AutoNotes Client App — Privacy Policy
Effective date: October 20, 2026 · Last updated: October 20, 2026
1. Who we are and what this policy covers
This Privacy Policy explains how AutoNotes AI LLC (“AutoNotes”, “we”, “us”) handles your information when you use the AutoNotes client app on iOS, Android or the web (the “App”). You use the App because a therapist, counselor, clinician or practice (your “Provider”) invited you to it.
The App lets you book and manage sessions, join video sessions, complete and sign forms, and message your Provider securely. This policy covers clients only. Providers are covered by our separate Application Privacy Policy and agreements. Visitors to our website are covered by our Website Privacy Notice.
Your Provider controls your health information
Your Provider decides what information to collect about you, what to keep in your chart, and how long to keep it. For health information covered by the U.S. Health Insurance Portability and Accountability Act (HIPAA), your Provider is the covered entity and AutoNotes is its business associate. We sign a Business Associate Agreement (BAA) with every Provider who uses the App with protected health information (PHI).
In Canada, your Provider is the health information custodian or organization accountable for your information under PHIPA or PIPEDA, and AutoNotes acts as its agent or service provider. Where the GDPR or UK GDPR applies, your Provider is the controller and AutoNotes is the processor.
This means we use your health information only to provide the App to your Provider and to you, as their agreement with us allows. Your Provider’s own Notice of Privacy Practices also applies to you. Questions about your records, such as corrections or copies, usually go to your Provider first.
For a small set of information we handle for our own purposes, such as account security logs and your sign-in details, AutoNotes is responsible as the business that runs the App. Section 4 explains which is which.
2. Information we collect
We collect only what the App needs to work. We do not use advertising SDKs or third-party analytics in the App, and we do not track you across other apps or websites.
| Category | Examples | Where it comes from |
|---|---|---|
| Account details | Name, email address, the practice or practices you belong to, password (stored only as a secure hash) | Your Provider’s invitation, and you when you sign up |
| Sign-in details | One-time email codes, Google account email and name if you choose Sign in with Google, sign-in tokens | You and Google |
| Appointments | Upcoming and past sessions, booking requests, cancellations, the service and provider you chose | You and your Provider |
| Forms and documents | Intake forms, questionnaires, consent forms, your answers, drafts and hand-drawn signatures | You |
| Messages | Messages you send and receive, photos and files you attach, read receipts and typing status | You and your Provider |
| Video sessions | Live audio and video during a session, in-session chat, and your answer to a recording consent request | You |
| Session recordings and notes | Recordings, transcripts and clinical notes, if your Provider records a session and you agree | Your Provider, with your consent |
| Device information | A random device ID, device name and model, operating system, push notification token, last time the device was used | Your device |
| Security logs | IP address, date and time, and the action taken (for example sign-in, sign-out, message sent, form submitted, session joined) | Your device and our servers |
| Support requests | What you tell us when you contact us | You |
We also hold the chart information your Provider keeps about you in AutoNotes, such as clinical notes and treatment plans. The App does not show you that information unless your Provider shares it.
Face ID, Touch ID and fingerprint lock
You can turn on an optional app lock in Settings. When it is on, the App asks you to unlock with Face ID, Touch ID, fingerprint or your device passcode whenever you return to it.
We never receive your biometric data. The check is done entirely by your phone’s operating system (Apple’s Secure Enclave or Android’s Biometric framework). The App only gets a yes or no answer back. Your face or fingerprint data never leaves your device and is never sent to AutoNotes, your Provider or anyone else. We do not collect, store or process biometric identifiers or biometric information.
The on/off setting for the lock is stored only on your device. You can turn the lock off at any time in Settings.
Device permissions
The App asks for permission before it uses these features of your device. You can change them any time in your device settings.
| Permission | Why we ask |
|---|---|
| Camera and microphone | To join video sessions with your Provider |
| Photos | To attach photos to messages, or save photos you receive |
| Calendar | To add a session to your calendar when you ask |
| Notifications | To tell you about new messages, sessions and forms |
| Face ID or fingerprint | To unlock the App, if you turn on the app lock |
The App does not access your location or contacts.
