Privacy Policy

1. Scope and Products

Effective Date: September 28, 2026 Last Updated: September 28, 2026 Version: 1.0.2 Cortexa AI, Inc. (“CortexaNote,” “we,” “us,” or “our”) operates CortexaNote, including AI-assisted clinical documentation software and the CortexaNote Recorder hardware that supports it. This Privacy Policy describes how we collect, use, disclose, retain, and protect personal information through our websites, applications, Recorder devices, AI scribe workspace, calendar scheduling features, connected accounts, and support channels. This policy covers information relating to clinicians, administrators, practices, and other users, as well as patient information processed through authorized clinical workflows. When we process information on behalf of a healthcare organization, that processing is also governed by our applicable agreement with the organization, including any Business Associate Agreement or Data Processing Agreement.

2. Information We Handle

Depending on the features you use, we process the following categories of information: • Account and profile information, such as your name, email address, professional details, and account preferences. • Organization and workspace information, such as practice details, workspace membership, roles, permissions, and configuration. • Device and service information, such as device identifiers, synchronization status, technical logs, and information about how the service is used. • Billing and subscription information needed to administer purchases, subscriptions, and payments. • Support information, including messages, attachments, and information you provide when requesting assistance. • Website and cookie information, as described in the Cookies and Analytics section below. • Calendar account, calendar, and appointment information, as described in Sections 5–16. When clinical capture or documentation features are used, we also process audio recordings, transcripts, clinical context, template selections, note drafts, generated documentation, and associated workspace metadata. We process clinical information to support the generation, review, storage, export, and deletion of documentation within the applicable workflow.

3. How We Collect Information

We collect information directly from you when you create an account, configure a workspace, use our products, connect a calendar, contact support, request a security review, or interact with our website. We may also receive information from your organization administrator, authorized colleagues, integration partners, or third-party services that you or your organization connect to CortexaNote. We collect certain technical and usage information automatically when you interact with our websites, applications, devices, and services.

4. How We Use Information

We use information to: • Provide, operate, and secure CortexaNote. • Manage accounts, workspaces, subscriptions, and authorized access. • Operate Recorder synchronization and associated workflows. • Generate and support the review of clinical documentation. • Display appointments and synchronize connected calendars. • Provide technical support and respond to requests. • Maintain and improve service reliability and user-facing functionality. • Detect, investigate, and prevent fraud, abuse, and security incidents. • Communicate service, account, and security updates. • Comply with applicable legal and contractual obligations. We do not sell personal information. We do not use identifiable patient information for advertising. No patient data is used to train, develop, or improve any of our AI models. We may de-identify or aggregate general personal information (never clinical content) to analyse how our services are used and to improve them. Google user data is subject to the additional restrictions described in Sections 11 and 12.

5. Optional Calendar Connections

Connecting an external calendar to CortexaNote is optional. You may connect: • Google Calendar through Google’s authorization process. • iCloud Calendar using your Apple Account email address and an app-specific password. We do not request your Google password or your primary Apple Account password. Calendar access depends on the permissions you grant and the calendars you select. You can manage your calendar connections within CortexaNote and revoke access through the relevant provider.

6. Google Calendar Information

When you connect Google Calendar, we receive authorization credentials, which may include access and refresh tokens. We access your calendar list, including calendar identifiers, names, and access permissions, so that you can select calendars to synchronize. For selected calendars, we access and store information such as: • Event identifiers and calendar identifiers. • Event titles. • Start and end dates and times. • Time zones and all-day status. • Recurrence and cancellation information. • Synchronization metadata. Responses from Google may also contain event descriptions, locations, attendee information, and other event properties. This information may be present in calendar records we process during synchronization. The information available to us depends on your authorization, calendar permissions, and the contents of your calendar events.

7. iCloud Calendar Information

When you connect iCloud Calendar, we receive your Apple Account email address and an app-specific password. We use CalDAV to access calendar information and synchronize the calendars you select. We store calendar event resources in ICS format. Depending on the existing event, these resources may include: • Event identifiers and titles. • Start and end dates and times. • Time zones and all-day status. • Recurrence and cancellation information. • Descriptions and locations. • Attendees and reminders. • Other existing calendar event properties. We use the app-specific password to operate the connection. You can revoke that password through your Apple Account settings.

8. How We Use Calendar Information

We use connected-calendar information to: • Display your schedule. • Synchronize selected calendars. • Keep appointment information current. • Detect conflicting changes. • Enable you to create, reschedule, or cancel events where you have permission to do so. • Support appointment-related clinical workflows. Synchronization may continue on our servers while you are not actively using CortexaNote. If you choose to start a clinical visit from an appointment, we associate that appointment with a CortexaNote session. Clinical information processed during that visit is subject to the clinical-data provisions of this policy and applicable agreements.

