HIPAA Notice of Privacy Practices

1. Important Notice to All Users

This Notice of Privacy Practices ("Notice" or "NPP") is provided by MentraNote Inc. ("MentraNote") to describe how we may use and disclose Protected Health Information (PHI) received from or created on behalf of Covered Entities (our Subscriber clinicians and healthcare organizations) in the course of providing our electronic health record (EHR) platform services.

This Notice is distinct from your healthcare provider's own Notice of Privacy Practices. If you are a patient or client seeking information about how your therapist or mental health provider handles your records, please contact your provider directly. MentraNote processes patient PHI only as a Business Associate acting on behalf of your provider.

2. About MentraNote's Role Under HIPAA

Under HIPAA, entities that handle PHI on behalf of healthcare providers are classified as either "Covered Entities" (the providers themselves) or "Business Associates" (vendors and service providers that receive or process PHI on behalf of Covered Entities). MentraNote serves as a Business Associate under HIPAA.

As a Business Associate, MentraNote is directly subject to certain HIPAA regulations under the HITECH Act (Pub. L. 111-5), including the Security Rule, the Breach Notification Rule, and certain provisions of the Privacy Rule.

3. What Constitutes Protected Health Information (PHI)

Protected Health Information (PHI) is any individually identifiable health information that: (a) relates to an individual's past, present, or future physical or mental health condition, the provision of healthcare, or payment for healthcare; (b) identifies or reasonably could identify the individual; and (c) is created, received, maintained, or transmitted by a Covered Entity or Business Associate.

PHI processed on the MentraNote Platform may include, without limitation:

• Patient/client names, dates of birth, Social Security numbers, and other identifiers;
• Mental health diagnoses, clinical assessments, and treatment plans;
• Session notes in any clinical format (SOAP, DAP, BIRP, PIRP, GIRP);
• Session recordings and transcripts;
• Prescription and medication histories relevant to mental health treatment;
• Insurance information and claims data;
• Dates of service, appointment records, and clinical correspondence;
• AI-generated clinical notes and summaries produced from session content.

MentraNote does not independently collect PHI directly from patients. All PHI on the Platform is entered, uploaded, or generated by Subscriber clinicians in connection with their clinical practice.

4. Permitted Uses and Disclosures of PHI

As a Business Associate, MentraNote may use or disclose PHI only as authorized in the BAA with the Covered Entity and as permitted or required by HIPAA. Specifically, MentraNote may use and disclose PHI for the following purposes:

4.1 To Provide Services

MentraNote uses PHI as necessary to provide the EHR platform services to Covered Entities, including hosting, storing, displaying, processing, and transmitting clinical records and related data as directed by the Covered Entity (your therapist or organization).

4.2 For Platform Operations

MentraNote may use PHI in a limited and de-identified manner for the proper management and administration of the Platform, including: troubleshooting technical issues, security monitoring, system performance optimization, and quality assurance activities, all subject to strict access controls and the minimum necessary principle.

4.3 As Required by Law

MentraNote may disclose PHI when required to do so by applicable federal, state, or local law, including in response to a valid court order, subpoena, or government agency request, and as required to report breaches to HHS under the Breach Notification Rule.

4.4 For Legal Defense

MentraNote may use PHI in its own legal defense in proceedings in which the Covered Entity is also a party, or to obtain legal or financial services, provided that MentraNote first obtains reasonable assurances that the PHI will be held confidential and used or disclosed only for the purpose of the legal activity.

4.5 Data Aggregation (De-identified Only)

MentraNote may aggregate de-identified health information (from which all 18 HIPAA Safe Harbor identifiers have been removed per 45 C.F.R. § 164.514(b)) for the purpose of analyzing the health care operations of the Covered Entities. De-identified data is never re-identified and is used solely for aggregate analytics and Platform improvement.

5. Disclosures of PHI to Third Parties

MentraNote will not disclose PHI to any third party except:

• To subcontractors and agents that assist in delivering the Platform, subject to appropriate Business Associate subcontractor agreements (see Section 8);
• As required or permitted by law (Section 4.3);
• As authorized in writing by the Covered Entity (your provider);
• To report a breach of unsecured PHI to HHS and applicable Covered Entities as required by the Breach Notification Rule;
• To a government agency authorized by law to conduct audits, investigations, or oversight activities relating to health care fraud and abuse.

MentraNote does not disclose PHI to advertisers, data brokers, marketers, or any entity for commercial purposes not directly related to the provision of our services.

6. Prohibited Uses and Disclosures

MentraNote will not use or disclose PHI in any manner that is not permitted by the BAA or HIPAA, including:

• Using PHI for marketing purposes without explicit authorization from the Covered Entity and the individual;
• Selling PHI to any third party for any purpose;
• Using PHI to train AI models without express written opt-in from the Covered Entity;
• Disclosing PHI to family members, employers, or any individual not authorized by the Covered Entity or the individual;
• Using PHI for any purpose that is incompatible with the purposes described in this Notice and the BAA.

