Privacy Policy

Effective date: April 23, 2026  ·  Last updated: October 1, 2026

NoteCoach ("we", "us", "our") is a clinical documentation tool for behavior health professionals (RBTs, BCBAs, BCaBAs). This policy explains what data we collect, how we use it, and how we protect it.

1. Information We Collect

• Account information: name, email, professional credential (RBT/BCBA/BCaBA), license number if provided, role, subscription tier.
• Client-related data you enter: client initials, diagnosis, behavior plans, intervention data, session notes, and uploaded Assessment PDFs. We treat all of this as Protected Health Information (PHI) under HIPAA.
• Usage data: timestamps of actions, note counts, feature interactions, device/browser info for security and analytics.
• Payment data: handled entirely by Stripe. We do not store credit card numbers.

2. How We Use It

• To provide the note generation service.
• To enforce subscription limits and prevent abuse.
• To improve product features (aggregated, anonymized metrics only).
• To respond to support requests.
• To comply with legal obligations.

We do not sell, rent, or share your data with third parties for marketing purposes.

3. AI Processing

When you generate a note, read an Assessment, or use Nova or NoteCoach Audit, the data needed is sent to Anthropic's Claude API for AI assistance. Your content is not used to train models. Anthropic keeps requests and responses only as its commercial terms allow and under the BAA described below.

4. Where Your Data Lives

• Firestore (Google Cloud, us-east1, South Carolina, USA) — client records, session notes, user accounts. Covered by Google Cloud's HIPAA BAA.
• Google Cloud Storage — private copies of the Assessments you upload (readable only by our server) and backups.
• Stripe (USA) — payment processing.
• Google Workspace Gmail — outbound emails.
• Anthropic (USA) — AI processing, covered by BAA.

5. Security Measures

• Data encrypted in transit (HTTPS/TLS) and at rest (Google Cloud encryption).
• Access controlled per-user via Firebase Authentication.
• Firestore security rules enforce that users can only access their own data.
• Admin access limited to a single account with audit logging.
• Point-in-time recovery (7 days) and scheduled backups (daily 7d + weekly 28d) enabled.

6. Your Rights

You can request at any time:

• A copy of your data (export).
• Deletion of your account and associated records (subject to legal retention requirements).
• Correction of inaccurate information.
• Withdrawal of consent for non-essential processing.

Send requests to admin@workhublogistic.com. We respond within 30 days.

7. Data Retention

• Active accounts: data retained while the account is active.
• Cancelled accounts: client data retained for 90 days then permanently deleted, unless you request earlier deletion.
• Backups: rotated on a 28-day cycle.
• Payment records: retained 7 years per US tax law.

8. Children's Privacy

NoteCoach is a professional tool for credentialed clinicians. We do not knowingly collect information from individuals under 18.

9. HIPAA-Protected Information

If you enter PHI into NoteCoach (any data that identifies a client receiving treatment), you remain the Covered Entity under HIPAA. NoteCoach acts as a Business Associate and in turn has signed BAAs with Google Cloud (storage) and Anthropic (the AI). Use of the service for PHI should be backed by our Business Associate Agreement (BAA), available on request.

10. Changes to This Policy

We will notify users by email at least 30 days before material changes take effect. Continued use of the service after the effective date constitutes acceptance.