9. Sharing Information with Calendar Providers

When you create or modify an appointment through a connected calendar, the connector sends the external calendar title and scheduling information to the selected calendar provider. CortexaNote’s separate private title, patient association, preparation notes, templates, recordings, transcripts, and generated clinical notes are not added as external-calendar fields by the connector. Personal information that you include in an external calendar title will be shared with that provider and may be visible to others who have access to the calendar. Existing properties of external events may be preserved when those events are updated. Your calendar provider processes information under its own terms and privacy policy. Calendar visibility also depends on the sharing settings and permissions in your provider account.

10. Calendar Exports and Subscriptions

If you export an ICS file or enable a calendar subscription, the resulting calendar includes the external titles and schedules of the appointments included in that export or subscription. Anyone who obtains an active subscription link can read the calendar information it exposes. Treat subscription links as confidential and share them only with intended recipients. You can revoke or replace a subscription link to invalidate the previous link. Revoking or replacing a link does not erase copies already downloaded by another person, application, or calendar service. Exported ICS files also remain available to anyone who already possesses a copy.

11. Google User Data and Limited Use

CortexaNote’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and the applicable Google Workspace API user data requirements. We use Google user data only to provide or improve the user-facing features disclosed to you. We do not: • Sell Google user data. • Use Google user data for advertising, personalized advertising, or retargeting. • Transfer Google user data to advertising platforms or data brokers. • Use Google user data to train general-purpose artificial intelligence or machine-learning models. These restrictions apply to both the original Google user data and data derived from it, including information that is not protected health information. Relevant Google policies: • Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy) • Google Workspace API User Data Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy)

12. Google Data Sharing and Human Access

We transfer Google user data only as permitted by Google’s applicable policies, including: • When necessary to provide or improve the user-facing features you authorize, and only to the extent permitted by those policies. • When necessary for security purposes, such as investigating abuse. • When required to comply with applicable law. • As part of a permitted business transfer, subject to the consent and other requirements of Google’s policies. Service providers processing Google user data on our behalf must follow the same applicable use restrictions. Human access to Google user data is limited to circumstances permitted by Google’s policies, such as your documented consent to access specific data, necessary security investigations, or legal obligations. These Google-specific restrictions apply notwithstanding any broader descriptions of marketing, analytics, research, product development, business transfers, or other uses elsewhere in this policy.

13. Security and Protection of Calendar Information

We maintain administrative, physical, and technical safeguards to protect personal information. We handle protected health information in accordance with applicable HIPAA requirements and applicable agreements. Data stored in our databases is encrypted at rest. Stored Google authorization credentials and iCloud app-specific passwords are also encrypted. We use HTTPS to communicate with calendar providers.

14. Calendar Retention and Disconnection

We retain calendar information to provide scheduling and synchronization, maintain appointments you keep in CortexaNote, and meet applicable legal and contractual obligations. You can manage calendar connections and selected calendars within CortexaNote. Deselecting a calendar stops further synchronization for that calendar but does not itself delete previously stored records. Disconnecting an account: • Stops synchronization for that connection. • Removes its locally stored connection credentials. • Does not automatically delete appointments previously synchronized into CortexaNote. • Does not delete events from your Google or iCloud account. Previously synchronized appointments remain as local CortexaNote appointments and may be included in calendar exports or subscriptions you have enabled.

15. Revoking Provider Access and Cancelling Appointments

You can revoke CortexaNote’s Google access through your Google Account connection settings (https://myaccount.google.com/connections). You can revoke an iCloud app-specific password through your Apple Account settings (https://account.apple.com/). Revoking access at the provider stops our ability to continue accessing the account once the revocation takes effect. It does not itself delete information already held by CortexaNote. Cancelling an appointment changes its scheduling status and may remove the corresponding external event when synchronization is enabled. Cancelling an appointment is not the same as requesting deletion of all retained information associated with that appointment.

16. Deleting Calendar Information

To request deletion of retained calendar information, contact support@cortexanote.com. Deleting your CortexaNote account removes calendar connection and appointment records from the active calendar database. It does not delete events from your external Google or iCloud accounts. Associated clinical records and any legally required records remain subject to applicable retention obligations and agreements. Deletion from active systems does not necessarily mean immediate removal from backups. Any retained backup information remains subject to applicable security controls and retention requirements.