7. PHI Safeguards

MentraNote has implemented comprehensive administrative, physical, and technical safeguards to protect PHI in accordance with 45 C.F.R. Part 164, Subpart C (the HIPAA Security Rule):

7.1 Administrative Safeguards (§ 164.308)

• Designated HIPAA Security Officer responsible for Privacy and Security Rule compliance;
• Workforce security training program covering HIPAA requirements, PHI handling, and incident reporting;
• Access authorization and modification procedures ensuring only authorized personnel access PHI;
• Contingency plan including data backup, disaster recovery, and emergency mode operation procedures;
• Annual risk analysis and risk management activities to identify and address vulnerabilities.

7.2 Physical Safeguards (§ 164.310)

• PHI is hosted exclusively in AWS data centers in the United States (US-East region) with multi-layer physical security controls;
• AWS facilities maintain SOC 2 Type II, ISO 27001, and FedRAMP compliance;
• No PHI is stored on portable media or unencrypted personal devices;
• Workstation security policies enforce encrypted hard drives for all MentraNote employees who may access PHI.

7.3 Technical Safeguards (§ 164.312)

• Access Control: Unique user IDs, mandatory 2FA, role-based access control (RBAC), and automatic session timeouts;
• Audit Controls: PHI access logs capturing user ID, timestamp, IP address, action type, and data accessed, retained for 6 years;
• Integrity Controls: Data validation and checksums to detect unauthorized alteration of PHI;
• Transmission Security: TLS 1.3 encryption for all data in transit; all API endpoints enforce HTTPS;
• Encryption at Rest: AES-256-CBC encryption for all stored PHI, with encrypted key management.

8. Subcontractors and Agents

MentraNote may engage subcontractors to assist in providing the Platform. To the extent any subcontractor creates, receives, maintains, or transmits PHI on behalf of MentraNote, MentraNote ensures that each such subcontractor enters into a Business Associate subcontractor agreement that imposes the same requirements on the subcontractor as HIPAA imposes on MentraNote as a Business Associate.

Current subcontractors with access to PHI include: Amazon Web Services (AWS) for hosting and storage. Third-party AI providers (OpenAI, Groq) receive only de-identified content after PHI sanitization and are subject to data processing agreements that prohibit training on the data.

MentraNote is responsible for ensuring its subcontractors maintain appropriate HIPAA compliance. A complete list of subcontractors is available upon request at compliance@mentranote.com.

9. Breach Reporting and Notification

MentraNote maintains a formal Breach Notification Policy consistent with 45 C.F.R. § 164.410 and the HITECH Act. In the event of a breach of unsecured PHI:

• MentraNote will notify affected Covered Entities (Subscribers) of the breach within 60 calendar days of discovery;
• Notification will include: the nature of the breach, the PHI involved, the individuals potentially affected, steps MentraNote has taken to investigate and mitigate the breach, and recommendations for affected individuals;
• MentraNote will cooperate with the Covered Entity in providing notification to affected individuals as required by 45 C.F.R. § 164.404;
• MentraNote will provide information required for the Covered Entity to complete any required notification to HHS under 45 C.F.R. § 164.408;
• All potential security incidents are logged, investigated, and documented in accordance with MentraNote's incident response procedures.

10. Minimum Necessary Standard

MentraNote is committed to the HIPAA Minimum Necessary Standard (45 C.F.R. § 164.502(b)). This means that MentraNote employees and systems access only the minimum amount of PHI necessary to perform a specific function. Specifically:

• Platform access is granted on a role-by-role basis through our RBAC system — therapists access only their assigned clients' records; supervisors access only their organization's data;
• MentraNote engineers and support personnel do not have routine access to PHI. Support access requires explicit authorization, is logged in the audit trail, and is revoked immediately upon completion of the support task;
• Automated systems process PHI only to the extent necessary for the specific service being performed;
• Requests for PHI from MentraNote personnel for internal purposes (such as debugging) must be approved by the Security Officer and are documented.

11. Individual Patient/Client Rights Under HIPAA

Under HIPAA, individuals have the following rights with respect to their PHI:

11.1 Right of Access (45 C.F.R. § 164.524)

Individuals have the right to inspect and receive a copy of their PHI maintained in a Covered Entity's designated record set, including medical records and billing records used to make decisions about the individual. Covered Entities are required to respond to access requests within 30 days (or 60 days with written extension). MentraNote enables Covered Entities to generate data exports to fulfill patient access requests.

11.2 Right to Amendment (45 C.F.R. § 164.526)

Individuals have the right to request amendment of PHI they believe is inaccurate or incomplete. The Covered Entity may deny the request under certain circumstances (e.g., if the records were not created by the Covered Entity, or the records are accurate and complete). MentraNote supports amendment of records through the Platform's editing and documentation features.

