Privacy
Privacy Policy
SimaNotes LLC
Effective date: September 1, 2026
Last updated: September 1, 2026
1. Who we are
SimaNotes LLC (“SimaNotes,” “we,” “us”) is a Florida limited liability company. We build SimaNotes, an ambient clinical documentation tool that helps clinicians produce a draft visit note, and SimaSuites, the Chrome extension that delivers SimaNotes and related practice tools to a clinician’s browser.
We sell to medical practices. We do not sell to, contract with, or have a direct relationship with patients.
2. If you are a patient — please read this first
This policy is probably not the document you are looking for.
If your clinician uses SimaNotes, your health information is handled by us on behalf of your clinician’s practice, under a written Business Associate Agreement required by HIPAA. In that arrangement:
- Your practice, not SimaNotes, is responsible for your health information. We act only on the practice’s instructions and only as the agreement permits.
- Your rights run through your practice. To see your records, request a correction, ask who your information has been shared with, ask questions about recording, or withdraw your consent to be recorded, contact your clinician’s office. They can act on those requests; we cannot act on them directly, and we will refer any request we receive back to the practice.
- Your practice’s Notice of Privacy Practices, not this policy, describes how your health information is used and disclosed.
- Consent to recording is obtained by your practice, not by us. Florida law requires the consent of all parties to record a conversation. If you do not consent, tell the staff or your clinician — the visit is documented the traditional way and nothing is recorded.
The rest of this policy covers our website and our business customers.
3. Information we handle
3.1 Website visitors (simanotes.com)
simanotes.com is a static marketing site. It runs no analytics, no advertising or tracking technology, and no third-party scripts of any kind. Its webfonts are served from our own domain rather than from a font network, so loading a page does not disclose your visit to anyone else. The site’s Content Security Policy permits no third-party host at all, which is what keeps this true rather than merely intended.
Cookies. The site sets no cookies. If you choose a light or dark theme, that choice is stored by your own browser on your own device and is never sent to us.
- Information you send us. Our contact form asks for
your name, email address, practice name, your role, and your message.
We use it to answer you and to keep a record of the conversation. The
form is handled by Netlify Forms, the built-in form
service of our hosting provider — which means Netlify stores
each submission in addition to delivering it to us. The form
also carries one hidden field used solely to catch automated spam; it
collects nothing about you, and we use no CAPTCHA.
Please do not send patient information through this form. It is not a secure channel for it, and the form itself says so. If you are a patient, contact your clinician’s office — see §2.
- Server logs. Netlify records ordinary technical information about requests — IP address, timestamp, page requested, browser user-agent — for security and reliability. We do not combine it with other information or use it to build a profile of you.
- We do not use advertising or analytics trackers on this site.
3.2 Customer practices and their staff
When a practice becomes a customer, we handle:
- Account information — each user’s email address, name, role, and the practice they belong to. Authentication is managed through Amazon Cognito.
- Clinician preferences — a clinician’s own note-style settings (tone, level of detail, standing phrasings). These are the clinician’s professional preferences and contain no patient information.
- Operational records — audit logs of who accessed what and when, which HIPAA requires us to keep; error and performance logs; and per-visit cost records used for billing and capacity planning.
- Business contact and billing information for the practice.
Legal basis and use. We use this to provide the service, authenticate users, support customers, secure the system, meet our HIPAA obligations, and bill.
3.3 Patient health information — handled for the practice, not for us
When a clinician records a visit, we receive and process protected health information (PHI) solely on that practice’s behalf:
- Visit audio captured by the clinician, with the patient’s consent obtained by the practice.
- A transcript produced from that audio.
- A draft clinical note produced from that transcript, which the clinician reviews, edits, and signs in their own electronic health record. SimaNotes does not sign anything, does not practice medicine, and does not write to the medical record on its own — a person reviews and signs every note.
- Limited visit metadata, such as an appointment identifier and the clinician’s identity.
We use this information only to provide the documentation service to the practice, and for no purpose of our own. Specifically, we do not use it to develop, improve, or train products, to build profiles, or for any commercial purpose beyond delivering the service the practice bought.
4. The SimaSuites Chrome extension
This section describes what the extension does on a user’s computer. It is the section relevant to the Chrome Web Store listing.
Who uses it: clinicians and authorized practice staff, signed in with an account we issue. It is not a consumer product.
What it accesses:
| Capability | Why | What leaves the computer |
|---|---|---|
| Microphone | To record a visit when the clinician starts a recording | Audio, encrypted in transit, to our AWS backend |
| Access to the EHR page (*.athenahealth.com) | To read the open chart’s context (and the patient details used to send a welcome email). The extension does not write to the chart — note sections are copied to the clipboard for the clinician to paste | Nothing is sent to us from the page except the visit identifiers needed to label the recording |
| Local storage | Sign-in tokens, the clinician’s settings, recent drafts, and audio chunks held for crash recovery | Nothing — this stays on the computer |
| Microsoft 365 sign-in (PushDocs / patient email) | To send patient forms and welcome emails from the practice’s own mailbox | Email is sent by the practice’s Microsoft 365 tenant, not by us |
Recording is never silent or automatic. The clinician starts and stops each recording deliberately, and the extension shows a recording indicator while it runs.
