Privacy Policy

The short version

CareDraft is a clinical productivity tool that stores clinical work and runs note-generation AI on your device.

• CareDraft is intended for clinician-dictated, post-encounter, de-identified note drafting. It is not intended to record patient interactions or to capture patient identifiers.
• CareDraft LLC does not collect or store your clinical notes, dictations, transcripts, AI summaries, patient information, or other app content.
• Your saved work stays on your phone or tablet. We have no servers that store your work and no way to access it.
• The App downloads note-generation model files from Hugging Face. On iPhone and iPad, dictation is recognized on the device. On Android, live dictation uses the speech recognition service selected on your device. It can work offline when offline recognition is available, or the selected service may use provider network processing depending on its settings. CareDraft LLC does not receive the audio or transcript.
• Online Visit Router suggestions start off. Enabling them sends address searches and a search area to Photon / Komoot. Manual entry remains available.
• Android photo-to-text uses Google ML Kit, which processes images on-device but sends technical usage and diagnostic data to Google. See Section 4.4.
• We do not include advertising trackers. Expo over-the-air update checks are disabled; updates come through the app stores.
• We do not sell your personal information. We do not share it with advertisers.

If anything in this policy contradicts the short version, the longer text governs — but we have tried hard to make sure they say the same thing.

1. Who we are

CareDraft is published by CareDraft LLC ("we," "us," "our"), located at 95 Christmas Lane, Bunker Hill, WV 25413. You can contact us about this policy at [email protected].

CareDraft is a mobile software application (the "App"). This policy describes what limited information we collect, how it is used, and your rights.

This policy does not apply to: (a) websites or services we do not control, including the Hugging Face model hosting service and your device's selected speech recognition service; (b) your clinical employer's separate policies governing how you may use software with patient information; (c) other apps you may use on your device.

2. Important context: you are a clinician using a personal productivity tool

CareDraft is sold to individual clinicians as a personal productivity tool, similar to a notebook, a voice recorder, or a notes app. It is not sold to clinics, hospitals, or health systems.

CareDraft is intended for clinician-dictated, post-encounter, de-identified note drafting. It is not intended to record patient interactions or to capture patient identifiers. Timestamps shown in the App reflect when a draft was created in CareDraft and are not intended to represent encounter date, encounter time, or date of service unless you separately add that information.

CareDraft LLC is not a HIPAA Covered Entity. We are not a HIPAA Business Associate. We do not enter Business Associate Agreements. If your professional obligations under HIPAA, state medical privacy law, your employer's policies, or your malpractice insurance require a Business Associate Agreement before using a software tool with patient information, CareDraft is not the right tool for that use case, and you should not use it for that purpose.

You are solely responsible for:

• Determining whether your use of the App is permitted under your employer's policies, your professional licensure rules, and applicable law.
• Securing the device the App is installed on, including device-level encryption, screen-lock, and OS updates.
• Protecting your PIN, biometric credentials, and any recovery code we provide.
• Any decision to export, share, print, email, open addresses in a maps app, or otherwise transmit content you create in the App.

3. Information stored on your device (we do not have access to this)

When you use CareDraft, the following is created and stored locally on your device, never on CareDraft LLC's servers:

• Legacy saved audio recordings, if present; current live dictation does not save a separate audio recording
• Text transcriptions of those dictations
• AI-generated summaries, templates, and other note content
• Notes you type or edit manually
• Visit route stops, addresses, and mileage you enter for route planning
• Any patient identifiers, clinical details, or other information you enter
• Your settings and preferences (some non-clinical operational preferences may be stored locally without field-level encryption)

Clinical content and sensitive fields are encrypted at rest using AES-256-GCM with a random data-encryption key protected by the app PIN and platform secure storage. Your PIN is not stored; it is used with PBKDF2-HMAC-SHA512 to unwrap the local encryption key. If you enable biometric unlock, the App stores a separate biometric-protected copy of that encryption key in iOS Keychain or Android Keystore. CareDraft LLC does not store, back up, or have any technical means to access this information.

This means: if you lose your PIN and your recovery code, your data is permanently inaccessible. We cannot recover it. The App provides a recovery code at setup; you should store it in a safe place outside the App.

Content you choose to send out of the App. Some features hand content to other apps at your explicit request — for example, exporting, sharing, printing, or emailing a note, or opening a visit stop's address in your maps app for directions. For directions, CareDraft builds a Google Maps link and asks your device to open it; CareDraft itself makes no network connection. Once you confirm one of these actions, that content leaves CareDraft's encrypted storage and is handled by the receiving app under its own privacy policy. The App provides export warnings, some of which you can choose to dismiss for later actions. This includes copying a de-identified transcript for use with an external AI service: any provider you choose then handles that content under its own terms. We do not receive a copy through these handoffs.

4. Network connections and recipients

CareDraft LLC does not operate a clinical-content backend. The following providers can receive data directly from your device. Their receipt is still a data flow from the app even when CareDraft LLC does not receive a copy.

