Skip to main content
NoteIQ is now live for hospice teams. Schedule a demo
section label

Privacy Policy

Privacy Policy

section label

Last Updated: October 12, 2026

Introduction

NoteIQ, Inc. and its subsidiaries, divisions, and affiliates (collectively, “NoteIQ”, “we”, “us”, and “our”) recognize the importance of protecting the privacy of the personal information you provide to us. Accordingly, we have developed this Privacy Policy (the “Policy”) so that you can make educated and informed decisions about the personal information that you entrust to us by engaging our services on the websites, software, social media, email exchanges, mobile apps, text messages and other online services on which this Policy is posted (the “Service”), and understand how we collect, use, disclose, and otherwise manage this information.

Your use of the Service is conditioned upon your agreement with this Policy and our Terms of Service. If there are any terms in this Policy or in our Terms of Service to which you do not agree, you must discontinue your use of our services. Before using our Services, please read this Policy carefully as it contains important information on who we are and how and why we collect, store, use, and disclose your personal information. This Policy also explains your rights in relation to your personal information and how to contact us or the applicable regulatory authorities in the event you have a complaint.

"Personal information" means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.  “Personal information” does not include information lawfully made available to the general public. “Personal data” has the same definition as “personal information” for this Privacy Policy and the terms may be used interchangeably.  Some states refer to “personal information” as "personal data" and this Privacy Policy conforms to the states’ preferred usage.

As used in this Policy: “Customer” means any business, agency, or other entity that contracts with NoteIQ for access to and use of the Service. “Authorized User” means an individual member of Customer’s personnel, including an employee, contractor, or agent of Customer, whom Customer authorizes to access and use the Service on Customer’s behalf.  “Patient” or “Individual” means an individual who is the subject of records, data, or other information processed through the Service and who does not contract with NoteIQ. References to “you” or “your” in this Policy refer to Customer and its Authorized Users, as applicable.

NoteIQ is not a covered entity under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). While NoteIQ is not a medical provider, insurance company, or other HIPAA covered entity, NoteIQ acts as a business associate to the extent applicable and, in that capacity, complies with its obligations under its Business Associate Agreements (“BAAs”) and the provisions of 45 C.F.R. Parts 160 and 164 that apply to business associates concerning Protected Health Information (“PHI”). To learn more about our practices concerning PHI and HIPAA, see the HIPAA section below.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY USING OUR SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTAND, AND AGREE TO THE TERMS OF THIS PRIVACY POLICY. If you do not agree with this Policy, please do not use the Service or provide personal information to us.

This Policy is written in the English language. We do not guarantee the accuracy of any translated versions of this Policy. To the extent that any translated versions of this Policy conflict with the English language version, the English language version of this Policy shall control.

Children and Individuals Under the Age of Eighteen

We are committed to protecting the privacy of children. Our services are not intended for or directed to persons under eighteen (18) years of age. IF YOU ARE UNDER THE AGE OF EIGHTEEN (18) OR THE AGE OF MAJORITY IN YOUR JURISDICTION, WHICHEVER IS GREATER, YOU ARE NOT AUTHORIZED TO USE OUR SERVICE, EVEN IF YOU HAVE OBTAINED PARENTAL CONSENT TO DO SO.

While minors may not access or use the platform directly, authorized adult users (such as medical professionals) may upload or import personal data of minor patients (under 18) into the platform. This indirect data collection is strictly limited to the purposes of treatment, record-keeping, and providing support to the minor patient's medical team. Because the platform is not directed at children and does not permit children to use the platform directly, NoteIQ relies on parents, legal guardians, or authorized healthcare providers to provide any required consent for the processing of minor patient data.

If you are a parent or guardian and believe we have improperly collected personal information of a child, please contact us at support@noteiq.com and we will remove such data to the extent allowed by applicable law. Upon notice that a child has provided us with personal information, or that another party has otherwise provided us with a child’s personally identifiable information, we will delete the child’s personally identifiable information from our records, unless the child’s information constitutes PHI processed on behalf of a Customer. Where the child's information constitutes PHI processed on behalf of a Customer, parental requests concerning such PHI must be directed to the Customer. In accordance with applicable law and platform functionality, parents or guardians may contact us to view, delete, or revoke permission for further use or maintenance of their child’s information that constitutes non-PHI data.  For concerns regarding PHI, parents and guardians should contact the Customer. To exercise your rights as a parent for non-PHI data, contact us at support@noteiq.com.

