Privacy Policy

Draft — not yet reviewed by an attorney. Do not present this to a real clinic until counsel has reviewed it.

The short version

Your clients' clinical records live on your own computers, encrypted, and we don't have a copy. We hold account and billing information for your practice, and the minimum technical information needed to run the service.

What we collect

Account and billing information (email, practice name; payment details go directly to Stripe, never to us). Device information (a one-way hashed Device ID, your computer's name, last check-in). Drafting requests — only the specific section's text, never a client's name or your practice's identity. Usage counts for billing.

What we don't collect

We don't collect or store your clients' names, evaluation content, or report text. That data is encrypted on your own computers and never leaves them, except for the narrow drafting-request case above.

Account recovery

If every one of your practice's computers were lost at once, InsightNotes holds a sealed copy of your practice's encryption key that can restore your access — described in full in the Business Associate Agreement.

Governing law

This policy is governed by the laws of the State of Georgia. Any dispute will be brought exclusively in the state or federal courts located in Georgia.

The full document is at docs/legal/privacy-policy.md in the InsightNotes repository.