Privacy Policy
Effective date: July 27, 2026
Chartflow Health, Inc. ("Chartflow", "we", "us", or "our") operates the Chartflow mobile application, website, and browser extension (collectively, the "Service") — an AI-powered medical-scribe platform built for home health clinicians. We are committed to protecting the privacy of our users and to maintaining compliance with applicable law, including the Health Insurance Portability and Accountability Act (HIPAA).
This Privacy Policy explains what information we collect, how we use and share it, and the rights you have with respect to your data.
1. Information We Collect
Account Information
When you register for Chartflow we collect your name, email address, and professional role (e.g., registered nurse, physical therapist). If you sign in via Google or Apple, we receive the profile information those providers share with us.
Patient-Visit Audio Recordings
Chartflow records the audio of patient visits that you initiate in the app. These recordings may contain protected health information (PHI). Audio is transmitted over encrypted connections to our service providers (see §4) for transcription, and is stored encrypted as part of the clinical documentation record (see §5, Data Retention).
Transcripts and Generated Notes
The Service converts your audio recording into a text transcript and then uses AI to draft a clinical note. Both the transcript and the generated note are stored in your account and may contain PHI. You are responsible for reviewing, editing, and finalising all AI-generated content before it enters any medical record.
Usage and Technical Data
We collect standard server logs (IP address, browser or app version, timestamps, pages viewed) and crash-diagnostic data. We use this information solely to operate and improve the Service. Optional product-usage analytics are off by default and collected only if you enable them; you can turn them on or off at any time in the app (Settings → Data & Privacy).
Billing Information
Subscription payments are handled by a PCI-DSS Level 1 certified payment processor. Chartflow does not store your full card number, CVC, or bank-account details — that information is held exclusively by the payment processor. We receive and store only non-sensitive billing identifiers (customer reference, subscription status, last-four digits of your card). Our payment processor never receives clinical data or PHI.
Browser Extension Data
The Chartflow browser extension operates as follows with respect to data. (1) Authentication token:the Chartflow web application relays the clinician's authentication identity token to the extension via the Chrome messaging API; the extension stores that token in chrome.storage solely to authenticate requests to the Chartflow backend. The token is cleared on sign-out or expiry. (2) Note content:the extension fetches the finalised clinical note from the Chartflow backend and writes it into the clinician's EHR charting form. Note content may contain PHI; it is held in memory only for the duration of the push operation and is not persisted by the extension. (3) EHR page content: the extension reads the DOM of the active EHR page solely to locate the correct form fields and to verify patient identity before writing, as a guard against writing to the wrong chart. (4) Field-mapping snapshots: when generating a new EHR field mapping, the extension captures an HTML snapshot of the EHR form. That snapshot is scrubbed to remove patient data before transmission to the Chartflow backend. (5) Diagnostic telemetry: the extension sends non-PHI diagnostic data (reason codes, field-discovery counts, frame-scan statistics) to the Chartflow backend to support reliability monitoring. No PHI is included in telemetry. The extension does not record audio and does not read or access any web page other than the EHR domains the clinician has explicitly granted access to.
2. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service;
- Transcribe your audio recordings and generate draft clinical notes;
- Send transactional and administrative communications (account verification, billing receipts, security alerts);
- Comply with legal obligations;
- Detect, investigate, and prevent fraud and abuse.
We do not sell your personal information or PHI to third parties. We do not use your clinical data to train general-purpose AI models without your explicit consent.
3. Legal Basis for Processing
Where applicable law requires a legal basis, we process your personal information on the basis of contract performance (to provide the Service you signed up for), legitimate interests (security, fraud prevention, product improvement), and legal obligation. For PHI, our processing is governed by HIPAA and any Business Associate Agreement (BAA) in effect with your agency or covered entity.
4. Service Providers and Third Parties
We share information with a limited set of service providers (sub-processors) solely to deliver the Service. They fall into the following categories:
Speech-to-text and AI processing providers — Transcription and draft-note generation
Patient-visit audio and transcripts are processed by third-party speech-recognition and AI language-model services to produce transcripts and draft clinical notes. Where PHI is involved, these providers operate under Business Associate Agreements (BAAs) with Chartflow, process your data solely to provide the Service, and are contractually prohibited from using your audio, transcripts, or notes to train their general-purpose AI models.
Cloud infrastructure and hosting providers — Storage, computing, and identity services
The Service is hosted on HIPAA-eligible cloud infrastructure located in the United States, covered by a BAA. This includes encrypted storage of recordings, transcripts, and notes, and our user sign-in / authentication service.