Collection of Personal Information

NoteIQ provides its Customers with a platform to securely gather, store, manage, and share personal information within the Service. To do this, NoteIQ collects personal information in the ways described herein.

‍

Information provided to us directly

NoteIQ will collect personal data directly when an Authorized User interacts with our Service, contacts us, uses our services, creates an account, signs up to receive offers or emails from us, or completes an intake form. When an Authorized User accesses the Service, we may ask for a name, address, telephone number, email address, or other contact details to respond to a request or inquiry or to share products, services or education materials that we think the Authorized User will find interesting via email, text message, push notification or using any other contact information provided.  

To access and use certain features of the Service, an Authorized User may be required to first complete registration. When an Authorized User creates an account or registers with us or otherwise uses our services, we may collect the Authorized User’s contact information, other identity information, username and password, and other information optionally provided for the user’s profile including but not limited to, photographs or videos.

This information is necessary to enable us to provide the requested account and to maintain the account and the associated profile. An Authorized User may update account information by editing the information associated with the account.

‍

Information we obtain indirectly

We may receive personal data from an existing electronic medical record (“EMR”) imported to the Service on a Customer’s behalf. We may combine this with data that we have already collected. This information is used to provide a more comprehensive patient record.

‍

Information collected automatically

When an Authorized User uses our Service, we collect certain information automatically through our use of cookies and similar technologies only to the extent reasonably necessary to operate and provide the Service. When an Authorized User visits our Service, we automatically collect information from the browser or mobile device, which includes the date and time of the visit, the Internet Protocol (IP) address or unique device identifier, domain server, browser type, cookies and data about which pages are visited. This information is used to generate audit trails to facilitate Customer’s compliance with HIPAA. To learn more about our collection of technical data, please see the Cookies and Similar Technologies section of this Policy below.

‍

Non-Personal Information

Even if an Authorized User does not register with or provide any personal information to NoteIQ, we may collect non-personal information about the use of NoteIQ. “Non-personal information” means information that we cannot use to identify or contact an individual, such as aggregate statistics.

‍

Categories of Personal Information and Purpose for Collection

NoteIQ collects the following categories of personal information:

  • Contact Information such as name, email address, mailing address and phone number;
  • Billing Information such as credit card number and billing address;
  • Authentication Information such as username, account number and password that an Authorized User uses to register an account on the Service;
  • Preferences Information such as communication preferences, and reminder and notification preferences;
  • Medicare and primary or secondary medical insurance coverage details;
  • Personal relations, including contact information for family members, representatives, and their relationships and roles;
  • Online behavior information including online activity, preferences, and time spent viewing features; and
  • IP address, mobile network information, and browser information.

NoteIQ may also collect the following categories of sensitive personal information:

  • Social security number;
  • Ethnicity, race, and religion;
  • Protected Health Information, including:
    • Visit notes from doctors, nurses, hospice aides, social workers, spiritual care providers, volunteers, and other medical professionals;
    • Audio recordings and transcripts of clinical encounters;
    • Primary and related diagnoses, level of care, allergies, comorbidities, attending physician identity, and code status;
    • Admission and service dates, and the benefit period;
    • Medications, including prescriptions, medication orders, and medication sensitivity information;
    • Medical forms, including certifications of terminal illness and other documentation pertaining to medical care.
  • Communication logs, including call history with patient family members, physicians, and team members.

We do not collect or process health or personal information with the purpose of inferring characteristics about an individual.

The sensitive personal information we collect is limited to the information enumerated above, provided to us by an Authorized User or the caregivers of a patient, and is owned by the Customer as described in the Terms of Service. Beyond this, NoteIQ does not collect sensitive personal information. We take our responsibility with sensitive personal information seriously. Some of our key protections for sensitive personal information include:

  • Encryption: sensitive data such as SSNs and stored records is encrypted at rest, and traffic is protected in transit. Document files are kept in secure, private storage.
  • Access control: users only see and do what their role and job title allow, so PHI is limited to those who need it.
  • Audit logging: access to and changes involving PHI are recorded to an immutable audit trail.
  • Secure sharing: documents sent by email go through password-protected, time-limited secure links rather than raw attachments.
  • Safe uploads: uploaded files are checked for type and size and scanned before they're accepted.
  • Tenant isolation: each agency's data is kept separate from other agencies.