4.1 Model downloads (Hugging Face)

When you choose to download or replace a model, the App downloads AI model files used for on-device note generation. These files are hosted by Hugging Face and the App makes an HTTPS request to download them. This request conveys standard HTTP information (your IP address and user agent) to Hugging Face. It does not convey your clinical content.

Hugging Face's privacy practices are governed by Hugging Face's own privacy policy at https://huggingface.co/privacy. We do not receive this information ourselves.

4.2 Android speech recognition

On Android, live dictation is handed to the speech recognition service selected in your device settings. On supported devices it can work without a network connection when offline English recognition resources are available. Depending on the service, connectivity, and settings, the service may instead send speech to its provider for network processing. The provider's privacy policy and your device settings govern that processing. CareDraft LLC does not select the provider, receive the audio or transcript from the provider, or use that content for analytics or advertising. Because service behavior varies, use only de-identified dictation unless you have independently confirmed that the selected service and your use comply with your obligations.

On iPhone and iPad, CareDraft requires Apple's speech recognition to run on the device, so dictation is not sent off the device for recognition.

4.3 App Store / Play Store activity

When you download, install, or purchase the App, Apple and Google receive information about that transaction. Their handling of that information is governed by their own privacy policies. We may receive de-identified aggregate sales reports from Apple and Google, which contain no personal information. If you have chosen in your device settings to share diagnostics with app developers, Apple and Google may also give us crash reports and app performance statistics, which describe the device, operating system version, and where the App failed.

If you start the free AI drafting trial or buy the AI drafting unlock, Apple or Google processes that transaction and tells the App on your device which purchases you own. The App keeps your trial start date and purchase status on your device so AI drafting works offline. CareDraft LLC does not receive your payment details.

4.3a Optional Visit Router address suggestions

Online suggestions are off when you open Visit Router. Before any online search, a visible notice explains what is sent and the Enable online suggestions button asks for your choice. Typing manually without enabling suggestions does not contact Photon.

After you enable suggestions, address and city/ZIP queries go over HTTPS to Photon, operated by Komoot, to find nearby matches. Requests include the selected search center and ordinary network metadata such as your IP address. Coordinates are rounded to two decimal places, but this can still describe a small, potentially precise area. Do not assume rounding makes location anonymous.

With your opt-in, an already allowed device location can set the area; otherwise the city/ZIP portion of your saved home address may be searched. Use my location requests foreground location permission when needed. You can instead select a city/ZIP. There is no background location tracking.

Notes, dictations, stop titles, mileage, and whole saved routes are not uploaded for suggestions. Queries can contain visit addresses, so do not enter a patient identifier or use online search for an address you are not authorized to disclose. Search pauses when the screen is inactive or the app is in the background. Turn off suggestions cancels pending requests and stops new searches; leaving Visit Router also turns suggestions off. It cannot recall data already sent. Search history and the device search center are not saved to disk by this feature; addresses you choose to save in a route remain stored locally.

Komoot controls its service and retention. We do not promise that requests are anonymous, used only in memory, or immediately deleted. See Komoot's privacy policy.

4.4 Android photo-to-text (Google ML Kit)

Medication images and recognized text are processed on-device. Android uses the bundled Google ML Kit text-recognition SDK. Google documents collection of device/app details, an installation identifier, feature-use events and technical performance/error information for diagnostics and usage analytics over HTTPS. This technical reporting is separate from image and text recognition. CareDraft has no in-app switch that disables SDK technical reporting. See Google's ML Kit disclosure and Google's privacy policy. iOS uses Apple's on-device Vision framework instead.

4.5 Direct communications with us

If you email us at [email protected] or otherwise contact us directly, we will receive whatever information you choose to send. We use that information only to respond to you. We do not add you to marketing lists.

4.6 What CareDraft LLC does not receive

To be explicit, CareDraft LLC does not receive:

• The audio of your dictations
• The text of your notes, transcriptions, or summaries
• Patient names, identifiers, dates of birth, medical record numbers, diagnoses, treatments, or any other clinical information
• The addresses you enter for visit routing (they stay on your device unless you enable online address suggestions or choose to open them in your maps app)
• Your name, email address (unless you write to us), phone number, or other contact information
• Your location (optional address search can send a rounded search center directly to Photon as described above)
• Analytics events or usage telemetry from the App (crash reports reach us only through Apple and Google, as described in Section 4.3)
• Advertising identifiers

5. How information is used

Connections support model downloads, speech recognition, address matching, and Google SDK diagnostics and usage analytics as described above. Communications sent to CareDraft LLC are used to respond and handle requests. We do not use clinical content for advertising or sell it to marketers.

6. How information is shared

We do not sell personal information. We do not "share" personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act / California Privacy Rights Act (Cal. Civ. Code § 1798.140).

