Privacy Policy
Effective date: October 9, 2026
Chartflow Health, Inc. ("Chartflow", "we", "us", or "our") operates the Chartflow mobile application, web application, website, and browser extension (collectively, the "Service") — an AI-powered clinical documentation and operations platform built for home health agencies and their clinicians. We are committed to protecting the privacy of our users and to maintaining compliance with applicable law, including the Health Insurance Portability and Accountability Act (HIPAA).
This Privacy Policy explains what information we collect, how we use and share it, and the rights you have with respect to your data.
1. Information We Collect
Account Information
When you register for Chartflow we collect your name, email address, and professional role (e.g., registered nurse, physical therapist). If you sign in with Google, we receive your name, email address, and profile picture from Google (see §2, Google User Data). If you sign in with Apple, we receive your name and email address, or the private relay address Apple provides if you choose to hide your email. If you sign in with your phone number, we collect that number and use it to send you one-time sign-in codes. Your agency may also record your professional credentials — for example your National Provider Identifier (NPI) and license numbers — so they can be verified (see §5).
Patient-Visit Audio Recordings
Chartflow records the audio of patient visits that you initiate in the app. These recordings may contain protected health information (PHI). Audio is transmitted over encrypted connections to AssemblyAI for transcription and the resulting transcript to Google Cloud Vertex AI for draft-note generation (see §5 for both), and is stored encrypted as part of the clinical documentation record (see §6, Data Retention).
Transcripts and Generated Notes
The Service converts your audio recording into a text transcript and then uses AI to draft a clinical note. Both the transcript and the generated note are stored in your account and may contain PHI. You are responsible for reviewing, editing, and finalising all AI-generated content before it enters any medical record.
Patient Records Kept for Your Agency
When your agency uses Chartflow to run its operations, the Service also stores the patient information your agency enters or receives through it — for example demographics, addresses and phone numbers, insurance coverage, referrals and physician orders received by fax or at your agency's intake email address, visit schedules, assessments, and patient signatures. This information is PHI. We process it only on your agency's behalf, under our Business Associate Agreement with your agency, and store it encrypted as part of the medical record (see §6, Data Retention). The Service uses AI to read faxed and emailed documents and to draft records from them; your agency's staff review that work as your agency's settings require.
Visit Location (Electronic Visit Verification)
When you check in to or out of a scheduled visit, the app records your device's location and the time at that moment, as required by Electronic Visit Verification (EVV) rules for Medicaid-funded home health visits. Location is captured only at check-in and check-out, while the app is open; the app does not track your location in the background. Because a visit location is usually a patient's home, these records are PHI: they are stored encrypted with your agency's visit records and, where state EVV rules require it, sent on your agency's behalf to the state's EVV system. You can turn off location access for Chartflow at any time in your device settings.
Addresses Used for Scheduling
If your agency turns on location-based scheduling, the Service converts clinicians' starting addresses and patients' visit addresses into map coordinates and estimates drive times between them, so visits can be assigned and routed sensibly. This uses the addresses already in your agency's records; it does not use your device's location.
Usage and Technical Data
We collect standard server logs (IP address, browser or app version, timestamps, pages viewed) and crash-diagnostic data (via Firebase Crashlytics — device model, OS version, and stack traces; never audio, transcripts, or PHI). We use this information solely to operate and improve the Service. Optional product-usage analytics (Google Analytics for Firebase) are off by default and collected only if you enable them; you can turn them on or off at any time in the app (Settings → Data & Privacy). Analytics events never include audio, transcripts, or PHI.
Website Visitors
Our marketing website (chartflow.health) does not use advertising or analytics cookies, tracking pixels, or third-party trackers. Our hosting provider records standard server logs (IP address, browser type, pages requested, and timestamps), which we use only to operate and secure the site. If you email us, we use your message and address only to reply.
Billing Information
Subscription payments are handled by a PCI-DSS Level 1 certified payment processor. Chartflow does not store your full card number, CVC, or bank-account details — that information is held exclusively by the payment processor. We receive and store only non-sensitive billing identifiers (customer reference, subscription status, last-four digits of your card). Our payment processor never receives clinical data or PHI.
