Privacy Policy

1. Who We Are

MentraNote Inc. ("MentraNote," "we," "us," or "our") is a Delaware corporation that operates an AI-powered mental health electronic health record (EHR) platform. Our registered address and principal place of business is in the United States. MentraNote acts as a data controller with respect to account and usage data of clinicians and organization administrators, and as a data processor (or Business Associate under HIPAA) with respect to Protected Health Information (PHI) uploaded by Subscribers.

For questions or concerns about this Privacy Policy or our data practices, please contact our Privacy Team at privacy@mentranote.com or our general support at support@mentranote.com.

2. Scope and Applicability

This Privacy Policy applies to:

• All users of the MentraNote web and mobile applications;
• Visitors to our website at mentranote.com and related subdomains;
• Individuals who communicate with MentraNote by email, phone, or other means.

This Policy does not apply to the clinical data of patients/clients whose information is processed by MentraNote on behalf of Subscribers. Such data is governed by the applicable BAA and relevant state and federal health privacy laws, including HIPAA. Patients seeking information about how their therapist or healthcare provider handles their records should contact their provider directly.

3. Data We Collect

3.1 Account and Registration Data

When you register for a MentraNote account, we collect: full legal name, email address, professional license number and issuing state, professional title/role, organization affiliation (if applicable), phone number (optional for SMS notifications), and password (stored as a bcrypt hash — never in plaintext).

3.2 Subscription and Payment Data

We collect information necessary to process your subscription, including billing address, subscription plan, and billing cycle. Payment card processing is handled exclusively by Stripe, Inc. MentraNote does not receive, store, or process raw payment card numbers, CVVs, or full card data. We receive only tokenized references and last-four-digit summaries from Stripe for account management purposes.

3.3 Clinical Data (PHI)

Subscribers may upload, create, or generate clinical data on the Platform, which may constitute Protected Health Information (PHI) under HIPAA, including: client demographic information, session notes, treatment plans, diagnoses, session recordings, transcripts, AI-generated notes, assessments, and other clinical documentation. This data is processed solely as directed by the Subscriber under our BAA and applicable law.

3.4 Usage and Technical Data

We automatically collect technical information when you use the Platform, including: IP address, browser type and version, operating system, device identifiers, pages visited and features used, timestamps of access, referring URLs, session duration, and error logs. This information is used for security, troubleshooting, and improving Platform performance.

3.5 Communications Data

If you contact our support team, submit a bug report, or communicate with MentraNote by email or through in-app channels, we collect and retain those communications to resolve your inquiry, improve our services, and for legal compliance purposes.

3.6 Data Collected via Cookies

We use cookies and similar tracking technologies as described in Section 9 of this Policy.

3.7 Summary of Data Categories

Data Category	Examples	Retention Period	Is it PHI?
Account Data	Name, email, license number	Duration of account + 5 years	No
Payment Data	Billing address, Stripe token	7 years (tax compliance)	No
Clinical Data	Session notes, transcripts, assessments	Per BAA; deleted 30 days after account closure	Yes
Session Recordings	Video/audio recordings	365 days from recording date	Yes
Usage & Technical Data	IP address, access logs	90 days rolling	No
Support Communications	Emails, chat transcripts	3 years from last interaction	No
Cookie Data	Session tokens, preferences	Session or up to 12 months	No

4. How We Use Your Data

MentraNote uses collected data for the following purposes:

• Service Delivery: Providing, maintaining, and improving the Platform and its features;
• Account Management: Managing your account, verifying your identity, and communicating with you about your account;
• Billing and Payments: Processing subscription fees, issuing invoices, and managing billing disputes;
• Security and Fraud Prevention: Detecting, investigating, and preventing unauthorized access, fraudulent activity, and security incidents;
• Legal Compliance: Complying with applicable laws, regulations, court orders, and government requests, including HIPAA, HITECH, GDPR, and CCPA;
• Customer Support: Responding to your support requests and resolving issues;
• Product Improvement: Analyzing aggregated, anonymized usage data to understand how the Platform is used and to improve its features and performance;
• Communications: Sending transactional emails (such as account confirmation, password reset, subscription receipts, and security alerts) and, where you have consented, marketing communications about Platform features and updates;
• AI Feature Improvement (opt-in only): Using de-identified, anonymized clinical data to improve AI features, only with your express written opt-in consent.

