PRIVACY
Privacy Policy
This policy explains what the private testing release collects, where information is processed, and the controls available to you.
Effective August 9, 2026
Information you provide
ABA NoteFlow AI receives the account information needed to identify your login, administer access, enforce note allowances, and support billing. You may also enter treatment details to request a draft. Do not enter names, initials, exact service dates, addresses, contact details, record numbers, insurance information, assessment files, or other information that could identify a client.
AI drafting
After you confirm that identifying information was removed, the treatment-detail fields needed for drafting are sent through the NoteFlow server to OpenAI to generate an editable draft. NoteFlow does not intentionally send client-profile fields, payment-card information, or assessment files with that request.
Information stored by NoteFlow
The server stores account identifiers, usage counts, access status, feedback status when enabled, and billing references needed to operate the service. Generated note drafts, session-form fields, and client profiles are not stored in the NoteFlow server database in this testing release.
Information stored on your device
Client and professional profiles are encrypted and stored in the browser on the device where you created them. They may be removed by deleting a profile, deleting your account from that browser, or clearing the browser’s site data. Anyone with access to your unlocked device and browser session may still be able to use the app, so protect your device.
Service providers
Clerk supports account authentication, Stripe supports checkout and subscription management, Cloudflare supports application hosting and operational storage, and OpenAI provides note generation. Those providers process limited information needed for their role and may retain records under their own terms or legal obligations. NoteFlow does not receive your full payment-card number.
Extension permissions
The optional Chrome extension requests access to a website only after you approve that website. Reading is manually initiated, extracted fields are shown for review, and approved access can be removed. Browser permissions do not make clinical information appropriate to send to AI; you remain responsible for removing identifiers.
Retention and deletion
You may permanently delete your NoteFlow account from the Account screen. This removes the login and NoteFlow usage and billing-reference records associated with it and clears local profiles in that browser. Stripe and other providers may keep transaction or security records they are independently required to retain.
Security and limitations
NoteFlow uses HTTPS, authenticated access, server-side secrets, security headers, and restricted application flows. No system can promise absolute security. This testing release has not completed a formal HIPAA compliance program and should not be used to transmit protected health information.
Questions
For privacy or account questions, email support@abanoteflow.com. Do not include client or session information in a support request.