Browser Extension Data
The Chartflow browser extension operates as follows with respect to data. (1) Authentication token: the Chartflow web application relays the clinician's authentication identity token to the extension via the Chrome messaging API; the extension stores that token in chrome.storage solely to authenticate requests to the Chartflow backend. The token is cleared on sign-out or expiry. (2) Note content: the extension fetches the finalised clinical note from the Chartflow backend and writes it into the clinician's EHR charting form. Note content may contain PHI; it is held in memory only for the duration of the push operation and is not persisted by the extension. (3) EHR page content: the extension reads the DOM of the active EHR page solely to locate the correct form fields and to verify patient identity before writing, as a guard against writing to the wrong chart. (4) Field-mapping snapshots: when generating a new EHR field mapping, the extension captures an HTML snapshot of the EHR form. That snapshot is scrubbed to remove patient data before transmission to the Chartflow backend. (5) Diagnostic telemetry: the extension sends non-PHI diagnostic data (reason codes, field-discovery counts, frame-scan statistics) to the Chartflow backend to support reliability monitoring. No PHI is included in telemetry. The extension does not record audio and does not read or access any web page other than the EHR domains the clinician has explicitly granted access to.
2. Google User Data
This section explains how Chartflow accesses, uses, stores, shares, and deletes information we receive from Google ("Google user data").
What We Access
When you choose "Continue with Google", you authorize Google to share your name, email address, and profile picture with Chartflow (the openid, email, and profile scopes). That is the only Google user data we request from your Google account. We do not request access to your Gmail, Google Calendar, Google Drive, Google Contacts, or any other Google service, and we never see your Google password. (A separate, agency-level mailbox connection is described below.)
How We Use It
We use your Google name and email address only to create your Chartflow account, sign you in, keep your account secure, and identify you inside the Service — for example to colleagues in your agency and as the author of the notes you sign. We use your email address to send you account and service messages. We do not use Google user data for advertising, we do not sell it, and we do not use it to train or improve AI or machine learning models.
How We Store and Protect It
Your sign-in identity is held by Google Cloud Identity Platform, and your name and email address are stored in our encrypted database in Google Cloud data centers in the United States. Data is encrypted in transit (TLS 1.2+) and at rest, and access is limited to the personnel who need it to operate the Service (see §8, Security).
How We Share It
We do not share Google user data with third parties except: with the members of your agency's Chartflow workspace, who see your name and email address; with Google Cloud, which hosts the Service on our behalf; and when required by law. We do not transfer Google user data to advertising networks, data brokers, or information resellers.
Retention and Deletion
We keep your Google name and email address for as long as your account is active. If you delete your account (see §7, Your Rights), we delete your sign-in identity and remove your name and email address from your profile within 30 days. Notes you authored remain part of the medical record as described in §6. You can also remove Chartflow's access at any time from the "Third-party apps & services" page of your Google Account.
Your Agency's Google Workspace Mailbox
If your agency connects a Google Workspace intake mailbox (for example, an address where referral sources email referrals), your agency's Google Workspace administrator — not you — grants Chartflow read-only access (gmail.readonly) to that mailbox. We read messages in that mailbox only to import the referrals and attachments sent to it into your agency's records; we cannot send, change, or delete mail. Those messages usually contain PHI and are handled under our Business Associate Agreement with your agency, as described in §1. We do not access any other mailbox.
Limited Use
Chartflow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Chartflow does not use data obtained from Google Workspace APIs to develop, improve, or train generalized AI or machine-learning models.
3. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Service;
- Transcribe your audio recordings and generate draft clinical notes;
- Carry out your agency's administrative workflows at its direction — for example sending and receiving faxes, sending text-message notifications, checking insurance eligibility, submitting claims, verifying visits, importing referrals, and scheduling and routing visits;
- Verify clinicians' credentials for your agency, such as checking an NPI or license against public registries and government exclusion lists;
- Send transactional and administrative communications (account verification, billing receipts, security alerts);
- Comply with legal obligations;
- Detect, investigate, and prevent fraud and abuse.
We do not sell your personal information or PHI to third parties. We do not use your clinical data to train general-purpose AI models without your explicit consent.
4. Legal Basis for Processing
Where applicable law requires a legal basis, we process your personal information on the basis of contract performance (to provide the Service you signed up for), legitimate interests (security, fraud prevention, product improvement), and legal obligation. For PHI, our processing is governed by HIPAA and any Business Associate Agreement (BAA) in effect with your agency or covered entity.
5. Service Providers and Third Parties
We share information with a limited set of service providers (sub-processors) solely to deliver the Service. They fall into the following categories:
AssemblyAI, Inc. — Speech-to-text transcription
Patient-visit audio is transmitted to AssemblyAI to produce the text transcript. AssemblyAI operates under a Business Associate Agreement (BAA) with Chartflow, processes your audio solely to provide the Service, and is contractually prohibited from using your audio or transcripts to train its general-purpose AI models.