NoteIQ does not intend to collect the following types of sensitive personal information: your driver’s license, state identification card, or passport number; account log-ins for third party services, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; your philosophical beliefs or associations, political opinions or membership; the contents of your mail, email and text messages, unless we are the intended recipient of the communication; your criminal background; your citizenship or citizenship status; or any non-patient-related personal information about a known child. We ask that an Authorized User not send nor disclose any sensitive personal information that we do not explicitly collect for the purposes outlined in this Policy or to provide our Service.

The statutory individualrights provisions of this Policy do not apply to PHI, which is governed by HIPAA, the applicable BAAs, and the provisions of this Policy concerning PHI, as described in the HIPAA section below. Because PHI is entered into the Service by Authorized Users on a Customer’s behalf and belongs to the Customer, NoteIQ does not control such information and cannot delete it or withdraw consent to its processing at the direction of an individual; requests concerning PHI must be directed to the applicable Customer. To the extent an Authorized User provides sensitive personal information that is not PHI and does not belong to a Customer, the Authorized User may withdraw consent to its processing at any time by contacting us at support@noteiq.com or P.O. BOX 781048, Orlando, Florida 32878.

‍

Purpose for Collection and Processing of Personal Information

NoteIQ only collects and processes the minimum amount of personal information from an Authorized User that is necessary for the purposes of our patient record services and information processing activities, and retains such information only for as long as required to fulfill such purposes, as permitted by the agreement for the Service, or as permitted or required by applicable law. Such purposes include to:

  • Conduct our business
  • Generate patient fact sheets, that summarize patient data
  • Generating patient records
  • Enable effective reviewing, editing, storage, and maintenance of patient records
  • Record and manage patient insurance and financial information
  • Respond to customer service requests and communications
  • Administer an Authorized User’s account, including login verification
  • Respond to an Authorized User’s questions and concerns
  • Quality management
  • Legal compliance

In some circumstances we may collect aggregated data or anonymize an Authorized User’s personal information (so that it can no longer be associated with the Authorized User and the Authorized User can no longer be identified by it) for research or statistical purposes. Any such aggregation or anonymization of health data must satisfy the HIPAA de-identification standards set forth in 45 C.F.R. § 164.514(a)-(b) and comply with all applicable requirements, limitations, and restrictions in any governing BAA. Aggregated or anonymized information is not considered personal information under this Policy.

Where applicable, if NoteIQ intends to further process an Authorized User’s personal information for a purpose other than that for which the personal information was initially collected, NoteIQ shall, prior to such processing, provide the Authorized User with any relevant information on such additional purpose, and, to the extent required by applicable law, obtain the Authorized User’s consent for this. To the extent an Authorized User provides consent to NoteIQ for any purpose, the Authorized User may withdraw such consent at any time by contacting us at support@noteiq.com.

The personal information which we collect may be required for us to provide our services. If an Authorized User declines to provide us with requested personal information (including sensitive personal information), we may be unable to provide some or all of our services.

We do not collect, use, or sell personal data for the purpose of training AI, and we do not authorize any Service Provider to do so on our behalf.

We or our Service Providers (defined below) may also use certain information to locate or try to locate the same unique users across multiple browsers or devices, such as smartphones, tablets, or computers, to better tailor content, and features, and to provide an Authorized User with a seamless experience across the devices the Authorized User uses to access the Service and to an extent reasonably necessary to use the Service.

‍

Disclosure of Personal Information

NoteIQ does not sell or share PHI or other personal information from users of the Service other than as described below. In the preceding twelve (12) months, we have shared PHI for the following purposes:

  • Service Providers. We disclose PHI and other personal information to third-party vendors that perform services on our behalf in connection with the Service (“Service Providers”), including recording and AI-processing vendors such as Amazon and AssemblyAI, only as necessary to provide the Service. Each such vendor has a Business Associate Agreement (“BAA”) in place with NoteIQ and is contractually required to comply with the applicable requirements of HIPAA with respect to any PHI it receives, process, maintains, or transmits on our behalf. PHI is stored and processed in the United States.

