APPI Disclosures

Business operator

Our name is Cortexa AI, Inc. (CortexaNote), our address is 1111B S Governors Ave STE 48093, Dover, DE 19904, United States, and our representative is SHIH-JACK LEE (CEO). Enquiries about how we handle personal information can be sent to support@cortexanote.com. This page is an English reference version of the Japanese disclosures, which are authoritative.

Personal information we handle

We handle account and usage information about clinicians and administrators that we obtain through the website, the CortexaNote app, the Recorder, and our support channels, the names, affiliations, contact details, and enquiries we receive through contact forms, demo requests, and events such as trade shows, and the names, shipping addresses, contact details, and order details of hardware orders. For clinical documentation, we handle recordings, transcripts, draft clinical notes, template selections, and related clinical information as a contractor entrusted by medical institutions.

Purposes of use

Information about clinicians, medical institution staff, and website visitors: (1) creating, authenticating, and managing accounts; (2) providing and operating the service, the Recorder, and other hardware integrations; (3) billing and payment, and processing and shipping hardware orders; (4) responding to enquiries and support requests; (5) sending information about our products, services, and events; (6) sending important notices about the service or security; (7) keeping the service secure, preventing misuse, and responding to failures; (8) measuring the reliability of the service, analysing how it is used, and improving it, with hashed or pseudonymised identifiers and usage data that contain no clinical content; (9) meeting legal obligations. Information about patients (handled on entrustment from medical institutions): only to perform the work the medical institution entrusts to us, namely transcribing recordings, drafting and storing clinical notes, and the support, security, misuse prevention, and failure response that go with them. Patient information, including recordings, transcripts, clinical context, and clinical notes, is not used to train, develop, or improve any of our AI models.

Security control measures

Organizational measures (a person responsible for handling personal data, handling rules, and regular checks and reviews of how data is handled); human measures (training employees and enforcing confidentiality obligations); physical measures (controlling entry and managing equipment and electronic media); technical measures (access control, multi-factor authentication, encryption in transit and at rest, collecting and keeping access logs, and addressing vulnerabilities); and understanding the foreign environment (we implement our security control measures with an understanding of the personal information protection system of the United States, where we handle personal data).

Provision to third parties

We do not provide personal data to third parties except where required by law, where it is necessary to protect a person's life, body, or property and it is difficult to obtain the person's consent, or with the person's consent. For personal data we handle on entrustment from a medical institution, the medical institution is the party that provides it to third parties.

Provision to third parties in foreign countries

We handle personal data in the United States. The United States is not among the foreign countries that the Personal Information Protection Commission recognizes as having a personal information protection system equivalent to Japan's. Contact form submissions on our website reach us through Web3Forms (operated by Web3Creative, India), the form service we use; we provide them only with the person's consent, after showing on the form the country, an overview of India's personal information protection system, and the measures the recipient takes. Hardware orders are shipped by Shenzhen Lingxing Network Technology Co., Ltd. (China), to which we provide the details needed for delivery; we do so only with the person's consent, after showing on the order screen the country, an overview of China's personal information protection system, and the measures the recipient takes. For personal data entrusted by medical institutions, we secure, through our agreements with the medical institutions, the system needed to continuously take measures equivalent to those a personal information handling business operator must take (Article 16, item (i) of the Enforcement Rules for the Act on the Protection of Personal Information). In other cases where we provide personal data to a third party in a foreign country, we do so with the person's consent, after providing the name of the recipient's country, an overview of that country's personal information protection system, and an overview of the measures the recipient takes. On request, we provide without delay an overview of the equivalent measures taken by the recipient, including how the system is set up, how often and how we check it, whether the foreign country has a relevant system and an overview of it, whether there is any impediment and an overview of it, and the measures we take if there is one.

How to make a request

Requests may be made to be notified of the purpose of use, or for disclosure, correction, addition, or deletion of content, suspension of use or erasure, suspension of provision to third parties, and disclosure of records of provision to third parties. Requests are accepted by email to support@cortexanote.com. We confirm identity with a copy of an official document such as a driver's license or passport; a request made by an agent must include a power of attorney or other document proving the agent's authority. There is no fee. After receiving the request and confirming identity, we reply without delay (as a guide, within two weeks), by providing electronic records or by another method the person specifies, or in writing where disclosure by that method is difficult. Information about patients that we handle on entrustment from a medical institution is personal data held by that medical institution, so the medical institution responds to requests about it; if we receive such a request, we pass it to the medical institution and help it respond.

Complaints

Complaints and enquiries are accepted at support@cortexanote.com. We record what we received, the facts we established, how we responded, and what we changed to prevent a recurrence, and we have arrangements in place to handle complaints appropriately and promptly.

Accredited organizations

We are not currently a covered business operator of an Accredited Personal Information Protection Organization. If we become one, we will publish that organization's name and its contact point for resolving complaints on this page.