Skip to main content

🔒 Security & Privacy

Noted handles protected health information, and the platform is shaped around that fact.

Data protection​

  • Encryption at rest — patient details, note contents, and sensitive record values (like SSNs) are encrypted in the database, not stored as plain text.
  • Encryption in transit — every connection between the apps and Noted's servers is TLS-encrypted.
  • Sensitive record values are additionally masked in the interface: hidden behind an explicit reveal on the nurse's profile, and never shown in agency-wide listings at all.

Access control​

  • Role scoping — nurses see only their assigned patients; admins see their own agency and nothing beyond it. Every request is checked server-side; the apps never enforce access on their own.
  • Audit logging — reads and writes of clinical data are logged with who, what, and when — the trail an audit expects.
  • Session security — sessions expire and refresh continuously. Opening the mobile app cold always requires your password, and certain security events require re-entering it mid-session on the web too.
  • Two-factor sign-in — web sign-in confirms a 6-digit code sent to your email.

On your phone​

  • Note drafts are stored encrypted on the device and are scrubbed on sign-out. A draft belongs to the account that wrote it — another user signing in on the same phone can't see it.
  • Push notifications never carry health information — no patient names, no credential names. The notification says something needs attention; the app says what.

AI processing​

Written notes are generated through OpenAI's API under a zero-data-retention agreement and healthcare BAA: visit content is processed to produce the note, then not retained and never used for training. See AI Note Generation.

Your data, your rights​