Also, we may share or disclose personal information for the following purposes:

  • Legal Disclosure. We may transfer and disclose information, including personal information, usage information and device identifier (including IP address), to third-parties to comply with a legal obligation; when we believe in good faith that the law requires it; at the request of governmental authorities conducting an investigation; to verify or enforce our agreements, terms of service, or other applicable policies; to respond to an emergency; or otherwise to protect the rights, property, safety, or security of third-parties, visitors to our Service, or the public.
  • Transfer in the Event of Sale or Change of Control. If the ownership of all or substantially all of our business changes, or we otherwise transfer assets relating to our business or the Service to a third-party, such as by merger, acquisition, bankruptcy proceeding or otherwise, we may transfer personal information to the new owner. In such a case, unless prohibited by applicable law, personal information would remain subject to the privacy policy applicable at the time of such transfer, unless users discontinue use of our Service.
  • Emergencies. We may also disclose personal information to the appropriate medical, law enforcement, or other emergency response professionals in response to a physical threat to persons.

We do not engage in automated decision-making or profiling, including algorithmic matching, to make decisions that produce legal or similarly significant effects about individuals based on PHI or other personal information.

‍

Cookies and Other Technologies

A “cookie” is a small file created by a web server that can be stored on a user’s device for use either during a particular browsing session (a “session” cookie) or a future browsing session (a “persistent” cookie). This file may include information about user or visitor IP addresses, browser type, internet service provider (ISP), URLs of any referring or exited webpages, operating system, and/or date and time stamps. We collect user or visitor data through cookies only to the extent necessary to operate the Service and directly provide service to users, such as by providing and maintaining authenticated account sessions, supporting login and account-session management, controlling access to records, and fulfilling and managing subscriptions. We do not sell or share this information.

Users are free to decline our Cookies, but, if they do, they may be unable to access some parts or all of our Service and/or some parts of our Service may not work properly for them. Unless users have adjusted their browser setting so it will refuse browser Cookies, our system will issue Cookies when users direct their browser to our Service.

If users would like more detailed information about Cookies in use on or related to the Service, please contact us using the information provided below.

If users would like more information about who we share our data with and why, please contact us using the information provided below.

‍

Linked Sites

The Service may contain links to third-party owned or operated websites, including, without limitation, social media websites (each a “Linked Sites”), as a convenient method of accessing information that may be useful or of interest to users. When users click on a link to a linked site, they will leave the Service and go to that linked site, and another entity may collect personal information or anonymous data from them. This Policy and the practices that we follow under this Policy do not apply to Linked Sites. We are not responsible for the content, accuracy, or opinions expressed on any Linked Site or for the privacy practices or security standards used by third parties on such Linked Sites. These Linked Sites have separate privacy and data collection practices, and we have no responsibility or liability relating to them.

Users understand and agree that by clicking on a link to a Linked Site, they have left our Service and this Policy is no longer in effect.

‍

Artificial Intelligence

The Service uses Artificial Intelligence (AI) features to process information, generate AI outputs, and help Customer perform tasks. AI vendors process Customer Data only to provide the Service, retain it only for the limited period described herein or as necessary to use the Service, and do not use it to train or improve models. The AI features do not create a "voiceprint" or any record designed to identify persons by their voice. AI processing is in accordance with HIPAA requirements and AI vendors each have a BAA in place where applicable. Any output generated based on Customer Data is owned by Customer.  

‍

Managing User Information

If users do not want their personal information used by NoteIQ as provided in this Policy, they should not use the Service or register as a member of NoteIQ or for any specific tool or application on NoteIQ’s Service that collects personal information.

Users may correct, update, or review personal information they have submitted through registration, interactive services and tools, and applications by signing into their NoteIQ account and updating their registration information or making the desired changes. If users have registered for an NoteIQ account and no longer want NoteIQ to use their personal information or desire to delete such information from our systems, they should delete their information as described in this Policy or contact NoteIQ to assist them using the information listed below. Users do not need to create an account with us to submit a request to delete. Upon a user’s request, we will delete the user’s personal information from our active databases and, where feasible, from our back-up media; however, users should be aware that it is not technologically possible to remove every record of the information they have provided to NoteIQ from our servers.