Payment processor — Subscription billing
A PCI-DSS Level 1 certified payment processor handles subscription payments. It never receives clinical data or PHI; we store only non-sensitive billing identifiers.
Every third party with whom we share your data is bound by written agreements — including BAAs where PHI is involved — requiring them to protect your data to a standard at least as protective as this policy. We do not share your data with advertising networks or data brokers. A current list of our sub-processors is available to customers and their compliance teams on request at hello@chartflow.health.
We may share information with law-enforcement or regulatory bodies when required by law, court order, or to protect the rights or safety of Chartflow, our users, or third parties.
5. Data Retention
We retain your account information for as long as your account is active. Clinical documentation — including visit audio recordings, transcripts, and generated notes — forms part of the medical record and is retained in encrypted storage for as long as required by applicable medical-record retention laws and any agreement with your agency or covered entity, even after your account is closed. If you delete your account, we delete your login credentials, profile, and device data within 30 days; clinical records are retained as described in §6 and remain subject to legal retention obligations. Billing records may be retained for up to 7 years to comply with financial reporting requirements.
6. Your Rights
Depending on your jurisdiction, you may have the following rights with respect to your personal information:
- Access: request a copy of the personal information we hold about you.
- Correction: request correction of inaccurate data.
- Deletion: you can request account deletion from within the app or by contacting us at hello@chartflow.health. We aim to delete your login, profile, and device data within 30 days of a verified request. Clinical notes, encounters, and medical records are retained as required by medical-record retention laws and remain attributed to you as the authoring clinician.
- Consent withdrawal:you can turn off optional usage analytics at any time in the app (Settings → Data & Privacy) and revoke microphone access in your device's system settings.
- Portability:you can download a copy of your data at any time using the "Download My Data" feature in the app (Settings → Data & Privacy).
- Objection / restriction: object to or request restriction of certain processing.
To exercise any right not available through the app, contact us at hello@chartflow.health. We will respond within 30 days.
If you are a patient whose PHI was captured during a home-health visit, your rights under HIPAA are governed by your provider's Notice of Privacy Practices. Please contact your clinician or agency directly.
7. Security
We implement administrative, technical, and physical safeguards designed to protect your information, including:
- Encryption in transit using TLS 1.2+ for all data transmitted between your device, our servers, and our sub-processors;
- Encryption at rest for all stored data, including audio recordings, transcripts, and clinical notes, using AES-256;
- Role-based access controls limiting data access to authorised personnel;
- Audit logging of access to PHI;
- Regular security assessments and penetration testing.
No method of transmission over the internet or method of electronic storage is 100% secure. If you believe your account has been compromised, contact us immediately at hello@chartflow.health.
8. Browser Extension
The Chartflow browser extension (Chrome MV3) exists for a single purpose: to transfer a completed Chartflow clinical note into the clinician's EHR charting form. It does not perform any function beyond that purpose.
Host Access Model
The extension declares static access only to the EHR domains Chartflow currently supports (Elation and Kinnser/WellSky). If Chartflow adds support for an additional EHR, the clinician is presented with a one-time Chrome permission prompt for that specific domain before any access is taken. The clinician may revoke access to any domain at any time from chrome://extensions.
No Advertising and No Sale of Data
The extension does not use data for advertising purposes. We do not sell extension data to third parties. We do not share extension data with advertising networks or data brokers.
Chrome Web Store Limited Use
Chartflow's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use extension data only to provide and improve the extension's single purpose, we do not transfer it to third parties except as described in this policy, we do not use it for advertising, and we do not allow humans to read it except as described in §7 and §9.
Data Retention for Extension Data
The authentication token stored by the extension is cleared on sign-out or token expiry. The extension does not maintain its own long-term store of PHI; note content is held in memory only for the duration of the push operation and is not written to persistent extension storage.
For extension-specific privacy questions, contact us at hello@chartflow.health.
9. HIPAA and Business Associate Agreements
Chartflow is designed to support HIPAA-covered entities and their business associates. If your organisation is a covered entity or business associate under HIPAA, you may enter into a Business Associate Agreement (BAA) with Chartflow as part of your subscription. Contact hello@chartflow.health for details.
10. Children's Privacy
The Service is intended for licensed healthcare professionals. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us and we will delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, by sending an email to the address associated with your account. Your continued use of the Service after the effective date of any change constitutes your acceptance of the updated policy.
12. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:
Chartflow Health, Inc.Email: hello@chartflow.health