Google Cloud — Vertex AI (Gemini) — AI draft-note generation
Visit transcripts are processed by Google Cloud's Vertex AI language models (Gemini) to draft clinical notes and extract structured documentation fields. The same models power the Service's in-app assistant and the AI features that read faxed and emailed documents and draft records for your agency to review. This processing occurs under Google Cloud's HIPAA Business Associate Agreement; Google does not use your transcripts or notes to train its general-purpose AI models.
Google Cloud Platform — Hosting, storage, and data processing
The Service runs on Google Cloud Platform in United States regions under Google Cloud's HIPAA Business Associate Agreement. Google Cloud hosts our servers and encrypted databases and stores recordings, transcripts, notes, and documents. We also use Google Cloud services to extract the text of faxed and uploaded documents (Cloud Vision), to remove identifying details from data before any de-identified processing (Cloud Data Loss Prevention), to read the assistant's answers aloud on request (Cloud Text-to-Speech), and to search public regulatory reference material such as CMS manuals (Vertex AI Search).
Firebase (Google) — Sign-in, push notifications, crash reports, and optional analytics
Sign-in runs on Firebase Authentication backed by Google Cloud Identity Platform, which holds your sign-in identity (email address or phone number, and the Google or Apple account you link). Firebase Cloud Messaging delivers push notifications; their text never includes patient names or other PHI. Firebase Crashlytics receives crash reports (device model, OS version, and stack traces — never audio, transcripts, or PHI). Google Analytics for Firebase receives product-usage events only if you turn analytics on.
Microsoft Azure Maps — Address geocoding and drive-time estimates
When your agency turns on location-based scheduling, clinicians' starting addresses and patients' visit addresses are sent to Azure Maps (United States endpoint) to convert them into map coordinates and to estimate drive times between visits. No names, diagnoses, or other clinical details are sent with an address. Azure Maps is used under Microsoft's HIPAA Business Associate Agreement.
Sinch — Fax and text messaging
Faxes the Service sends and receives — such as referrals and physician orders, which contain PHI — are transmitted through Sinch, as are the text messages the Service sends (for example, visit and scheduling notifications). Sinch operates under Business Associate Agreements with Chartflow covering both fax and text messaging.
Stedi, Inc. — Healthcare clearinghouse (insurance eligibility and claims)
When your agency checks a patient's insurance eligibility or submits a claim through the Service, the patient, coverage, and service details the transaction requires are sent through Stedi to the patient's health plan (for example, Medicare or Medi-Cal), and the plan's response returns the same way. Stedi operates under a Business Associate Agreement with Chartflow.
Sandata Technologies — Electronic Visit Verification (EVV) aggregator
Where a state requires EVV for Medicaid-funded visits, the Service submits the visit record that state requires — the patient and clinician identifiers, the service provided, and the check-in and check-out times and locations — on your agency's behalf to the state's EVV aggregator, Sandata (for example, California's CalEVV system).
OpenRouter, Inc. — De-identified AI decision support (only if your agency enables it)
If your agency turns on automated decision features (for example, recommending whether to accept a referral), the Service may send de-identified case details to an AI model that OpenRouter routes to the model's provider. Neither operates under a Business Associate Agreement with Chartflow, so the Service is built to send them only de-identified data: before anything is sent, Google Cloud Data Loss Prevention and our own checks remove names, dates, addresses, record numbers, and the other identifiers HIPAA's Safe Harbor standard lists, and a request that still looks identifying is blocked. These features are off unless your agency turns them on.
Resend — Transactional email
Account emails — such as workspace invitations and other account notices — are sent through Resend. These emails never contain PHI.
Stripe, Inc. — Subscription billing
Stripe, a PCI-DSS Level 1 certified payment processor, handles subscription payments. Stripe never receives clinical data or PHI; we store only non-sensitive billing identifiers.
Public registries and government data sources — Credential checks and clinical reference lookups
To verify clinicians' credentials for your agency, the Service looks up a clinician's NPI in the national NPPES NPI Registry, checks the clinician's name and NPI against the federal SAM.gov exclusions list, verifies license numbers with state licensing boards (for example, the California Department of Consumer Affairs), and compares staff against government exclusion lists it downloads (the HHS-OIG LEIE and the Medi-Cal Suspended and Ineligible Provider List), which sends nothing. To code medications and diagnoses, the Service sends the drug or condition term alone — never any patient detail — to the U.S. National Library of Medicine's public RxNorm and Clinical Tables services.
