Security and HIPAA at NoteCoach ABA

Where is the data stored?

In Google Cloud Firestore, region us-east1 (South Carolina, USA), covered by Google Cloud's HIPAA Business Associate Agreement. The Assessments you upload are kept as private copies in Google Cloud Storage that only NoteCoach's server can read.

Which AI writes the notes?

Anthropic (USA), under a signed Business Associate Agreement.

Is it encrypted?

Yes: in transit (HTTPS/TLS) and at rest (Google Cloud encryption).

Who can see the data?

Each user sees only their own clients and notes; access is enforced with Firebase Authentication and database security rules. The session closes after 15 minutes without use.

Do you store patient information?

Yes. What you enter (client name or initials, diagnosis, behavior plan, session data, notes and uploaded Assessments) is stored and treated as Protected Health Information (PHI). We recommend using client initials.

How long is it kept?

While the account is active. After cancellation, client data is kept 90 days and then permanently deleted, unless you ask for earlier deletion. Backups rotate on a 28-day cycle. Payment records are kept 7 years, as US tax law requires.

Do you sign a BAA?

Yes. NoteCoach ABA signs a Business Associate Agreement with your organization on request: write to admin@workhublogistic.com.

Who else receives data?

Only the services that run NoteCoach ABA: Google Cloud (storage, under BAA), Anthropic (AI, under BAA), Google Workspace Gmail (email notifications, under BAA) and Stripe (payments; card numbers never reach NoteCoach). Data is never sold or shared for advertising.

Can I delete my data?

Yes. Ask for your account and all associated data to be deleted at admin@workhublogistic.com.

"HIPAA certified" does not exist as a certification; what matters is signed BAAs and how data is handled. You keep your own HIPAA obligations with your employer and clients. Full privacy policy: notecoach.app/privacy.html. Last reviewed 2026-10-31.