17. Protected Health Information and Organization Agreements

When we process protected health information on behalf of a covered entity or business associate, that processing is governed by applicable HIPAA requirements and the applicable Business Associate Agreement. When we process personal data on behalf of an organization subject to data protection laws, that processing is also governed by the applicable Data Processing Agreement and other contractual terms. These agreements may specify processing instructions, access controls, permitted uses, retention, deletion, security responsibilities, and the handling of individual requests. Healthcare organizations remain responsible for their own privacy notices and for obtaining any patient or workforce permissions required for recording and processing information. This Privacy Policy does not replace a healthcare provider’s Notice of Privacy Practices or an applicable agreement governing our processing on the provider’s behalf.

18. General Retention, Deletion, and Export

We retain personal information for as long as reasonably necessary to provide the services, fulfill the purposes described in this policy, and meet applicable legal and contractual obligations. Retention periods vary depending on the type of information, the relevant service, organization settings, and applicable agreements. Retention, deletion, and export controls for recordings, transcripts, drafts, and final notes depend on the applicable workspace configuration, available features, and contract. Some information may need to be retained to comply with legal obligations, resolve disputes, maintain security, or enforce agreements. Requests concerning clinical information processed on behalf of a healthcare organization may require coordination with that organization. Calendar-specific retention and deletion practices are described in Sections 14–16.

19. Service Providers and Other Disclosures

We use service providers and subprocessors to support functions such as hosting, communication, payments, service analytics, transcription, and AI inference. These providers process information as needed to perform their services for us, subject to applicable confidentiality, security, contractual, and legal requirements. Information may also be disclosed: • To authorized members or administrators of your organization, according to workspace permissions and applicable agreements. • To integrations or recipients you authorize. • When required by applicable law or a valid legal process. • When necessary and lawful to protect the security, rights, or safety of users, patients, CortexaNote, or others. • In connection with a merger, acquisition, reorganization, or transfer of business assets, subject to applicable law and contractual restrictions. Google user data remains subject to the additional restrictions in Sections 11 and 12. Information about our security and compliance practices and available review materials can be found in our Trust Center (https://trust.cortexanote.com/).

20. Storage, Security, and International Transfers

We use encryption and other safeguards to protect information during storage and transmission, including clinical audio, transcripts, and notes. Personal information may be stored and processed in the United States and in other locations where our authorized service providers operate, subject to applicable law and agreements. Any organization-specific hosting or data-location arrangements are governed by the applicable contract. Where required by law, we use appropriate safeguards for international transfers, such as Standard Contractual Clauses or other valid transfer mechanisms. You can contact us for information about the safeguards applicable to your data.

21. Your Privacy Rights

Depending on your location, applicable law, and our role in processing the information, you may have rights to: • Access your personal information. • Correct inaccurate or incomplete information. • Request deletion. • Obtain a copy or export of certain information. • Restrict or object to certain processing. • Withdraw consent where processing is based on consent. • Submit a complaint to the relevant data protection authority. You may send requests directly to support@cortexanote.com. We may need to verify your identity and authority before responding. For clinical information processed on behalf of a practice, we may coordinate with the practice administrator as required by applicable law and agreements. We respond to verified requests within the timelines required by applicable law. Where a request cannot be fully fulfilled, we will explain the applicable limitations as required by law. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

22. Cookies and Analytics

We use cookies and similar technologies to operate our websites and applications, remember preferences, maintain security, and prevent abuse. With your consent, we also use non-essential technologies to measure traffic and advertising performance. Non-essential cookies remain disabled until you accept them through the cookie controls. You can change or withdraw your choice through Cookie settings in the website footer or the Privacy and cookies section of the application, where available. Our Cookie Policy describes the relevant technologies, providers, purposes, and retention periods. We do not share protected health information with analytics or advertising providers. The authenticated product does not load advertising pixels. Google user data is not used for advertising or retargeting. For more information, see our Cookie Policy (https://cortexanote.com/en/legal/cookie-policy/).

23. Changes to This Policy

We may update this Privacy Policy as our products, integrations, processing practices, or legal requirements change. We will update the Last Updated date when we revise this policy. Where required, we will provide notice of material changes through the product, by email, or by other appropriate means. If applicable law requires consent for a new processing activity, we will obtain that consent before proceeding.

24. Contact and Complaints

If you have questions, complaints, or requests concerning this Privacy Policy or our handling of personal information, contact: Cortexa AI, Inc. Operator of CortexaNote Email: support@cortexanote.com Website: https://cortexanote.com Organizations may also contact their CortexaNote account representative to coordinate requests relating to an applicable Business Associate Agreement, Data Processing Agreement, or other contract.