Information stored on your device
If you choose “Keep me signed in”, your sign-in tokens and basic account details are stored in your device’s secure storage (the iOS Keychain or Android Keystore). Otherwise they are kept only in memory and cleared when you close the App. Your theme and app lock settings are stored on the device. Calendar files and photos you save or share are placed briefly in the App’s temporary cache. Signing out removes your sign-in tokens from the device.
3. How we use your information
We use your information to:
- create and secure your account, sign you in and keep you signed in
- show your sessions, handle booking requests and cancellations, and add sessions to your calendar when you ask
- run video sessions and, only if you consent, let your Provider record them
- deliver your forms, save your drafts and send your answers and signatures to your Provider
- deliver messages and attachments between you and your Provider
- send push notifications and emails about messages, sessions, forms and your account
- protect the App, prevent fraud and misuse, and investigate security incidents
- fix problems and keep the App reliable
- meet our legal obligations and enforce our Terms of Use
Session recordings and AI documentation
Your Provider may ask to record a video session to help with their clinical notes. Before recording, the App asks for your consent. If you decline, recording stops for that session. Your Provider may also ask for your consent outside the App.
If you agree, the recording is stored securely and may be transcribed and summarized with AI tools so that your Provider can write their notes. Your Provider reviews and is responsible for those notes. AI output is not shown to you in the App and is not used to make decisions about you without your Provider’s review.
What we do not do
- We do not sell or rent your personal information, and we do not share it for targeted or cross-context behavioral advertising.
- We do not use your information to train AI models. Our AI providers are contractually prohibited from training on or keeping your information. We would use de-identified data for product improvement only with explicit permission, as HIPAA and your Provider’s agreement allow.
- We do not use your health information for marketing.
Legal bases (EEA, UK and Switzerland)
Where the GDPR or UK GDPR applies, we process your information on your Provider’s instructions. Your Provider’s legal basis for processing health information is usually the provision of health or social care, or your explicit consent. For our own processing, such as account security and service reliability, we rely on our legitimate interests in running a safe and reliable App, and on legal obligations where they apply.
4. How we share your information
We share your information only in these cases:
- With your Provider and their practice. Everything you submit in the App, including forms, signatures, messages, attachments, booking requests and recording consent, goes to your Provider and becomes part of your record with them. Messages are private between you and the provider you are messaging. Other providers at the practice who can see your chart have separate conversations with you.
- With our service providers (subprocessors). They process information only on our instructions, under contracts that require confidentiality and security, and under BAAs where they handle PHI.
- For legal reasons. We disclose information when required by law, subpoena, court order or other legal process, or to protect someone’s life or safety. Where the law allows, we tell your Provider first.
- In a business transfer. IfAutoNotes is involved in a merger, acquisition or sale of assets, your information may transfer under the same protections described here and in our BAAs.
Subprocessors
| Service provider | What it does for the App |
|---|---|
| Google Cloud | Hosting, databases, file storage and session recording storage (United States) |
| Cloudflare | Network security and content delivery |
| LiveKit | Real-time video and audio for sessions, and recording when you consent |
| Deepgram | Transcription of recorded sessions for your Provider |
| OpenAI | AI-assisted drafting of your Provider’s clinical notes |
| Twilio (SendGrid) | Sign-in codes, invitations and notification emails |
| Expo, Apple Push Notification service and Google Firebase Cloud Messaging | Push notification delivery and App updates |
| Google Sign-In | Signing in with your Google account, if you choose to |
| Sentry | Server error monitoring |
| Intercom | Customer support |
Our current subprocessor list is in our Trust Center.
Push notifications
Push notifications contain no health information. They never include your Provider’s or practice’s name, message text, attachment or form names, or anything your Provider writes. They only say that something is waiting for you, for example “You have a new secure message” or “Your session has been updated”. Notifications pass through Expo and Apple’s or Google’s notification services, which receive only this text and an internal reference the App uses to open the right screen. You see the details only after you open the App and sign in.
5. How we protect your information
We use administrative, technical and physical safeguards in line with HIPAA and PHIPA. These include:
- encryption in transit with TLS 1.2 or higher, and encryption at rest with AES-256
- data hosted in the United States, with regular encrypted backups and tested restores
- role-based access, least privilege, multi-factor authentication for our staff, and audit logs
- continuous monitoring, vulnerability management and regular penetration testing
- on your device: secure storage for sign-in tokens, and an optional Face ID or fingerprint lock
No system is perfectly secure. Keep your device passcode private, turn on the app lock, and sign out on shared devices. If a breach affects your information, we will notify your Provider and, where the law requires, you and regulators.