Every service provider with whom we share your data is bound by written agreements — including BAAs where PHI is involved — requiring them to protect your data to a standard at least as protective as this policy. Health plans, state EVV systems, and the government registries above receive information because your agency directs a transaction that requires it, or because the law does. We do not share your data with advertising networks or data brokers. A current list of our sub-processors is available to customers and their compliance teams on request at hello@chartflow.health.
We may share information with law-enforcement or regulatory bodies when required by law, court order, or to protect the rights or safety of Chartflow, our users, or third parties.
6. Data Retention
We retain your account information for as long as your account is active. Clinical documentation — including visit audio recordings, transcripts, and generated notes — forms part of the medical record and is retained in encrypted storage for as long as required by applicable medical-record retention laws and any agreement with your agency or covered entity, even after your account is closed. If you delete your account, we delete your login credentials, profile, and device data within 30 days; clinical records are retained as described in §7 and remain subject to legal retention obligations. Billing records may be retained for up to 7 years to comply with financial reporting requirements.
7. Your Rights
Depending on your jurisdiction, you may have the following rights with respect to your personal information:
- Access: request a copy of the personal information we hold about you.
- Correction: request correction of inaccurate data.
- Deletion: you can request account deletion from within the app or by contacting us at hello@chartflow.health. We aim to delete your login, profile, and device data within 30 days of a verified request. Clinical notes, encounters, and medical records are retained as required by medical-record retention laws and remain attributed to you as the authoring clinician.
- Consent withdrawal: you can turn off optional usage analytics at any time in the app (Settings → Data & Privacy) and revoke microphone or location access in your device's system settings.
- Portability: you can download a copy of your data at any time using the "Download My Data" feature in the app (Settings → Data & Privacy).
- Objection / restriction: object to or request restriction of certain processing.
To exercise any right not available through the app, contact us at hello@chartflow.health. We will respond within 30 days.
If you are a patient whose PHI was captured during a home-health visit, your rights under HIPAA are governed by your provider's Notice of Privacy Practices. Please contact your clinician or agency directly.
8. Security
We implement administrative, technical, and physical safeguards designed to protect your information, including:
- Encryption in transit using TLS 1.2+ for all data transmitted between your device, our servers, and our sub-processors;
- Encryption at rest for all stored data, including audio recordings, transcripts, and clinical notes, using AES-256;
- Role-based access controls limiting data access to authorised personnel;
- Audit logging of access to PHI;
- Regular security assessments and penetration testing.
No method of transmission over the internet or method of electronic storage is 100% secure. If you believe your account has been compromised, contact us immediately at hello@chartflow.health.
9. Browser Extension
The Chartflow browser extension (Chrome MV3) exists for a single purpose: to transfer a completed Chartflow clinical note into the clinician's EHR charting form. It does not perform any function beyond that purpose.
Host Access Model
The extension declares static access only to the EHR domains Chartflow currently supports (Elation and Kinnser/WellSky). If Chartflow adds support for an additional EHR, the clinician is presented with a one-time Chrome permission prompt for that specific domain before any access is taken. The clinician may revoke access to any domain at any time from chrome://extensions.
No Advertising and No Sale of Data
The extension does not use data for advertising purposes. We do not sell extension data to third parties. We do not share extension data with advertising networks or data brokers.
Chrome Web Store Limited Use
Chartflow's use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use extension data only to provide and improve the extension's single purpose, we do not transfer it to third parties except as described in this policy, we do not use it for advertising, and we do not allow humans to read it except as described in §8 and §10.
Data Retention for Extension Data
The authentication token stored by the extension is cleared on sign-out or token expiry. The extension does not maintain its own long-term store of PHI; note content is held in memory only for the duration of the push operation and is not written to persistent extension storage.
For extension-specific privacy questions, contact us at hello@chartflow.health.
10. HIPAA and Business Associate Agreements
Chartflow is designed to support HIPAA-covered entities and their business associates. If your organisation is a covered entity or business associate under HIPAA, you may enter into a Business Associate Agreement (BAA) with Chartflow as part of your subscription. Contact hello@chartflow.health for details.
11. Children's Privacy
The Service is intended for licensed healthcare professionals. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us and we will delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, by sending an email to the address associated with your account. Your continued use of the Service after the effective date of any change constitutes your acceptance of the updated policy.
13. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:
Chartflow Health, Inc.Email: hello@chartflow.health