WellNotes

Privacy Policy

Last updated:

1. Information We Collect

WellNotes AI ("we", "us", "our") collects the following information when you use our service:

  • Account information: Email address and password (hashed) when you create an account.
  • Clinical notes: Session notes and generated documentation you save within WellNotes. Saved notes are stored only in the web browser you use (browser storage on your device). They are not stored on, synced with, or backed up on our servers, and they are not available from other browsers or devices.
  • Content you submit for processing: The session text you enter is sent to our servers to generate your note, and audio you record or upload for voice dictation is sent to our servers to be transcribed. If you select a client when generating a note, short excerpts (such as the Assessment and Plan) from up to three of that client's earlier notes saved in your browser are also sent, so the new note reflects session history. This content is used only to return your note or transcript and is not stored on our servers.
  • Custom templates: The name and the free-text generation instructions (up to 2,000 characters) of each custom note template you create are stored with your account on our servers. Please do not include client names or other client-identifying information in template names or instructions.
  • Payment information: Billing details processed securely through Stripe. We do not store credit card numbers.
  • Usage data: Analytics on marketing pages and on the checkout steps (to measure sign-ups). No analytics events are sent from the notes, account or dashboard pages.

2. How We Use Your Information

  • To provide and maintain our clinical documentation service
  • To process your subscription payments
  • To generate AI-assisted clinical notes based on your input
  • To improve our service through anonymous, aggregated usage patterns
  • To send essential account communications (password resets, billing alerts)

3. Data Security & Privacy

WellNotes AI is designed with data security and privacy as core priorities:

  • Typed clinical note content is automatically sanitized to remove personally identifiable information (PII) before AI processing. Voice recordings are sent for transcription as audio, and the resulting transcript is sanitized before it is returned to you.
  • We do not log, track, or analyze the content of your clinical notes.
  • Analytics scripts do not load when you open the notes or account pages directly, Meta's automatic event collection is disabled, and no analytics events are sent from the notes, account or dashboard pages. If you arrive from our marketing pages, those scripts stay loaded in your browser tab but send no events from your notes.
  • All data is encrypted in transit (TLS). Data stored on our servers is encrypted at rest.
  • Notes are stored only in your browser on your device. There is no cloud sync or cloud backup of your notes. Notes in your browser are protected by your device and browser security, so we recommend using a password-protected device.

4. Data Sharing

We do not sell, rent, or share your personal information or clinical data with third parties, except:

  • Stripe: For payment processing only.
  • OpenAI: Sanitized clinical content is sent for AI note generation, and voice recordings are sent for transcription. Content is not used to train OpenAI models per our data processing agreement.
  • Supabase: Our cloud infrastructure provider for authentication, account and subscription data, and the server functions that generate notes and transcripts. Your saved notes are not stored with Supabase.
  • Legal requirements: If required by law, subpoena, or court order.

5. Data Retention

Your saved notes are kept only in your browser. We do not hold a copy of your notes on our servers, so we cannot restore notes once they have been removed from your browser.

To protect clinical information on shared devices, every note stored in your browser for your account is permanently deleted when:

  • You log out.
  • You are signed out automatically after 15 minutes of inactivity (a 60-second warning is shown first).
  • Your login session ends while WellNotes is open, for example if it expires.

You can also choose to have older notes removed automatically. In Account settings, "Auto-clear notes older than 24 hours" is off by default. When you turn it on, any saved note that has not been edited in the last 24 hours is permanently deleted from your browser. WellNotes checks for such notes when you open the app, every 15 minutes while it is open, and when you return to its tab. A note that is open in the editor is not cleared while it is open. Your clients, custom templates and style preferences are not affected. Notes removed this way cannot be recovered. The setting is saved with your account, so it applies in every browser where you sign in.

Clearing your browser's site data, or closing a private or incognito window, also removes your notes. To keep a note, copy it to your clipboard or export it (where your plan includes export) and store it in your EHR or records system before you log out.

While you are writing a new note, an unsaved draft is kept in your browser so you can resume it. A draft is removed when you save the note or discard the draft, and all drafts are cleared when you log out, are signed out for inactivity, or your session ends. Otherwise, drafts older than 24 hours are discarded.

Session text and audio sent for note generation or transcription, and any excerpts of a selected client's earlier notes sent with them, are not stored on our servers. We keep an audit log of activity (such as the type and time of an event), never the content of your notes. If you cancel your subscription, you have a 30-day grace period in which you can still sign in to view and export the notes stored in your browser.

6. Your Rights

You have the right to:

  • View, copy, and export the notes stored in your browser while you are signed in (export options depend on your plan)
  • Request deletion of your account and all associated data
  • Update or correct your account information
  • Opt out of non-essential communications

7. Security

We implement industry-standard security measures including encryption in transit (and at rest for data on our servers), secure authentication, rate limiting, and input validation. Despite these measures, no system is 100% secure. If you discover a security vulnerability, please contact us at support@wellnotesai.com.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification. Continued use of WellNotes after changes constitutes acceptance of the updated policy.

9. Contact Us

For questions about this Privacy Policy or your data, contact us at support@wellnotesai.com.