We are committed to protecting the privacy of clinicians and the patients they document

Note Reviewer is a browser extension developed and maintained by Infinity Code LLC, a technology company dedicated to building productivity tools for healthcare professionals. Our secure API infrastructure is hosted at infinitycodellc.com.

If you have any questions about this Privacy Policy, please contact us at info@notereviewer.org.

When you use Note Reviewer, the extension reads the clinical note text visible on your active browser tab — only when you explicitly trigger the analysis by activating the side panel. This text may include session descriptions, behavioral observations, and goal progress notes authored by BCBAs.

If you choose to use the Management Panel, the extension also processes the treatment plan documents you upload — BIPs and assessments — to build the client records used to check notes against the plan. Uploading is optional; reviews run without it.

We do not collect or process:

The note text you submit is used solely to generate real-time quality and compliance suggestions. The processing pipeline is as follows:

We do not store clinical note content on our servers. After the AI analysis is complete and the response is sent back to your browser, all submitted text is discarded from memory and is not persisted in any database, file system, or log.

Client records you create in the Management Panel — the treatment plan data extracted from documents you upload — are retained under your account so reviews can be checked against the plan, and remain available for you to edit or delete at any time. [Placeholder — confirm retention period and deletion policy with legal.]

Your API key — required to authenticate with the AI provider — is stored exclusively in your browser's local storage using the browser Extension Storage API. It never leaves your device and is never transmitted to our servers.

We may retain anonymized, aggregate usage metrics (e.g., number of analyses performed per day) for the sole purpose of monitoring service reliability. These metrics contain no content from your notes.

We implement industry-standard security controls to protect the data you submit:

We do not sell, rent, or share your data with third parties for advertising, marketing, or any commercial purpose.

The note text you submit is processed by the AI model provider that you configure via your API key. That provider's own privacy policy and terms of service govern their handling of data. We strongly recommend reviewing the privacy documentation of your chosen AI provider.

We may disclose data only if required by law, court order, or to protect the rights and safety of our users — and solely to the minimum extent necessary.

Note Reviewer is HIPAA compliant. The extension is built to the Privacy, Security, and Breach Notification Rules, and is designed to assist BCBAs in improving the quality of their documentation without placing Protected Health Information at risk.

Our compliance rests on the architecture itself: note content is not logged or persisted beyond the immediate processing window, your API key never leaves your browser, all traffic is encrypted in transit via TLS, and your original notes are never modified.

If your organization requires a Business Associate Agreement (BAA), please contact us at info@notereviewer.org to discuss your needs.

You have the right to:

To exercise any of these rights, contact us at info@notereviewer.org.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this page periodically. Continued use of the Note Reviewer extension after changes are posted constitutes your acceptance of the updated policy.

If you have any questions, concerns, or requests related to this Privacy Policy, please reach out to us: