GastroNote.ai Privacy Policy

GastroNote.ai ("GastroNote," "we," "us," or "our") is a clinical documentation platform operated by RadhAM LLC, a South Carolina limited liability company, with its principal place of business in Greenville, South Carolina. GastroNote provides AI-powered SOAP note generation and clinical documentation tools for gastroenterology healthcare providers.

This Privacy Policy describes how we collect, use, disclose, and protect information — including Protected Health Information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") — when you use our website at gastronote.ai, our iOS mobile application, and any related services (collectively, the "Services").

1. HIPAA Compliance

GastroNote is designed and operated as a HIPAA-compliant platform. We function as a Business Associate to healthcare providers (Covered Entities) who use our Services. In that capacity, we:

• Maintain administrative, physical, and technical safeguards to protect the confidentiality, integrity, and availability of PHI in accordance with the HIPAA Security Rule (45 CFR Part 164, Subpart C)
• Use and disclose PHI only as permitted or required by the applicable Business Associate Agreement and applicable law
• Do not sell, rent, or otherwise monetize PHI under any circumstances
• Maintain Business Associate Agreements with all subcontractors who may access PHI on our behalf
• Report breaches of unsecured PHI in compliance with the HIPAA Breach Notification Rule (45 CFR §§ 164.400–414)

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address and an encrypted password. Authentication is managed through Google Firebase Authentication. We do not store passwords in plaintext.

2.2 Protected Health Information (PHI)

In the course of providing the Services, we process the following categories of PHI on behalf of healthcare providers:

Data Category	Description
Patient Names	Names entered by the provider for documentation purposes
Audio Recordings	Voice recordings of patient encounters captured during clinical visits
Transcripts	Text transcriptions generated from audio recordings
Clinical Notes	AI-generated and provider-edited SOAP notes, including Subjective, Objective, Assessment, and Plan sections
Clinical Documents	Uploaded PDFs, images, lab results, and pathology reports
Pre-visit Summaries	AI-generated summaries derived from previous visit notes and workup data

2.3 Device and Technical Information

We collect limited technical information necessary for the operation and security of the Services, including device identifiers (for cross-device synchronization), IP addresses (for security and access logging), and browser or app version information. This information is used solely for operational purposes and is not combined with PHI.

2.4 Information We Do NOT Collect

We do not collect Social Security numbers, insurance or billing information, financial account information, biometric data (Face ID authentication is processed entirely on your device and never transmitted to our servers), or information from minors under the age of 18.

3. How We Use Information

We use the information we collect exclusively for the following purposes:

• Service Delivery: To transcribe audio recordings, generate SOAP notes, create pre-visit summaries, and provide clinical documentation tools
• Authentication and Security: To verify your identity, manage sessions, and protect against unauthorized access
• Cross-Device Synchronization: To enable real-time coordination between the web application and mobile application using device identifiers (no PHI is transmitted through the synchronization channel)
• Service Improvement: To monitor system performance, diagnose technical issues, and improve reliability. We do not use PHI for product development, analytics, marketing, or any purpose unrelated to direct service delivery
• Legal Compliance: To comply with applicable laws, regulations, and legal processes

4. How We Protect Information

4.1 Infrastructure Security

• All Services are hosted on Google Cloud Platform ("GCP") within the United States (us-central1 region)
• A HIPAA Business Associate Agreement is in place with Google Cloud covering all GCP services used
• All data in transit is encrypted using TLS 1.2 or higher
• All data at rest is encrypted using AES-256 encryption
• Database credentials and API keys are stored in Google Secret Manager, not in application code

4.2 Application Security

• All API endpoints require authenticated access via Firebase Authentication tokens
• Provider-level data isolation ensures that each provider can only access their own patient data
• PHI is encrypted at the application level in addition to infrastructure-level encryption
• Audio recordings are uploaded directly to Google Cloud Storage via signed URLs and deleted from client devices after successful upload
• No PHI is written to application logs

4.3 Mobile Application Security

• Authentication credentials are stored in the iOS Keychain (hardware-encrypted)
• Audio recordings are stored in the application's sandboxed directory and deleted after upload
• Face ID authentication is processed entirely on-device; biometric data never leaves the device
• The mobile application communicates exclusively over HTTPS

5. Third-Party Service Providers (Subcontractors)

We engage the following third-party service providers who may process PHI on our behalf. Each operates under a Business Associate Agreement or equivalent data protection agreement:

Provider	Service	Data Processed	BAA in Place
Google Cloud Platform	Infrastructure, compute, storage, AI (Vertex AI / Gemini)	All PHI (encrypted)	Yes
AssemblyAI	Audio transcription	Audio recordings	Yes
Google Firebase	Authentication, real-time database	Email, device sync signals (no clinical PHI)	Yes (covered under GCP BAA)

We do not share, sell, rent, or disclose PHI to any party other than the subcontractors listed above, except as required by law or with the explicit authorization of the Covered Entity.

6. Data Retention and Deletion

• Patient Data: Patient records, transcripts, and SOAP notes are retained for as long as the provider's account is active. When a provider deletes a patient record, all associated data — including transcripts, SOAP notes, audio references, and uploaded files — is permanently deleted within 14 days
• Audio Recordings: Audio files uploaded to Google Cloud Storage are retained as part of the patient record. Original audio files on client devices are deleted immediately after successful upload. Server-side audio files are deleted within 14 days of patient record deletion
• Account Data: Account information is retained for as long as the account remains active. Upon account termination, we will delete or de-identify all associated data within 30 days, unless a longer retention period is required by law
• Backup Data: Encrypted backups may persist for up to 14 days after deletion from production systems

Healthcare providers may delete specific patient records directly through the application at any time. All associated data is permanently removed within 14 days of deletion. Providers may also contact us to request bulk data deletion.

7. Your Rights

7.1 HIPAA Rights

If you are a patient whose data is processed through GastroNote, your HIPAA rights — including the right to access, amend, and receive an accounting of disclosures of your PHI — are administered by your healthcare provider (the Covered Entity). Please contact your healthcare provider directly to exercise these rights.

7.2 Provider Rights

Healthcare providers using GastroNote may:

• Access, export, or delete any patient data stored in the system at any time
• Request a complete export of all data associated with their account
• Request termination of their account and deletion of all associated data
• Request an accounting of disclosures of PHI made by GastroNote on their behalf

7.3 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us using the information provided below.

8. Cookies and Tracking

GastroNote uses only essential cookies required for authentication and session management. We do not use advertising cookies, tracking pixels, third-party analytics services, or any form of cross-site tracking. We do not serve advertisements within the Services.

9. Children's Privacy

GastroNote is designed for use by licensed healthcare professionals. We do not knowingly collect personal information from individuals under the age of 18. The Services are not directed to children, and we do not permit minors to create accounts.

10. Breach Notification

In the event of a breach of unsecured PHI, we will notify affected Covered Entities without unreasonable delay and no later than 60 days after discovery of the breach, in accordance with 45 CFR § 164.410. Our notification will include the information required by 45 CFR § 164.404(c), including identification of each individual whose PHI has been or is reasonably believed to have been compromised.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where required, provide notice through the Services or via email. Your continued use of the Services after any changes constitutes acceptance of the updated Privacy Policy.

12. Contact Information

If you have questions about this Privacy Policy, wish to exercise your rights, or need to report a privacy concern, please contact us:

For HIPAA-related inquiries or to report a potential breach, please include "HIPAA" in the subject line of your communication to ensure priority handling.