Users may reject and opt-out of cookies and other parts of the Service. When users register, subscribe, create an account, sign up to receive offers or emails from us, or otherwise communicate with us through our Service, they may “opt out” of receiving future communications from us for direct marketing purposes by indicating that they decline such communications. Users may choose to stop receiving any marketing emails by following the unsubscribe instructions included in these emails or contacting us at support@noteiq.com.

‍

Security of User Information

The security of personal information is important to us. We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. NoteIQ cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security, and improperly collect, access, steal, or modify personal information.

The security of NoteIQ accounts relies on users’ protection of user profile information. Authorized Users share responsibility for maintaining the security of the Service and preventing its misuse. Authorized Users are responsible for maintaining the security of user profile information, including passwords and for all activities that occur under an Authorized user’s account. Authorized Users may not share their password with anyone. We will never ask Authorized Users to send their password or other sensitive information to us in an email. Any email or other communication purporting to be from one of our websites requesting a password or asking Authorized Users to provide sensitive account information via email, should be treated as unauthorized and suspicious and should be reported to us immediately by using the “Contact” feature of our website. If Authorized Users believe someone else has obtained access to their password, please change it immediately by logging in to the account and report it immediately by using the “Contact” feature of our website or by contacting us via email at support@noteiq.com.

If a breach of security involving unsecured personally identifiable information occurs, we will comply with all applicable breach-notification laws.

If an Authorized User believes they have identified a security vulnerability in the Service, please report it to us at support@noteiq.com. We appreciate responsible disclosure and will review reports promptly. Please do not access, modify, or delete data belonging to others or disrupt the Service when investigating or reporting a potential vulnerability.

Liability arising from misuse of any account or credentials is governed by the applicable Terms of Service [insert link].

If users believe any personal information they have submitted to us is unsecure or have any other privacy concerns, please notify us immediately at support@noteiq.com.

‍

HIPAA

NoteIQ is not a HIPAA covered entity. To the extent applicable, NoteIQ acts as a business associate and, in that capacity, complies with any obligations under its Business Associate Agreements (“BAAs”) and the provisions of 45 C.F.R. Parts 160 and 164 that apply to business associates concerning Protected Health Information (“PHI”). NoteIQ claims no ownership in Customer Data. Under the Terms of Service, the Customer retains ownership of Customer Data, and NoteIQ holds only a limited license to host, copy, process, and transmit Customer Data solely as necessary to provide, maintain, and support the Service. The Service provides features that may assist the Customer in meeting its own HIPAA obligations, but NoteIQ does not guarantee HIPAA compliance, does not assume obligations that apply only to covered entities or to the Customer, and does not represent that the Service inherently guarantees “HIPAA compliance.” The Customer is independently responsible for determining its own HIPAA status, configuring access controls, applying least-privilege and minimum-necessary principles, verifying the identity and authority of recipients, and entering into any required BAAs with its own third parties. Features of the Service that may support these efforts include:

  • Encryption: Certain sensitive Customer, User, or Patient Data, such as Social Security numbers and stored records, is encrypted at rest, and traffic is protected in transit. Document files are kept in secure, private storage.
  • Access controls: Authorized Users are able to access and take actions permitted by their assigned roles, which the Customer configures to limit access to PHI consistent with the Customer’s least-privilege and minimum-necessary policies.
  • Audit logging: Access to, and changes involving, PHI are recorded to an audit trail. Audit entries record the action taken on a record, the date and time of the action, whether PHI was accessed, and request details, including IP address and browser information. Audit entries are insert-only and are not overwritten, edited, or deleted.
  • Secure sharing of EMRs: The Service permits two workflows for sharing electronic medical records (“EMRs”). First, the Customer may send specific records through a secure, password-protected, time-limited link, with the associated access recorded in the audit trail, rather than as raw email attachments. Second, the Customer may transfer care through the designated discharge workflow.
  • Safe uploads: Uploaded files are checked for type and size and are scanned before they are accepted.
  • Tenant isolation: Each Customer's data is kept separate from that of other customers.

Data retention and integrity: Patient records and documents are archived or soft-deleted rather than permanently destroyed, so that an administrator may recover them when appropriate. Deleting a document generally hides it from routine views while retaining the underlying record. Audit entries are not overwritten or removed. Signatures and signed documents are preserved as they existed at the time of signing, and later corrections are handled through addenda rather than by altering the original record.

