Compliance
Japan's Act on the Protection of Personal Information applies to Cortexa AI, Inc. whenever we handle information about clinicians, staff, or patients in Japan. Patient information from a medical institution is handled as its contractor, only within the documentation work it entrusts to us; clinician and staff account information we handle as a business operator in our own right.
Mapped signals
CortexaNote keeps framework, security control, workflow ownership, and review responsibility visible on one page.
Trust packet
A serious safety page makes compliance proof inspectable. CortexaNote keeps that rhythm without pretending gated reports are public downloads.
Security reviews, agreement requests, status checks, and framework evidence are separate artifacts. Keeping them explicit prevents the page from collapsing procurement, operations, and legal review into one vague trust claim.
Japanese
The matters Article 32 requires us to publish: who we are, every purpose of use, how to make a request, our security control measures, and where to complain.
Japanese
How CortexaNote handles personal information, written for APPI: patient information under entrustment, cross-border handling, and your rights.
Procurement
Talk to us about the information your institution needs to review and supervise CortexaNote as a contractor.
Trust center
Live posture, control summaries, security policies, and procurement evidence are published in the CortexaNote trust center.
Procurement
Ask for the right questionnaire response, agreement, or architecture summary for your procurement workflow.
Operations
Uptime and incident communication live outside marketing copy so operations teams can inspect them directly.
Controls
How CortexaNote handles personal information from Japan under the Act on the Protection of Personal Information.
Art. 27(5)(i)
01Recordings, transcripts, and draft notes are handled on behalf of the medical institution, only for the documentation service it entrusts to us and under its supervision. No patient data is used to train, develop, or improve any of our AI models.
Art. 20(2)
02Medical history and clinical content are special care-required personal information. The web and mobile apps can show a prompt before recording starts for the clinician to confirm the patient has been told and has agreed; obtaining and keeping that consent sits with the medical institution.
Art. 23
03Organizational, human, physical, and technical measures, from a named person responsible for personal data to access minimization, multi-factor authentication, encryption in transit and at rest, and access logs, are published in the APPI disclosures.
Art. 28
04Our main systems are in the United States, and personal data may be stored and processed there. We set our security measures with an understanding of the US legal system, and on request we explain the measures taken by recipients outside Japan.
Arts. 32-40
05Requests to be told the purpose of use, or to disclose, correct, stop using, or delete personal data, or to disclose third-party provision records, are accepted at support@cortexanote.com at no charge. For patient information we hold for a medical institution, we pass the request to that institution and help it respond.
Art. 26
06If personal data is leaked, lost, or damaged, we notify the medical institutions concerned promptly so they can meet their own reporting duties, and we report to the Personal Information Protection Commission and notify the people affected where the law requires it of us.
Data lifecycle
The boundary is not one database table. It is the whole journey from patient conversation to approved note.
01
Clinicians record only inside the authorization, consent, and operating policies required by their organization.
02
Audio moves from Recorder or browser capture through encrypted transfer into a protected clinical workspace.
03
AI output stays draft work until a qualified clinician checks the note, edits it, and approves the final record.
04
Teams can move approved text into the EHR and keep retention decisions explicit instead of hidden in the tool.
Yes. APPI applies to a business outside Japan that handles personal information of people in Japan in connection with providing goods or services to them. We treat it as applying to everything we do for clinicians and medical institutions in Japan.
CortexaNote works best when clinical, operations, procurement, and trust owners evaluate the same Recorder + AI scribe + EHR workflow.
Talk to sales