Which draft sections have been copied is tracked while the panel is open, so the clinician can see what is left to paste. It is in-memory only — not stored on the computer and never sent to us — and it ends with the session. It is declared to the Chrome Web Store as user activity.
Data stored on the computer, and for how long:
| What | Where | Retention |
|---|---|---|
| Audio chunks pending upload | Browser IndexedDB | Deleted once processed; in any case within 24 hours |
| Recent draft notes | Extension local storage | 7 days |
| Sign-in tokens | Extension local storage | Until sign-out or token expiry |
| Settings and preferences | Extension local storage | Until changed or cleared |
Settings include a “clear local data” control that removes locally stored recordings and drafts — use it before handing a computer to someone else.
Limited Use. Our use of information obtained through the extension adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements. We do not sell this data, transfer it for advertising or credit-scoring purposes, or use it for any purpose unrelated to providing the clinical documentation service.
5. Who we share information with
We share information only as follows, and never sell it.
Subprocessors that handle PHI on our behalf — each under a written agreement requiring HIPAA-appropriate safeguards:
| Subprocessor | What it does |
|---|---|
| Amazon Web Services | Hosting, storage, encryption, authentication, audit logging, and AI processing via Amazon Bedrock |
| Deepgram | Converts visit audio to a transcript |
Amazon Bedrock and AI models. The draft note is generated by a Claude model running inside Amazon Bedrock, within our AWS environment. AWS states that content processed through Bedrock is not used to train the underlying models and is not shared with model providers. We do not send patient information to any AI service outside this arrangement.
Others. We may disclose information to professional advisors under confidentiality obligations, and where required by law — in which case, if the information belongs to a practice, we will notify that practice unless legally prohibited.
In a business transfer (merger, acquisition, sale of assets), information may transfer to the successor, which remains bound by this policy and by the underlying business associate agreements.
6. How long we keep information
| Category | Retention |
|---|---|
| Visit audio | Destroyed when the note is finalized, and in any case within 24 hours |
| Transcripts and draft notes | 7 days, so the clinician and biller can complete the visit |
| System and access logs | 90 days |
| Clinician preferences and account records | For the life of the account |
| Website contact messages | 12 months |
The signed clinical note itself lives in the practice’s electronic health record, under the practice’s own retention policy — not with us.
Separately from the periods above, HIPAA requires us to keep our written policies, procedures, and required records for six years; that obligation is about our own compliance documentation, not about the information in the table.
7. What we do not do
- We do not sell personal information, and we have not in the preceding twelve months.
- We do not use patient information to train AI models, ours or anyone else’s.
- We do not use patient information for advertising, and we run no advertising.
- We do not use third-party analytics or tracking in the extension.
- We do not access patient information except as needed to provide the service, to fix a problem the practice reports, or as the law requires.
8. Security
We maintain administrative, physical, and technical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest with customer-managed keys, individual accounts with role-based access, audit logging of access to health information, and short retention windows that limit how much data exists to lose.
No system is perfectly secure, and we do not claim otherwise. If a breach of unsecured protected health information occurs, we notify the affected practice as the Business Associate Agreement and HIPAA require; the practice then notifies patients and regulators as the law directs.
9. Your choices and rights
If you are a patient: see §2. Your rights run through your practice.
If you are a website visitor or a customer user: depending on where you live, you may have the right to access, correct, delete, or obtain a copy of personal information we hold about you, and to appeal a refusal. Florida residents have rights under the Florida Digital Bill of Rights; residents of other states have comparable rights. Contact us at the address in §12 and we will respond within the period the applicable law requires. We will not discriminate against you for exercising these rights.
Some information we cannot delete on request — audit logs HIPAA requires us to keep, and records we hold for a practice, which only the practice can direct us to delete.
10. Children
SimaNotes is sold to medical practices and used by clinicians. We do not knowingly collect personal information directly from children. A practice may use the service in the care of a minor patient; that information is handled as PHI under §3.3 and the practice’s own policies govern it.
11. Changes to this policy
We will post any change here and update the “last updated” date. If a change materially affects how we handle personal information, we will provide notice before it takes effect — to customer practices directly, and on this page.
12. Contact us
SimaNotes LLC
Security & Privacy Officer
25191 Sawyer Francis Lane
Lutz, FL 33559
support@simanotes.com
Please do not send patient health information to this address. It is ordinary email and is not a secure channel for it. If you are a patient, contact your clinician’s office — see §2.
Patients: please contact your clinician’s office. See §2.