We will not use your data for any purpose that is incompatible with the purposes described above without your prior notice and, where required, consent.

5. Legal Bases for Processing (GDPR)

For users located in the European Economic Area (EEA), the United Kingdom, or Switzerland, MentraNote processes personal data on the following legal bases:

• Contract Performance (Art. 6(1)(b) GDPR): Processing necessary to provide the Services you have subscribed to, including account management and billing;
• Legitimate Interests (Art. 6(1)(f) GDPR): Processing for security, fraud prevention, product improvement, and business operations, where our interests are not overridden by your rights;
• Legal Obligation (Art. 6(1)(c) GDPR): Processing required to comply with applicable law, including tax, financial reporting, and breach notification obligations;
• Consent (Art. 6(1)(a) GDPR): Processing for marketing communications and optional AI model improvement, where you have provided explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal;
• Vital Interests (Art. 9(2)(c) GDPR): Processing of sensitive health data where necessary to protect the vital interests of data subjects in emergency situations.

6. Data Retention

MentraNote retains data for the minimum period necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods are:

• Account and Registration Data: Retained for the duration of your account plus 5 years following account closure, or as required by applicable law;
• Clinical Data / PHI: Retained for the duration of your subscription. Upon account closure, clinical data is available for export for 30 days, after which it is permanently deleted from our systems within an additional 30 days (60 days total from closure date);
• Session Recordings: Automatically flagged for deletion notification at 335 days and permanently deleted at 365 days from the recording date, consistent with HIPAA documentation retention standards;
• Payment Records: Retained for 7 years from the date of the transaction to comply with IRS and financial record-keeping requirements;
• Technical and Access Logs: Retained for a rolling 90-day window for security purposes;
• Support Communications: Retained for 3 years from the date of last interaction;
• Audit Logs (PHI Access): Retained for 6 years from the date of creation, consistent with HIPAA documentation requirements (45 C.F.R. § 164.530(j)).

After the applicable retention period expires, data is securely deleted or anonymized using industry-standard methods.

7. Data Sharing and Disclosure

MentraNote may share your data with third parties only in the following limited circumstances:

• Service Providers and Sub-Processors: We engage vetted third-party vendors to assist in delivering the Platform (see Section 8). All sub-processors are subject to data processing agreements that require them to maintain the confidentiality and security of your data;
• Business Transfers: In the event of a merger, acquisition, asset sale, or reorganization, your data may be transferred to the successor entity, subject to the same privacy protections as this Policy. We will notify you via email and/or prominent notice on the Platform at least 30 days before any such transfer;
• Legal Requirements: We may disclose data when required by applicable law, court order, subpoena, or government request, or when we believe in good faith that disclosure is necessary to: (a) comply with a legal obligation; (b) protect the rights or safety of MentraNote, our users, or the public; or (c) detect, prevent, or address fraud or security incidents;
• With Your Consent: We may share data with third parties with your prior explicit consent;
• Professional Liability: In the limited event of a legal dispute, we may disclose data to our legal counsel, insurers, or courts as necessary.

We never share PHI with advertisers, data brokers, analytics companies (other than de-identified aggregated data), or any entity that would use it for commercial profiling purposes.

8. Third-Party Sub-Processors

MentraNote uses the following vetted sub-processors to deliver the Platform. Each sub-processor has executed appropriate data protection agreements and, where applicable, HIPAA Business Associate Agreements:

Sub-Processor	Purpose	Data Shared	Location
Amazon Web Services (AWS)	Cloud hosting, databases, object storage	All data (encrypted at rest)	US-East (Virginia)
Stripe, Inc.	Payment processing	Billing info, payment tokens	USA / Global
OpenAI / Groq	AI note generation	De-identified/sanitized transcripts	USA
Jitsi / 8x8	Video session infrastructure	Video/audio streams (E2E encrypted)	USA / EU
Resend / SendGrid	Transactional email delivery	Email address, notification content	USA
Redis Labs / Upstash	Session management, token revocation	Session tokens (no PHI)	USA

We review sub-processor security practices annually. We will notify Subscribers of any material changes to our sub-processor list with 30 days' prior notice. An up-to-date list of sub-processors is available on request at privacy@mentranote.com.

