser extension and related web services. It is provided for transparency and is not a substitute for legal advice.

1. What NoteyDoc is designed to do

NoteyDoc is a documentation assistant that helps clinicians turn their own words into more structured clinical notes. In everyday use:

• Clinicians type or paste their own fragments, bullet points, or descriptions into NoteyDoc.
• NoteyDoc uses machine learning language models to process that input and return suggested wording or structure.
• The clinician reviews, edits, and copies final text into their EMR or documentation system.

NoteyDoc does not make medical diagnoses, select billing codes, or automatically submit documentation to payers or EMR systems.

2. Categories of information that may be processed

Depending on how you use the tool, the following categories of information may be entered into NoteyDoc:

• Free text clinical fragments describing a visit, intervention, or patient status.
• Non identifying context such as discipline (OT, PT, SLP), setting, and visit type.
• Custom phrase libraries or note templates you define within the extension.

Because free text fragments may sometimes contain protected health information or personally identifiable information, it is critical that you use NoteyDoc in a way that is consistent with your local regulations and your organization’s data handling policies.

3. Information you are encouraged not to include

To reduce privacy risk, avoid entering directly identifying patient details into NoteyDoc unless and until a documented Business Associate Agreement or equivalent arrangement is in place and you have authorization from your organization. Examples include:

• Full legal names, initials with other identifiers, or contact information.
• Exact dates of birth, full addresses, phone numbers, email addresses, or insurance IDs.
• Medical record numbers or any facility specific patient ID that could identify an individual.
• Highly specific details that, in combination, uniquely identify a patient.

4. How processing occurs (local and cloud)

The NoteyDoc extension is developed with a focus on minimizing the amount of information that leaves your browser. Some advanced features, such as AI assisted drafting, involve sending your input to secure cloud based processing services.

The general architecture is:

• Local operations: Where possible, settings, preferences, and non sensitive configuration are stored locally in the browser.
• Cloud processing: When AI models are used to suggest language, your input is transmitted to a secure server or third party AI provider solely to generate that output. These providers use language models to turn your text into draft wording.

NoteyDoc is configured so that data sent to AI providers is not used to train public models where such controls are available. Before enabling AI assisted features in a production environment, confirm which vendors are used, where data is processed, and whether those vendors are covered under a Business Associate Agreement or other required agreements.

5. Intended data retention practices

The goal of NoteyDoc is to retain the minimum amount of information needed to provide the service. The core principles are:

• No permanent storage of note content for drafting purposes unless you explicitly enable it, for example an optional phrase library you choose to save.
• Short lived processing: Draft text sent to AI services is processed in real time and is not used to train public models where that control is available.
• User controlled libraries: Any saved templates or custom phrasing are associated with your account or browser profile and can be edited or deleted by you.

Exact retention periods, if any, will be documented clearly as hosted service components are finalized. Until then, treat NoteyDoc as a drafting helper and continue to rely on your EMR as the system of record.

6. Legal basis for processing (where applicable)

If you are located in a region with comprehensive data protection laws, the legal basis for processing your personal data as a clinician may include:

• Legitimate interests in providing and improving a documentation support tool for clinicians.
• Contractual necessity where you have entered into an agreement to use the service.
• Consent for specific optional features, such as email updates or saving reusable phrase libraries tied to an account.

Where protected health information or other sensitive patient data is involved, additional agreements and strict organizational policies apply. You remain responsible for complying with those requirements.

7. Security measures

NoteyDoc uses industry standard security measures, such as:

• Transport Layer Security for communications between the extension and backend services.
• Restricted access to production systems and logs on a need to know basis.
• Separation of development and production environments.
• Use of reputable hosting providers with strong physical and logical security controls.

No security measure is perfect and no online service can guarantee absolute security, but security is treated as a core requirement.

8. Use of analytics and cookies

NoteyDoc may use limited, privacy respecting analytics to understand how the extension is used, for example how often certain buttons are clicked, so that features can improve over time. Where possible, analytics:

• Avoid collecting directly identifying personal information.
• Use aggregated or pseudonymous identifiers instead of real names or email addresses.
• Are configurable or allow opt out where supported by the platform.

If cookies or similar technologies are used on the website, a clear notice and explanation is provided.

9. Your responsibilities as a clinician or user

While NoteyDoc aims to support compliant documentation, you are ultimately responsible for:

• Ensuring that your use of the tool complies with local laws, regulations, and employer policies.
• Reviewing and editing all drafted content before it becomes part of the legal medical record.
• Avoiding the inclusion of unnecessary identifiers or highly sensitive details when using drafting tools.
• Securing your devices, browsers, and user accounts with appropriate access controls.

10. Third party services and model providers

NoteyDoc may rely on third party infrastructure or model providers, for example cloud hosting or AI text generation APIs. When such services are used:

• They are selected with an emphasis on security, reliability, and reputation.
• Efforts are made to ensure that data is not used to train public models without explicit consent.
• Where required, appropriate data processing agreements are put in place.

You should periodically review this page to understand which providers are in use and how they handle data.

11. International transfers

Depending on your location and the location of the hosting infrastructure, information that you submit to NoteyDoc may be processed in a different country. When information crosses borders, reasonable steps are taken to ensure that it is protected in line with applicable legal requirements.

12. Your rights and choices

Subject to your local laws, you may have rights such as:

• Accessing information about the personal data NoteyDoc holds about you as a user.
• Requesting corrections to inaccurate account information.
• Requesting deletion of stored user level data, for example saved phrase libraries, where technically feasible.
• Opting out of non essential communications or analytics.

Because NoteyDoc is not intended to store complete medical records or act as a system of record, these rights relate to your user account or configuration, not the underlying clinical charts maintained by your employer or EMR vendor.

13. How to contact the NoteyDoc team

If you have questions about this page, data handling, or privacy in general, you can contact the NoteyDoc developer at:

Email: contact@noteydoc.com

This privacy and data protection overview is updated as the product matures. Significant changes are reflected by updating the “Last updated” date at the top of this section.