11.3 Right to an Accounting of Disclosures (45 C.F.R. § 164.528)

Individuals have the right to receive an accounting of certain disclosures of their PHI made by the Covered Entity (and its Business Associates) for purposes other than treatment, payment, healthcare operations, or certain other specified purposes. MentraNote maintains audit logs that support Covered Entity accounting of disclosures upon request.

11.4 Right to Request Restrictions (45 C.F.R. § 164.522(a))

Individuals have the right to request restrictions on the Covered Entity's use or disclosure of PHI for treatment, payment, or healthcare operations. The Covered Entity is not required to agree to the restriction (except for certain disclosures to health plans when the individual has paid out-of-pocket in full).

11.5 Right to Confidential Communications (45 C.F.R. § 164.522(b))

Individuals have the right to request that the Covered Entity communicate with them about PHI by alternative means or at alternative locations (e.g., only by mail, or only to a specific address). Covered Entities must accommodate reasonable requests.

11.6 Right to Notification of Breach (45 C.F.R. § 164.404)

Individuals have the right to be notified, without unreasonable delay and within 60 days of discovery, if there is a breach of their unsecured PHI. Notification must be provided by the Covered Entity and must include specific details about the breach and protective actions.

12. Covered Entity Obligations

Subscriber clinicians and organizations using the MentraNote Platform as a Covered Entity under HIPAA are independently responsible for:

• Providing their own Notice of Privacy Practices to their patients/clients as required by 45 C.F.R. § 164.520;
• Obtaining any required patient authorizations before uploading PHI to the Platform;
• Responding to patient rights requests (access, amendment, accounting of disclosures, restrictions, confidential communications);
• Training their workforce on HIPAA requirements and proper use of the Platform;
• Implementing appropriate safeguards within their own practices;
• Executing a BAA with MentraNote prior to using the Platform for any purpose involving PHI;
• Reporting known breaches of PHI by MentraNote to HHS as required by the Breach Notification Rule;
• Maintaining their own HIPAA compliance programs.

13. Business Associate Agreement (BAA) Summary

MentraNote executes a Business Associate Agreement (BAA) with all paid Subscribers (Basic, Pro, and Premium plans) as required by HIPAA, 45 C.F.R. § 164.502(e). The BAA governs MentraNote's handling of PHI on behalf of the Covered Entity. Below is a plain-language summary of the key provisions of our standard BAA.

To request a copy of the full BAA, contact compliance@mentranote.com. Subscribers on paid plans who have not yet received a countersigned BAA should contact us to initiate the process.

14. Complaint Procedures

If you believe that your privacy rights under HIPAA have been violated in connection with MentraNote's handling of PHI, you have the right to file a complaint without retaliation.

14.1 Complaint to MentraNote

Submit complaints to MentraNote's Privacy/Compliance Officer at:

14.2 Complaint to HHS Office for Civil Rights

You may also file a complaint with the U.S. Department of Health and Human Services Office for Civil Rights (OCR), which is responsible for enforcing HIPAA's Privacy and Security Rules:

• Online: hhs.gov/ocr/complaints
• By mail: U.S. Department of Health and Human Services, 200 Independence Avenue, S.W., Washington, D.C. 20201
• Toll-free: 1-800-368-1019

Complaints to HHS OCR must be filed within 180 days of when you knew or should have known of the alleged violation (this may be extended for good cause). MentraNote will not retaliate against any individual for filing a good-faith complaint.

14.3 No Retaliation

MentraNote strictly prohibits retaliation of any kind against any individual who exercises their HIPAA rights, files a complaint, or participates in any investigation or proceeding related to HIPAA compliance. Any retaliation by MentraNote employees or agents will be subject to disciplinary action up to and including termination.

15. Record Retention

MentraNote maintains all HIPAA-related policies, procedures, and documentation for a minimum of 6 years from the date of creation or the date when the policy or procedure was last in effect, whichever is later, as required by 45 C.F.R. § 164.530(j). This includes:

• This Notice of Privacy Practices;
• All BAAs executed with Covered Entities and subcontractors;
• PHI access and audit logs;
• Breach notification records and risk assessments;
• Security policies and risk analysis documentation;
• Workforce training records.

Clinical data (PHI) uploaded by Subscribers is retained per the terms of the BAA and is available for export for 30 days following account closure, after which it is permanently deleted within an additional 30 days.

16. Changes to This Notice

MentraNote reserves the right to change the terms of this Notice at any time, and to make new provisions effective for all PHI maintained by MentraNote, including PHI created or received prior to the effective date of the revised Notice. When this Notice is revised, MentraNote will:

• Post the revised Notice on the MentraNote website with the updated effective date;
• Notify all Subscribers by email of any material changes to this Notice at least 30 days before the effective date;
• Maintain a version history of this Notice and make prior versions available upon request.

17. Contact Information

For HIPAA compliance questions, BAA requests, PHI-related complaints, or any other matter covered by this Notice: