Privacy Policy

Last updated: September 12, 2026

Notafid LLC (“Notafid,” “Company,” “we,” “our,” or “us”) respects your privacy and is committed to protecting it through our compliance with this policy. This policy describes how we collect, use, process, retain, and disclose Personal Information about you when you access or use our cloud-hosted, AI-assisted clinical documentation platform and related websites, applications, and services that link to this policy (our “Services”).

If Notafid processes protected health information (“PHI”) on behalf of a health care provider or other covered entity in connection with the Services, Notafid acts as a business associate, and its use and disclosure of that PHI is governed by the applicable Business Associate Agreement (“BAA”) (a copy of which is located at https://www.notafid.com/baa) and the Health Insurance Portability and Accountability Act (“HIPAA”), not by this policy. To the extent of any conflict between this policy and the BAA with respect to PHI, the BAA controls. This policy governs Personal Information that is not PHI (for example, account, contact, billing, device, and usage information relating to our customers’ personnel and other authorized users and visitors).

This policy applies only to information we collect:

Through the Services.
In communications, including email, text, chat, and other electronic messages, between you and the Services.
When you interact with our advertising or applications on third-party websites and services, if those applications or advertising include links to this policy.

It does not apply to information collected by (i) us offline or through any other means, including any other website operated by Notafid or any third party that does not link to this policy; (ii) any third party, including through any application or content that may link to or be accessible from the Services; or (iii) our processing of PHI as a business associate, which is governed by the BAA and HIPAA.

Please read this policy carefully. By interacting with our Services or providing us with your information, you agree to the collection, use, and disclosure of your information as described in this policy. This policy may change from time to time (see Changes to Our Privacy Policy, below). Your continued use of the Services after we make changes is deemed acceptance of those changes.

Children’s and Minors’ Data

Our Services are directed to businesses and their personnel and are not intended for, and we do not knowingly collect any Personal Information from, children under the age of 18. If we learn we have collected Personal Information from a child under 18 without verified parental consent, we will delete that information.

The Personal Information We Collect or Process

“Personal Information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include PHI (addressed above), publicly available information, or deidentified or aggregated information.

The categories of Personal Information we collect or process include:

Category	Examples of what we collect	Do we collect it?
Identifiers	Name, email address, postal address, phone number, username, account ID, IP address, NPI number, medical license number, and similar identifiers	Yes
Customer Records (Cal. Civ. Code § 1798.80(e))	Contact information. Our payment processor and their affiliates, currently Stripe, Inc. (“Stripe”), collect your payment information. Your use of our payment processor is subject to such payment processor’s terms and conditions.	Yes
Characteristics of Protected Classifications	Age, name, other necessary information to verify identity	Yes
Commercial Information	Subscription, account, order, and transaction history, practice locations, practice billing information and other similar information	Yes
Internet or Network Activity	Browsing/usage details, interactions with the Services, log data, and information collected through cookies and similar technologies	Yes
Geolocation Data	No specific geolocation data is collected, however, general location may be derived from your IP address	Yes
Sensory Information	Audio recordings and photos. Audio recordings and document photos are deleted promptly after processing and, in any case, automatically within 24 hours; Notafid does not retain them.	Yes
Professional or Employment Information	Job title, employer, and role of authorized users	Yes
Education Information	Not collected	No
Inferences	Inferences drawn from the above to create a profile about preferences and use of the Services	Yes
Sensitive Personal Information	Account log-in credentials, precise geolocation, health information that is not PHI	Yes

To the extent we collect information that is sensitive Personal Information under applicable law, we use and disclose it only for the purposes permitted under applicable law (such as providing the Services you request) and do not use it to infer characteristics about you. (See Your California Privacy Rights, below, for any California user’s right to limit the use of sensitive Personal Information.) Any PHI we collect is subject to our Business Associate Agreement, which is linked above.

In addition to the categories of data referenced above, we also collect aggregated and deidentified information and technical information (such as clickstream data, page response times, and interaction details). We maintain deidentified information in deidentified form and do not attempt to reidentify it, except as permitted by law. If we combine non-Personal Information with Personal Information such that it identifies you, we treat the combined information as Personal Information.

In the 12 months before the “last updated” date above, each of the above categories of Personal Information may have been shared with a recipient identified herein for a business purpose described herein.

How We Collect Your Information

You provide it to us. When you create or update an account, subscribe to or purchase the Services, configure or use the Services, participate in surveys or promotions, or communicate with us.

Automatically through the Services. As you navigate and interact with the Services, we use automatic data-collection technologies (such as cookies) to collect usage details, IP addresses, device and browser information, and interaction data. Using these technologies helps us operate, secure, and improve the Services.

Cookies. The technologies we use may include cookies, which are small files placed on your device. You may refuse or disable cookies through your browser settings, though some Services features may then be unavailable.

How We Use Your Information

We use the information we collect for the following business and commercial purposes:

Provide, operate, maintain, secure, and support the Services and their features.
Manage subscriptions, orders, billing, payments, and renewals and carry out our obligations and enforce our rights under our contracts (including for billing and collection).
Authenticate users and administer role-based access.
Communicate with you, including service, security, and administrative notices and responses to your inquiries.
Subject to applicable law (or, where applicable, the BAA), improve, develop, and analyze the Services, including by creating aggregated and deidentified data.
Detect, prevent, and respond to security incidents, fraud, and misuse.
Comply with legal obligations and enforce our terms.
Any other purpose we describe when you provide the information or with your consent.

We do not use your data (including PHI) to train AI models. Our AI features rely on third-party providers, bound by contract and, for PHI, a BAA, that do not use your data to train their models. Any product improvement uses only aggregated, deidentified data.

How We Disclose Your Information

We may disclose the categories of Personal Information described above as follows:

To service providers and contractors who process Personal Information on our behalf and are bound by contract to keep it confidential and use it only to perform services for us. For example, AWS (Bedrock/Transcribe/S3), Google Cloud/Firebase, Stripe, Deepgram, Cloudflare, and SendGrid.
To our affiliates and subsidiaries.
To our business customers (and their authorized users) to whom your access relates.
In a corporate transaction (to a buyer or successor in the event of a merger, acquisition, reorganization, financing, sale of assets, or bankruptcy).
For legal and safety reasons (to comply with a court order, law, or legal or regulatory request; to enforce our terms and conditions, license agreements or other similar agreements related to the Services; and to protect the rights, property, or safety of Notafid, our customers, or others).
With your consent or as otherwise disclosed when you provide the information.

We may disclose aggregated and deidentified information without restriction.

No sale or sharing of Personal Information. Notafid does not sell or share your Personal Information.

Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights with respect to your Personal Information, subject to certain exceptions:

Right to Know / Access. You may request that we disclose the categories and specific pieces of Personal Information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, and the categories of third parties to whom we disclose it. You may request this information for the 12-month period preceding your request or a longer period as required by law.
Right to Delete. You may request that we delete Personal Information we collected from you, subject to exceptions (for example, information we must retain to provide the Services, comply with law, or for security).
Right to Correct. You may request that we correct inaccurate Personal Information we maintain about you.
Right to Opt Out of Sale/Sharing. You may direct us not to sell or share your Personal Information. We do not sell or share Personal Information; however, you may still exercise this right.
Right to Limit Use of Sensitive Personal Information. To the extent we use sensitive Personal Information beyond the purposes permitted by the CCPA, you may direct us to limit that use.
Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.
Right to Appeal. If your state provides an appeal right, you may appeal a decision on your request by contacting us pursuant to the contact information herein.

How to Submit a Request. To exercise these rights, please use the contact information at the end of this policy.

Global Privacy Control. Some browsers and extensions support the Global Privacy Control (“GPC”). When we detect a GPC signal, we will treat it as a valid request to opt out of any sale or sharing of Personal Information from that browser or device, as required by applicable law.

Shine the Light (Cal. Civ. Code § 1798.83). California residents may request information about our disclosure of Personal Information to third parties for their direct marketing purposes. Notafid does not disclose Personal Information for third-party direct marketing. To make a request, contact us using our contact information located at the end of this policy.

How We Protect Your Information

We use commercially reasonable administrative, physical, and technical safeguards designed to protect your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. However, no system is completely secure, and we cannot guarantee the security of information transmitted to or through the Services. Any transmission is at your own risk, and you are responsible for safeguarding your account credentials.

How We Retain Your Information

We keep Personal Information for as long as reasonably necessary to fulfill the purposes described in this policy, or as otherwise permitted or required by law (including to operate and secure the Services, comply with legal obligations, and resolve disputes). At the end of the applicable retention period, Personal Information is deleted, destroyed, or deidentified. Retention of licensee data, including any PHI, is governed by the applicable license agreement and the BAA.

Changes to Our Privacy Policy

We may update this policy from time to time and will provide notice of material changes as required by law. The “last updated” date at the top reflects the most recent revision. We will post the updated policy on the Services and, where required, provide additional notice.

Contact Information

To exercise your rights, or to ask questions or comment about this policy or our privacy practices, contact us at:

Notafid LLC
7901 4th St N, Suite # 35886
St. Petersburg, FL 33702
Attention: Legal Department
legal@notafid.com

To register a complaint or concern, please email us at legal@notafid.com.