These features may assist the Customer in meeting its HIPAA obligations when paired with the Customer’s own policies, training, and configuration. It is Customer’s sole responsibility to determine whether Customer is a covered entity or business associate subject to HIPAA and to comply with all obligations arising from such status. NoteIQ is not responsible for Customer’s failure to comply with HIPAA due to Customer’s own actions, omissions, or decisions.

‍

Retention of Personal Information

We retain users’ personal information for only as long as necessary to fulfil the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements, unless a longer retention period is required or permitted by law.

To determine the appropriate retention period for personal information, we consider:

  • the amount, nature, and sensitivity of the information;
  • the potential risk of harm from unauthorized use or disclosure of the information;
  • the purposes for which we obtained the information and whether we can achieve those purposes through other means;
  • whether the information is needed to provide and improve our services and respond to users’ inquiries;
  • the need to maintain appropriate business and accounting records;
  • compliance with our legal, regulatory, and contractual obligations; and
  • our rights to establish, exercise, or defend legal claims.

Archival of patient records. Patient records and documents are archived or soft-deleted rather than permanently destroyed, so they can be recovered by an administrator when appropriate. Deleting a document typically hides it from daily views while retaining the underlying record.

Immutable audit history. Audit entries are never overwritten or removed, so the compliance history remains complete.

Point-in-time integrity. Signatures and signed documents are preserved as they were at signing, and later corrections are handled through addenda rather than altering the original.

When personal information, other than patient records, is no longer needed, we will delete, destroy, de-identify, or anonymize it in accordance with our retention practices, subject to legal hold, backup retention, or other legal, regulatory, contractual, or operational obligations.

Termination or expiration of a subscription. Upon termination or expiration of a subscription, Customer Data, including any PHI, will be handled in accordance with the applicable BAA between NoteIQ and Customer, which governs NoteIQ’s treatment of PHI upon termination, including the return or destruction of PHI or, where return or destruction is infeasible, the extension of applicable protections to such PHI for as long as it is retained, consistent with 45 C.F.R. § 164.504(e). Except as otherwise provided in the applicable BAA, upon cancellation NoteIQ will deactivate Customer’s account, provide Customer a defined post-cancellation window during which Customer may export its data, and thereafter retain or destroy Customer Data in accordance with the applicable BAA and any applicable legal retention requirements. It is Customer’s responsibility to instruct NoteIQ regarding the processing, export, retention, and disposition of Customer Data within the timeframes and through the mechanisms made available by NoteIQ, and to timely export any data Customer requires to satisfy its own recordkeeping and retention obligations. For further details, please refer to the Terms of Service.

Scope of State Special Notices

This Policy addresses two distinct categories of information that are subject to different rules. First, website-visitor data, which is limited to information reasonably necessary to support login, authentication, security, and related functionality, and contact and account information provided directly to us is subject to this Policy and to any applicable state privacy rights described below. Second, Protected Health Information (“PHI”) and other Customer Data that Authorized Users input into authenticated areas of the Service on a Customer’s behalf is governed by HIPAA, the applicable Business Associate Agreements (“BAAs”), and the direction of the Customer, rather than by the statutory individual-rights provisions of this Policy. As described in the HIPAA section above, NoteIQ processes PHI and Customer Data only as a business associate on the Customer’s behalf, does not own or control such information, and cannot access, correct, delete, port, or withdraw consent to the processing of such information at the direction of an individual; requests concerning PHI or other Customer Data must be directed to the applicable Customer.

Accordingly, all statutory individual-rights sections of this Policy-including the Special Notice for California Residents; the Special Notice for Residents of Alabama, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia; and the Special Notice for Nevada and Washington Residents-apply only to non-PHI personal information that NoteIQ collects and controls as a business or controller in its own right. These sections do not apply to PHI or other Customer Data that NoteIQ processes as a business associate on a Customer’s behalf.

