Privacy Policy

MosaicNotes ("we," "us," or "our") operates the MosaicNotes platform, a therapy practice management application that provides session recording, AI-assisted clinical documentation, scheduling, and related services (the "Service"). This Privacy Policy describes how we collect, use, disclose, and protect your information when you use the Service.

1. Scope

This Privacy Policy applies to all users of the Service, including clinicians, practice administrators, supervisors, and other authorized personnel ("Users"). Patient-related data entered into the Service is processed on behalf of the clinician or practice. Our handling of Protected Health Information ("PHI") is governed by the Business Associate Agreement ("BAA") between MosaicNotes and the applicable covered entity.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, professional license type, organization name, and phone number.

Clinical Data

The Service processes session recordings (audio), transcripts, clinical notes, client records, scheduling information, and related treatment documentation. This data is entered and controlled by you, the clinician. We process it solely to provide the Service.

Usage and Technical Data

We automatically collect device information, browser type, IP address, pages visited, and usage patterns to maintain and improve the Service.

Payment Information

Payment processing is handled by Stripe. We do not store your full credit card number. Stripe's privacy policy governs the handling of your payment data.

Third-Party Integrations

If you connect third-party services, we collect and store data necessary to provide the integration. The specific data collected depends on the service:

Google Calendar. When you connect your Google Calendar account, we access and store the following data from your Google account:

• OAuth authentication tokens (encrypted at rest using AES symmetric encryption)
• Your Google email address and selected calendar identifier
• Calendar event metadata: event titles, start/end times, attendee email addresses, and event identifiers
• Your Google Calendar timezone setting

Attendee email addresses from your calendar events are compared against your existing client records solely to match appointments with the correct client. We do not store calendar event descriptions, attachments, conference links, or other event content beyond what is listed above.

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process session recordings and generate AI-assisted clinical documentation
• Facilitate scheduling and calendar synchronization — specifically, Google Calendar data is used to import your calendar events into MosaicNotes, match events to client records using attendee email addresses, and create corresponding Google Calendar events when you schedule sessions in MosaicNotes
• Process payments and manage subscriptions
• Send service-related communications (e.g., session reminders, account notifications)
• Monitor and improve the security, performance, and reliability of the Service
• Comply with legal obligations

4. AI Processing

The Service uses artificial intelligence to transcribe session recordings and generate clinical note drafts. Audio recordings and transcripts are sent to third-party AI subprocessors solely for processing purposes. These providers are bound by data processing agreements and do not use your data to train their models. You are responsible for reviewing and approving all AI-generated content before use in clinical records.

5. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service Providers: Third-party vendors who assist in operating the Service (e.g., cloud hosting, payment processing, AI processing), bound by confidentiality and data processing agreements.
• Within Your Organization: Other authorized members of your practice or organization, as determined by your organization's role-based access settings.
• Legal Requirements: When required by law, court order, or governmental regulation, or to protect the rights, safety, or property of MosaicNotes or others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.

Google Calendar data is only shared with Google's servers to read and create calendar events on your behalf. We do not transfer, disclose, or share your Google Calendar data with any other third parties, advertising platforms, data brokers, or information resellers.

6. HIPAA Compliance

MosaicNotes is designed to support HIPAA compliance for covered entities. We enter into Business Associate Agreements with applicable customers. Our handling of PHI is governed by the terms of the applicable BAA, which takes precedence over this Privacy Policy to the extent of any conflict. Key safeguards include:

• Encryption of data in transit (TLS) and at rest
• Role-based access controls with row-level security
• Audit logging of data access and modifications
• Encrypted storage of third-party authentication tokens
• Minimum necessary use principle applied to all data processing

7. Data Security

We implement technical, physical, and administrative safeguards designed to protect your information. These include encryption, access controls, secure infrastructure, and regular security assessments. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Clinical data is retained in accordance with applicable healthcare records retention laws. When you delete your account, we will delete or de-identify your personal information within a reasonable timeframe, except where retention is required by law.

Google Calendar data. When you disconnect your Google Calendar integration from MosaicNotes, we immediately revoke and delete your stored Google OAuth tokens. Calendar synchronization link records (event identifiers used to map Google events to scheduled sessions) are retained for audit purposes but are no longer actively synced. Scheduled sessions that were created from Google Calendar imports remain in your MosaicNotes account as part of your clinical scheduling records. You may also revoke MosaicNotes' access to your Google account at any time through your Google Account permissions.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access, correct, or delete your personal information
• Export your data in a portable format
• Withdraw consent for optional data processing
• Object to certain processing activities

To exercise these rights, contact us at privacy@mosaicnotes.com.

10. Cookies and Tracking

We use cookies and similar technologies, including pixels and software development kits, to maintain your session and authentication state, understand how the Service is used, measure the effectiveness of our marketing, and deliver or personalize advertising. These technologies may collect device, browser, referral, campaign, and interaction information. We do not use or disclose client records, clinical information, or protected health information for advertising, and we do not sell personal information for money.

You can change your optional analytics and advertising choices at any time. We also honor Global Privacy Control browser signals by disabling personalized advertising measurement.

11. Children's Privacy

The Service is intended for use by licensed healthcare professionals and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

12. Google API Services Usage Disclosure

MosaicNotes' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only use Google Calendar data to provide and improve user-facing features of the Service that are prominent in our application (scheduling synchronization and calendar event management).
• We do not use Google Calendar data for serving advertisements, including retargeting, personalized, or interest-based advertising.
• We do not transfer or sell Google Calendar data to third parties, including advertising platforms, data brokers, or information resellers.
• We do not use Google Calendar data to determine creditworthiness or for lending purposes.
• Data obtained through Google APIs is never transmitted to, processed by, or used to create, train, or improve any artificial-intelligence or machine-learning model, whether ours or a third party's. Our AI features operate exclusively on content created within MosaicNotes by the practitioner and have no access to Google user data.
• We do not allow humans to read your Google Calendar data unless: (a) you have given affirmative consent for a specific message (e.g., for customer support at your request), (b) it is necessary for security purposes (e.g., investigating a bug or abuse), (c) it is required by applicable law, or (d) the data is aggregated and anonymized for internal operations.
• Google Calendar authentication tokens are encrypted at rest using symmetric encryption and are only decrypted server-side when actively synchronizing your calendar.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date. Your continued use of the Service after changes are posted constitutes acceptance of the revised policy.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at:

MosaicNotes
Email: privacy@mosaicnotes.com