Privacy & HIPAA

Our role under HIPAA

NOTRA is a Business Associate as defined in 45 CFR 160.103. Your practice (or your employing covered entity) is the Covered Entity. We process Protected Health Information (PHI) on your behalf solely to provide the scribe service — recording, transcription, and clinical note generation.

We will sign a Business Associate Agreement (BAA) with your covered entity before any production use with real patient data.

What we collect

• Account data: your name, email, password hash (bcrypt; we never see your password), specialty, default template, theme preference.
• Visit audio: the audio you record during a visit, plus an optional patient name or chart number you choose to attach.
• Generated content: the transcript, clinical note sections, and suggested ICD-10/CPT codes produced from each visit.
• Audit log: records of who accessed which note, when, from what IP. We never log PHI itself in audit entries.

How we protect it

• Encryption in transit: all connections use HTTPS with HSTS enforced.
• Encryption at rest: patient identifiers, transcripts, sections, codes, and audio blobs are encrypted with AES-256-GCM using a customer-managed AWS KMS key before being persisted.
• De-identification before AI: any text sent to AI models is run through a redaction layer that replaces names, dates, phone numbers, email addresses, MRNs, addresses, and other identifiers with placeholder tokens. The AI model only sees the de-identified text; the original mapping never leaves the server.
• Access control: session tokens are short-lived JWTs; each API call validates the session before touching any record. Every read and write is audited.

Who we share it with (subprocessors)

We use a small number of HIPAA-eligible AWS services. All operate under our single AWS Business Associate Agreement:

• Amazon RDS (PostgreSQL): stores account data and the encrypted blobs described above.
• Amazon S3: stores encrypted audio recordings.
• AWS Transcribe Medical: converts audio to text. Receives audio in a transient S3 location that is deleted after the transcription job completes.
• Amazon Bedrock (Claude): generates the structured note and Copilot answers from the de-identified transcript only.
• AWS KMS: holds our encryption key material.
• AWS App Runner / CloudWatch: hosts the service and stores operational logs (no PHI in logs).

We do not sell, rent, or share PHI with anyone outside this list. We do not use PHI to train AI models.

How long we keep it

Audio recordings, transcripts, notes, and codes are retained for the lifetime of your account. You can delete any individual note at any time from the Notes screen. Deleted notes are removed from primary storage immediately; backups roll off within 30 days. You can delete your account (and erase your clinical data from primary storage) from the Account page in the app or on the web. We keep a limited operational record of the deletion (your email, time, and item counts — not clinical content) for support and security. If you need help, contact team@notralabs.com.

Your rights as a user

• Access: view your data inside the app, or request a full export via team@notralabs.com.
• Correction: edit any note section directly in the app. Edit your name from the Account page.
• Deletion: delete individual notes via the note's menu, or delete your account from the Account page. For help, contact team@notralabs.com.
• Portability: notes can be copied or shared as plain text from the note detail screen.

Patient rights

Patients exercise their HIPAA rights — access, amendment, accounting of disclosures, complaints — through your covered entity, not through NOTRA. We will assist your practice in fulfilling those requests when required by our BAA.

Reporting a security incident

If you suspect a breach or unauthorized access, contact team@notralabs.com immediately. We commit to investigating and notifying affected covered entities within the timelines required by 45 CFR 164.410.

Changes to this notice

We may update this notice as our practices evolve. Material changes will be communicated by email and shown on next sign-in.