‍

Special Notice for California Residents

As a resident of California, the user has certain rights regarding the user’s personal information, including:

  • ‍Request to Correct. The user may correct or update the user’s personal information at any time by logging into the user’s account or by contacting us.Request to Access.
  • Request to Access. The user may submit a request to obtain a copy of or access to the personal information that we have collected on the user.Request to Know.
  • Request to Know. The user may submit a request to receive information about our data collection practices, and in particular, the following:
    • Right to Know what Personal Information is being Collected. The user may request information on the categories of personal information we have collected about the user; the categories of sources from which the personal information is collected; our business or commercial purpose for collecting, selling, or sharing personal information; the categories of third parties to whom we have disclosed personal information, if any; and the specific pieces of personal information we have collected about the user.
    • Right to Know what Personal Information is Sold or Shared and to Whom. The user may also request the categories of personal information that we have collected about the user; the categories of personal information that we have sold or shared about the user and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared; and the categories of personal information that we have disclosed about the user for a business purpose and the categories of persons to whom it was disclosed for a business purpose. Please note that the categories of personal information, sources, and disclosure will not exceed what is contained in this Policy. Additionally, we are not required to retain any information about the user if it is only used for a one-time transaction and would not be maintained in the ordinary course of business. We are also not required to re-identify personal information if it is not stored in that manner already, nor are we required to provide the personal information to the user more than twice in a twelve-month period.Request to Limit the Use of the User’s Sensitive Personal Information.
  • Request to Limit the Use of the User’s Sensitive Personal Information. We collect and use the non-PHI sensitive personal information described above solely for the purposes of creating, authenticating, and maintaining user accounts and responding to requests by users. We do not sell the user’s sensitive personal information or use it for targeted advertising. If the user believes that we may have collected sensitive personal information about the user, the user may withdraw the user’s consent to any use or disclosure of the user’s sensitive personal information.Request to Delete.
  • Request to Delete. The user may request that we delete personal information we have collected from the user. Subject to certain exceptions set out below, we will, on receipt of a verifiable request, delete the user’s personal information from our records, direct any service providers to do the same, and notify all third parties with whom we have shared the user’s personal information to delete it unless this proves impossible or involves disproportionate effort. Please note that we may not delete the user’s personal information if it is necessary to:
    • Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by the consumer or reasonably anticipated by the consumer within the context of a business’s ongoing business relationship with the consumer, or otherwise perform a contract between the business and the consumer.
    • Help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes.
    • Debug to identify and repair errors that impair existing intended functionality; exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law; or comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
    • Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if the consumer has provided informed consent.
    • Enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the consumer provided the information.
    • Comply with a legal obligation, including HIPAA retention requirements.Right to Access Information About Automatic Decision-Making.
  • Right to Access Information About Automatic Decision-Making. We do not currently engage in automated individual decision-making. However, in the event we ever do so, we will inform the user of such change and the user may request information about and opt out of such automated decision-making.Request to Opt-Out.
  • Request to Opt-Out. The user may submit a request to opt out of the sharing or sale of the user’s personal information as well as its processing for targeted advertising or consumer profiling.Right to Data Portability.
  • Right to Data Portability. The user may also request that we transfer the user’s personal information to another entity, to the extent such transfer is technically feasible.
  • ‍Request to Access. The user may submit a request to confirm whether we are processing the user’s personal data and to obtain a copy or representative summary of, or access to, the personal data that we have collected on the user, including what the data is, how it has been used, and to whom it has been disclosed. The user’s personal data may no longer be available because it has been destroyed, erased, or made anonymous in accordance with our data retention policies, in which case we will provide the user with the reasons why the personal data no longer exists where possible.Request to Correct.
  • Request to Correct. The user may correct or update the user’s personal data at any time by logging into the user’s account or by contacting us.Request to Delete.
  • Request to Delete. The user may request that we delete the personal data we have collected on the user. We will delete the user’s personal data from our records and direct any service providers to do the same unless retention is required by law.Request to Opt-Out.
  • Request to Opt-Out. The user may submit a request to opt out of the sale of the user’s personal data as well as its processing for targeted advertising or consumer profiling.Right to Data Portability.
  • Right to Data Portability. The user may also request that we transfer the user’s personal data to the user or another entity, to the extent such transfer is technically feasible.Appeal.
  • Appeal. If we notify the user that no action is to be taken in response to the user’s request to access, correct, delete, or opt out, the user may appeal this decision by contacting us within 30 days with the reason why the user believes further action should be taken. If the user is not satisfied with the result of the appeal, the user may contact the Attorney General of the user’s state, as described below.Withdraw Consent for the User’s Sensitive Personal Information.
  • Withdraw Consent for the User’s Sensitive Personal Information. We collect and use the non-PHI sensitive personal information described above solely for the purposes of creating, authenticating, and maintaining user accounts and responding to requests by users. We do not sell the user’s sensitive personal information or use it for targeted advertising. If the user believes that we may have collected sensitive personal information about the user, the user may withdraw the user’s consent to any use or disclosure of the user’s sensitive personal information.