The provider connections and user-directed exports in Sections 3 and 4 disclose information to their recipients. We may also disclose information actually in our possession in the following narrow circumstances:

• To respond to a lawful subpoena, court order, or legal process (and we will resist any request that is overbroad or unlawful);
• To protect our legal rights or comply with legal obligations;
• In connection with a merger, acquisition, or asset sale, subject to a successor's agreement to honor this policy.

7. Your privacy rights

7.1 Rights that apply to everyone

You can exercise these rights at any time without contacting us:

• Local deletion: Delete saved items in the app or remove its app data. Uninstalling removes the app sandbox, but platform secure-store entries, previously exported files, copies in other apps, and provider records can require separate deletion. Device-level backup and retention behavior depends on the platform. CareDraft cannot remotely erase a device or a recipient's copy.
• Right to access: Your data is on your device, in the App. You can view, edit, and export it at any time.
• Right to opt out of selling/sharing: We do not sell or share personal information for advertising. There is nothing to opt out of.

7.2 California residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know what personal information we collect, use, disclose, and (if applicable) sell or share. See Section 4 above.
• Right to delete personal information. For information in our possession, contact us. We cannot retrieve or remotely delete local clinical content or guarantee deletion of records held independently by a provider. We will explain which records and recipients a request can address.
• Right to correct inaccurate personal information.
• Right to limit use of sensitive personal information. Information you input into the App may be "sensitive personal information" (including health information), but CareDraft LLC does not receive or use it.
• Right to non-discrimination for exercising your rights.

To exercise California rights, email us at [email protected]. We will verify your identity before responding to substantive requests. We will respond within 45 days as required by law.

7.3 Other US states

If you are a resident of a state with a comprehensive consumer privacy law (currently including Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia, with others taking effect), you have rights similar to those described in Section 7.2 under your state's law. To exercise them, email [email protected].

7.4 Washington residents (My Health My Data Act)

Washington residents have additional rights specifically governing consumer health data under the Washington My Health My Data Act (RCW 19.373). Those rights, and how to exercise them, are described in our separate Washington Consumer Health Data Privacy Policy, available at https://caredraft.app/privacy/washington.

7.5 Appeals

If we deny a privacy rights request and you wish to appeal, reply to our denial within 30 days. We will respond to your appeal within 60 days. If we deny your appeal, you may contact your state's attorney general.

8. Children's privacy

CareDraft is not directed to children under 13 and is not intended for use by children under 13. We do not knowingly collect information from children under 13. If you believe a child under 13 has used the App and provided information to us, contact us at [email protected] and we will investigate.

9. Security

We have designed the App to keep your information secure:

• All clinical content stored by the App on your device is encrypted using AES-256-GCM.
• Access to the App requires a PIN (4 to 6 digits) and supports biometric authentication (Face ID, Touch ID, or fingerprint).
• The PIN is processed using PBKDF2-HMAC-SHA512 key derivation to protect the local encryption key. The PIN itself is not stored.
• Optional biometric unlock uses a separate biometric-protected key in iOS Keychain or Android Keystore; it does not store or replay your PIN.
• Session keys exist only in device memory during an unlocked session and are cleared on app lock.

No security measure is perfect. The security of your information also depends on you: keep your device updated, use a strong device passcode, do not share your PIN, store your recovery code in a safe place, and use your device platform's lost-device controls if needed.

10. Data retention

Because we do not collect or store your clinical content, we do not retain it. Saved work remains on your device unless you export it or use a connected feature as described above. Local deletion does not delete exported copies or provider logs.

On-device automatic cleanup. To limit how much sensitive clinical content accumulates on your device, the App automatically prunes older notes, saved recordings, medication-list history, home exercise program history, and patient education history when it launches. By default, once one of those categories holds more than 50 entries, the App permanently deletes entries in that category older than 30 days, including associated encrypted audio. Both thresholds are adjustable in Settings → Data Retention. Mileage logs and vehicle expenses are intentionally retained for tax record-keeping until you delete them manually. Cleanup happens entirely on your device, and deleted content cannot be recovered.

For model-download metadata, address searches, speech-provider processing, Google ML Kit technical data, and app-store records, retention is governed by the respective provider's policies. CareDraft does not control those providers' retention or promise immediate deletion. Direct communications you send to us are retained as long as needed to respond and to maintain records of our correspondence, and then deleted.

11. International users

CareDraft is intended for a United States launch. If you are accessing the App from outside the United States, please be aware that we have not designed the App for use outside the United States, and our practices may not comply with the privacy laws of your country. If you wish us to support additional jurisdictions, contact us at [email protected].

12. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last Updated" date at the top of the policy. If we make material changes, we will provide additional notice through the App (such as a banner or prompt on next launch). Reading this policy does not enable optional online suggestions or grant device permissions; those choices remain separate.

13. Contact us

For privacy questions, requests, or complaints:

CareDraft LLC 95 Christmas Lane, Bunker Hill, WV 25413 Email: [email protected]

This policy describes CareDraft's actual data practices. It is provided for transparency and is not a substitute for individualized legal advice.