Privacy Policy

This Privacy Policy explains how ClinicalWriter Pro LLC (“ClinicalWriter Pro,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you access or use the ClinicalWriter Pro website, application, and related services (collectively, the “Service”). By using the Service, you agree to the practices described below.

1. Information we collect

1.1 Information you provide

When you register or use the Service, you may provide:

• Account information — your name, email address, password (stored hashed), practice or organization name, role, and billing contact.
• Payment information — card and billing details, processed by our payment processor (Stripe). We do not store full card numbers on our servers.
• Content you generate — prompts, source notes, draft documents, templates, and outputs created using the Service.
• Support communications — messages you send to us via email or in-app support.

1.2 Protected Health Information (PHI)

Customers with an active BAA may submit PHI through the Service for the purpose of generating, editing, and storing clinical documentation. PHI is handled in accordance with the HIPAA Privacy Rule (45 CFR Part 164, Subpart E), HIPAA Security Rule (45 CFR Part 164, Subpart C), and the executed BAA. We use, disclose, and safeguard PHI only as permitted by your BAA and applicable law.

1.3 Information collected automatically

When you use the Service we automatically collect limited technical information, including IP address, browser type and version, device identifiers, pages visited, timestamps, and audit-log events tied to your account. This information is used for security, fraud prevention, and to operate and improve the Service.

1.4 Cookies and similar technologies

We use first-party session cookies to keep you signed in and to maintain CSRF protection. We do not use third-party advertising cookies. You can disable cookies in your browser, but the Service will not function correctly without session cookies.

2. How we use information

We use the information we collect to:

• provide, maintain, and improve the Service;
• authenticate your account and prevent unauthorized access;
• process payments and manage subscriptions;
• generate, store, and retrieve the documents you create;
• respond to your support requests;
• monitor for security incidents, abuse, and policy violations;
• comply with legal obligations and enforce our Terms of Service.

We do not sell personal information, and we do not use PHI for marketing, advertising, or model training.

3. AI processing and subprocessors

The Service uses large-language-model APIs to generate document drafts. When you submit content for generation, that content is transmitted to our AI subprocessor under contractual protections that prohibit training on customer data and that, for PHI, are governed by a downstream BAA. Our principal subprocessors are:

• Anthropic, PBC — language-model inference (HIPAA-eligible under a BAA).
• Stripe, Inc. — payment processing.
• Our hosting and email providers — for application hosting, database storage, and transactional email.

A current list of subprocessors is available on request at structofy@gmail.com.

4. How we share information

We share information only as follows:

• Service providers / subprocessors — as described in Section 3, subject to written agreements that restrict their use of the information.
• Within your organization — content you generate may be visible to other authorized users on your practice or organization account.
• Legal compliance — when required by law, court order, subpoena, or to protect the rights, property, or safety of ClinicalWriter Pro, our users, or the public. We will notify the affected customer where legally permitted.
• Business transfers — in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality protections and, for PHI, continued BAA protections.

5. Security

We implement administrative, physical, and technical safeguards designed to meet the HIPAA Security Rule, including:

• encryption of data in transit (TLS 1.2+) and at rest (AES-256);
• password hashing using industry-standard algorithms;
• role-based access controls and least-privilege provisioning;
• audit logging of access to PHI and administrative actions;
• session-based authentication with CSRF protection;
• regular vulnerability monitoring and incident-response procedures.

No method of transmission or storage is perfectly secure. In the event of a breach of unsecured PHI, we will notify affected customers in accordance with 45 CFR Part 164, Subpart D and the terms of the applicable BAA.

6. Data retention

We retain account information for the life of your account and for a reasonable period thereafter to satisfy legal, accounting, and audit obligations. Documents and PHI are retained per your subscription plan and the terms of your BAA. You may request deletion of your account and associated content at any time by emailing structofy@gmail.com.

7. Your rights and choices

Depending on where you live, you may have rights regarding your personal information, including the right to access, correct, port, delete, or restrict processing of your information, and to object to processing or withdraw consent. To exercise any of these rights, contact us at structofy@gmail.com. We will respond within the timeframes required by applicable law.

For PHI, your rights are governed by HIPAA and are exercised through the Covered Entity that controls the PHI, not directly through ClinicalWriter Pro.

8. Children

The Service is not directed to, and we do not knowingly collect personal information from, children under 18. If you believe a child has provided information to us, please contact structofy@gmail.com and we will delete it.

9. International users

The Service is operated from the United States. If you access the Service from outside the United States, you consent to the transfer, storage, and processing of your information in the United States, which may have different data-protection laws than your jurisdiction.

10. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated by email to the address on file or by a prominent notice in the Service. The “Effective” date above will reflect the most recent revision.

11. Contact us

For privacy questions, BAA requests, data subject requests, or breach inquiries, contact:

ClinicalWriter Pro LLC
Connecticut, United States
Email: structofy@gmail.com