9. Cookies and Tracking Technologies

9.1 Types of Cookies We Use

• Strictly Necessary Cookies: Required for the Platform to function, including authentication session cookies (stored in HttpOnly, Secure, SameSite=Strict cookies to prevent XSS and CSRF attacks). These cannot be disabled;
• Functional Cookies: Store your preferences such as language, theme, and dashboard layout settings;
• Analytics Cookies: Used to understand how users interact with the Platform (e.g., page visits, feature usage) using aggregated, anonymized data. We do not use Google Analytics on pages where PHI may be present;
• Security Cookies: Used for fraud detection and to identify suspicious activity.

9.2 No Third-Party Advertising Cookies

MentraNote does not use advertising cookies, retargeting cookies, or any cookies that track your activity across third-party websites for commercial purposes. We do not allow third-party advertisers to place cookies on the Platform.

9.3 Cookie Management

You can manage or delete non-essential cookies through your browser settings. Disabling strictly necessary cookies will impair the functionality of the Platform. For cookie-specific preferences, you may also use the cookie preference center available at the bottom of our public website pages.

10. AI Features and PHI Handling

When you use AI Features on the Platform (such as AI note generation, session transcript analysis, or clinical insights), the following data handling practices apply:

• De-identification before AI processing: Before any session content is sent to third-party AI providers (such as OpenAI or Groq), MentraNote applies de-identification techniques consistent with HIPAA Safe Harbor standards (45 C.F.R. § 164.514(b)) to remove or mask personally identifiable information;
• No AI training on clinical data (default): Your clinical notes, session transcripts, and client data are never used to train, fine-tune, or improve third-party AI models by default. This opt-out is applied at the API level through data processing agreements with our AI providers;
• AI provider data retention: De-identified prompt data sent to AI providers is subject to their respective data retention policies. We select providers who do not retain API inputs for model training by default;
• Audit trail: All AI feature invocations are logged in our audit system, recording the user ID, timestamp, feature used, and de-identified data inputs. No raw PHI is retained in AI logs.

11. Your Rights Under GDPR

If you are located in the EEA, United Kingdom, or Switzerland, you have the following rights with respect to your personal data under the General Data Protection Regulation (GDPR) and applicable national implementing legislation:

• Right of Access (Art. 15): You have the right to obtain confirmation of whether we process your personal data and to receive a copy of that data, along with information about how it is processed;
• Right to Rectification (Art. 16): You have the right to request correction of inaccurate or incomplete personal data;
• Right to Erasure / "Right to be Forgotten" (Art. 17): You may request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where consent is withdrawn, or where processing is unlawful. Note that certain data must be retained for legal compliance purposes;
• Right to Restriction of Processing (Art. 18): You may request that we restrict processing of your data in certain circumstances, such as while disputing the accuracy of your data;
• Right to Data Portability (Art. 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller;
• Right to Object (Art. 21): You may object to processing based on legitimate interests or for direct marketing purposes;
• Rights Related to Automated Decision-Making (Art. 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce significant legal or similarly significant effects. MentraNote does not make fully automated decisions that produce legal effects for users;
• Right to Lodge a Complaint: You have the right to lodge a complaint with the supervisory authority in your EU member state or the UK Information Commissioner's Office (ICO).

To exercise any of these rights, submit a written request to privacy@mentranote.com. We will respond within 30 days of receipt. We may require identity verification before processing your request.

12. Your Rights Under CCPA / CPRA

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the sources, the purposes of collection, and the categories of third parties with whom we share it;
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions;
• Right to Correct: You have the right to request correction of inaccurate personal information;
• Right to Opt Out of Sale or Sharing: MentraNote does not sell or share personal information for cross-context behavioral advertising. However, you may submit a "Do Not Sell or Share My Personal Information" request at privacy@mentranote.com;
• Right to Limit Use of Sensitive Personal Information: To the extent we process sensitive personal information (as defined by CPRA), you may request limitation of its use;
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights. We will not deny services, charge different prices, or provide a lower quality of service based on your exercise of these rights.

To exercise your CCPA/CPRA rights, submit a verifiable consumer request to privacy@mentranote.com. We will respond within 45 days, with an extension of up to 45 additional days where reasonably necessary.