Special Notice for Residents of Alabama, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia

As a resident of Alabama, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, the user has certain rights, including:

If the user is a resident of one of these states, the contact information for the user’s attorney general can be found below or on the appropriate official website for the user’s state:

‍

Special Notice for Nevada and Washington Residents

Residents in the state of Washington or Nevada have rights related to their consumer health data. “Consumer health data” means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer’s past, present, or future physical or mental health status. Washington and Nevada law exempt protected health information (“PHI”) that is governed by HIPAA from the definition of consumer health data. As described in the HIPAA section above, all health information that NoteIQ collects and processes is PHI that NoteIQ processes as a business associate on a Customer’s behalf. Such PHI is governed by HIPAA, the applicable BAAs, and the provisions of this Policy concerning PHI, rather than by the Washington or the Nevada consumer health data laws. NoteIQ does not collect health data that falls outside this PHI category, and therefore does not collect “consumer health data” within the meaning of the Washington or the Nevada consumer health data law. Requests concerning PHI must be directed to the applicable Customer. If the user believes that NoteIQ may have collected consumer health data about the user, the user may contact us at support@noteiq.com.

‍

How Consumers in Covered States May Submit Requests

If the user is a resident of any state identified in this Policy and wishes to exercise the rights described above or make any of the above requests, the user can contact us at support@noteiq.com to submit a Consumer Request. If the user chooses to submit a request, the user must provide us with enough information to identify the user (e.g., the user’s first and last name, email address, and telephone number) and enough specificity on the requested data. We will only use the information we receive to respond to the user’s request. We will not be able to disclose information or comply with the user’s request if we cannot verify that the person making the request is the person about whom we collected information, or someone authorized to act on such person’s behalf. We will verify the user’s request by comparing the information the user provides with the information we have on the user and, if the user’s request is submitted by an authorized agent, we will require the user to provide signed, written permission for such agent to act on the user’s behalf.

We may not, and will not, treat the user differently because of the user’s request to exercise the user’s rights. As a result of the user’s request, we may not and will not deny goods or services to the user; charge different rates for goods or services; provide a different level or quality of goods or services; or suggest any of the preceding will occur.

‍

Changes to Our Privacy Policy  

We reserve the right to change or modify this Policy or any of our tools or services at any time to reflect changes to our information practices, and any non-material changes are effective upon being posted unless we advise otherwise. If we make any material changes to this Policy, we will post notice on the Service, and we will also send emails to email addresses provided by Customers. Such modifications will be effective thirty (30) days after our notice, except for changes that relate to new features or for legal reasons, which will become effective immediately. Use of information we collect now is subject to the Policy in effect at the time such information is used. You are bound by any changes to our Policy when you use the Service after such changes have been first posted. We encourage you to periodically review this Policy for the latest information on our privacy practices. If you do not accept the terms of our Policy, we ask that you do not register with us and that you do not use NoteIQ. Please exit NoteIQ immediately if you do not agree to the terms of this Policy.

Business Associate Agreement

NoteIQ will enter into Business Associate Agreements (“BAAs”) with Customer, as well as with vendors and other third parties that handle Customer Data involving PHI, and will handle PHI in accordance with the applicable BAA. Any Customer Data that is not PHI and is not covered by a BAA will be handled in accordance with this Policy, the Terms of Service, and applicable statutory and regulatory requirements.

‍

Reasonable Fees

Subject to applicable law, NoteIQ may charge a reasonable fee for the administrative costs of any request that is manifestly unfounded or excessive.

How to Contact Us

If you have any questions about this Policy, you may contact us by using the “Contact us” link at the bottom of every page of our Service, by email at support@noteiq.com, or by mail at:

NOTEIQ, Inc.
Attn: Privacy Officer
P.O. BOX 781048
Orlando, Florida 32878

Our HIPAA Security Official may be contacted at:

HIPAA Security Official
support@noteiq.com

See NoteIQ on your own patients.

Book a 30-minute walkthrough with our team. We'll show you the workflow end to end and talk through what it takes to get your agency live.