6. How long we keep your information
| Information | How long we keep it |
|---|---|
| Chart information: forms, signatures, messages, attachments, appointments, recordings, transcripts and notes | As long as your Provider keeps it under their retention settings and their legal record-keeping duties. When your Provider deletes it or ends their AutoNotes account, we delete or return it as their BAA requires. |
| Live audio and video | Not stored unless the session is recorded with your consent |
| Your client account and sign-in details | While your account is active. We delete them within 30 days after your account is closed, unless your Provider still needs your chart. |
| Device records and push tokens | Until you sign out, revoke the device, or close your account |
| Security logs | 7 years, to meet HIPAA audit and record-keeping requirements |
| Backups | Overwritten on a rolling schedule of up to 30 days |
7. International transfers
We store and process information in the United States. If you use the App from Canada, the EEA, the UK, Switzerland or elsewhere, your information is transferred to the United States, where privacy laws may differ. Where required, we protect those transfers with safeguards such as the European Commission’s Standard Contractual Clauses and the UK Addendum, along with the security measures above. While your information is in the United States, U.S. courts and authorities may be able to access it under U.S. law.
8. Your rights and choices
Depending on where you live, you may have the right to:
- access your information and get a copy of it
- correct information that is wrong or incomplete
- delete your information, subject to your Provider’s legal duty to keep health records
- restrict or object to some processing
- receive your information in a portable format
- withdraw consent, for example to session recording, without affecting processing that already happened
- receive an accounting of certain disclosures of your health information, under HIPAA
- complain to a regulator, such as the U.S. Department of Health and Human Services Office for Civil Rights, the Office of the Privacy Commissioner of Canada or your provincial commissioner, or your local data protection authority
How to make a request. Your Provider controls your health records, so send requests about chart information to your Provider. If you send them to us, we will pass them to your Provider and help them respond. For your client account, sign-in details and security logs, email privacy@autonotes.ai.
We verify your identity before acting on a request. We respond within 30 days, or sooner where the law requires, and we do not charge for reasonable requests. You can use an authorized agent where the law allows. We will not treat you differently for using your rights.
Deleting your account. To delete your client account, email support@autonotes.ai from the email address linked to your account, as described on our account deletion page. We use that address to verify your identity before we act. Deleting your account stops your access to the App and removes your client account and sign-in details as Section 6 describes. Your Provider may still need to keep the records you shared with them, as health record laws require.
Other choices. You can turn off notifications, the app lock, and camera, microphone, photo or calendar access in your device settings. You can decline session recording at any time. Signing out removes your sign-in details from the device.
U.S. state privacy rights
Residents of California and other U.S. states with privacy laws may have the rights listed above. Most information in the App is health information covered by HIPAA, which is exempt from many of those laws. We do not sell or share personal information as those laws define it. We do not use or disclose sensitive personal information except to provide the App. Where consumer health data laws such as Washington’s My Health My Data Act apply, you can use the rights they give you through the contacts in Section 11.
9. Children
The App is for people aged 13 and older. Clients aged 13 to 17 may use the App only if their Provider approves it and either a parent or legal guardian consents or local law lets them consent to their own care. Children under 13 may not have their own account, but a parent or legal guardian may use the App for them. A minor’s parent or guardian may have rights to the minor’s records, as the law and the Provider’s policies allow. We do not knowingly collect information from children under 13 without verified parental consent. If you believe we have, contact privacy@autonotes.ai and we will work with the Provider to address it.
10. Changes to this policy
We may update this policy as the App or the law changes. We will post the new version with a new “Last updated” date. For material changes, we will notify you in the App or by email before the change takes effect.
11. Contact us
AutoNotes AI LLC 639 E Ocean Avenue #303 Boynton Beach, FL 33435, United States
- Privacy Officer: privacy@autonotes.ai
- Support: support@autonotes.ai
- Phone: 866-397-9835
- Trust Center: autonotes.ai/trust-center
For questions about your care or your records, contact your Provider directly. The App is not for emergencies. If you are in crisis, call or text 988 in the U.S. or Canada, call 911, or contact your local emergency services.