Note regarding medical information: PHI and medical information collected in the context of clinical care may be exempt from certain CCPA/CPRA provisions where covered by HIPAA or CMIA (California Confidentiality of Medical Information Act).

13. HIPAA Patient Rights

If you are a patient or client whose records are stored on the MentraNote Platform by your therapist or healthcare provider, your HIPAA privacy rights are primarily governed by your provider's Notice of Privacy Practices, not this Policy. MentraNote processes your information as a Business Associate acting on behalf of your provider (the Covered Entity). To exercise HIPAA rights (such as access, amendment, or restriction of your health records), please contact your therapist or healthcare provider directly.

For more information about how MentraNote handles PHI, see our HIPAA Notice of Privacy Practices.

14. Data Security

MentraNote implements industry-leading security measures to protect your data, including:

• AES-256-CBC Encryption at Rest: All clinical data and PHI is encrypted at rest using AES-256-CBC encryption with regularly rotated keys;
• TLS 1.3 in Transit: All data transmitted between clients and servers is encrypted using TLS 1.3. We enforce HTTPS with HSTS headers and do not support downgraded TLS connections;
• HttpOnly, Secure Cookies: Authentication tokens are stored in HttpOnly, Secure, SameSite=Strict cookies, preventing JavaScript access and CSRF attacks;
• Two-Factor Authentication (2FA): 2FA is mandatory for all accounts to prevent unauthorized access;
• Role-Based Access Control (RBAC): Strict RBAC ensures users can only access data appropriate to their role;
• PHI Audit Logging: Every access, modification, and deletion of PHI is logged with user ID, timestamp, and IP address, maintained for 6 years;
• Penetration Testing: Annual third-party security audits and penetration testing;
• VPC Isolation: Databases are isolated in a Virtual Private Cloud (VPC) with no public internet exposure.

Despite these measures, no method of transmission or storage is 100% secure. In the event of a security incident, we will follow our Breach Notification Protocol as described in Section 15.

15. Breach Notification

In the event of a data breach involving unsecured PHI or personal data, MentraNote will:

• Notify affected Subscribers (Covered Entities) of a breach of unsecured PHI within 60 days of discovery, consistent with 45 C.F.R. § 164.410 (HIPAA Breach Notification Rule);
• Notify affected individuals directly where required by applicable law and as directed by the Covered Entity;
• Notify the U.S. Department of Health and Human Services (HHS) as required by the HIPAA Breach Notification Rule;
• Notify applicable state regulators and affected individuals within the timeframes required by applicable state breach notification laws;
• For EEA users, notify the relevant supervisory authority within 72 hours of discovery, where required under GDPR Art. 33;
• Provide affected individuals with information about the nature of the breach, data involved, steps taken, and protective measures they can take.

16. International Data Transfers

MentraNote's servers are located in the United States (AWS US-East region). If you access the Platform from outside the United States, your data will be transferred to, stored in, and processed in the United States. The U.S. may have different data protection standards than your country of residence.

For EEA/UK users, where personal data is transferred to the U.S., MentraNote relies on: (a) Standard Contractual Clauses (SCCs) approved by the European Commission; and/or (b) adequacy decisions where applicable. A copy of the applicable transfer mechanisms is available upon request at privacy@mentranote.com.

17. Children's Privacy

The MentraNote Platform is not directed to children under the age of 13 (or 16 in the EEA), and we do not knowingly collect personal data from children under these ages. The Platform is designed for use by adult licensed mental health professionals. If you believe that we have inadvertently collected information from a minor, please contact us immediately at privacy@mentranote.com.

Note: Therapists may lawfully store session notes relating to minor clients in the Platform as part of their clinical practice. Such data is subject to HIPAA, applicable state minor privacy laws, and the BAA, and is processed on behalf of the clinician Subscriber (the Covered Entity).

18. Changes to This Privacy Policy

MentraNote reserves the right to update this Privacy Policy at any time. We will provide notice of material changes by: (a) posting an updated version of the Policy on the Platform with a revised "Effective Date"; (b) sending an email notification to the address on your account at least 30 days before material changes take effect; and (c) displaying a prominent in-app notification.

Your continued use of the Platform after the effective date of any change constitutes your acceptance of the updated Policy. If you object to any changes, your sole remedy is to discontinue use of the Platform and close your account before the effective date of the change.

19. Contact and Data Protection Officer

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: