In plain language
- Note Composer helps Registered Behavior Technicians (RBTs) and ABA providers turn the facts they record about a session into a draft progress note. You record the facts; the AI only phrases them.
- We store your account, your clients' treatment plans, your session entries and the notes you generate, so that the service works across your devices.
- To write notes, read treatment plans and transcribe dictations, we send the relevant content to AI and transcription providers that process it on our behalf. They are not allowed to use it for their own advertising.
- We do not sell personal information, and we do not use clinical content for advertising.
- You can edit or delete records at any time, and ask us to delete your account.
01Who we are
Note Composer is developed and operated by Infinity Code LLC ("Infinity Code", "we", "us"). Note Composer consists of a browser extension, a companion mobile app for voice dictation, and the cloud service (the "Service") that both of them connect to.
This policy applies to the Service and to any information you submit through it. It does not apply to third-party websites or electronic health record (EHR) systems that you use alongside the Service, which have their own policies.
Note Composer is a tool for licensed providers and their staff. You (or the agency that employs you) decide what to document and remain responsible for the clinical accuracy of every note you submit, edit or insert into another system.
02Information we collect
Information you give us
| Category | What it includes |
|---|---|
| Account | Your email address, your name, a password (stored only as a one-way hash) or, if you use Google sign-in, the basic profile information Google shares with us (email, name, profile identifier). |
| Client records | The name or label you give each client, and the treatment plan details you enter or upload: goals, target and replacement behaviors, antecedents, interventions, prompt levels, reinforcers and similar clinical program information. |
| Treatment plan documents | The .docx or .pdf files you upload so that the Service can read the plan, and the structured information extracted from them. |
| Session entries and notes | What you record about a session (date, times, place of service, who was present, behaviors, interventions, responses, trial data, environmental or medical remarks) and the notes the Service generates from them, including their edit history and the checks run on them. |
| Voice dictations | Audio you record in the mobile app and the text transcribed from it (see Section 05). |
| Billing | Your subscription status, number of paid clients and invoices. Card details are entered directly with our payment processor; we never receive or store full card numbers. |
| Messages | What you send to our support team. |
Information collected automatically
- Usage and diagnostics: which features you use, request times, error reports, device and browser type, and IP address, kept in server logs for security and troubleshooting.
- AI usage metrics: for each AI request, the operation, the model used, token counts, duration and cost. These records do not contain the text that was sent or received.
- Local storage: the extension and mobile app keep your sign-in session and interface preferences on your device.
What we do not collect
We do not ask for, and do not intentionally collect, Social Security numbers, insurance or payment-card numbers, biometric identifiers, precise location, contacts, or your browsing history. We do not use advertising trackers or sell data to data brokers.
Please minimize identifiers. Where your agency's policy allows, use a client's initials or an internal code rather than a full name, and avoid entering identifiers (such as dates of birth, addresses or ID numbers) in free-text fields. Notes are written about "the client" and do not need the client's name.
03How we use information
- To provide the Service: read treatment plans, compose and check session notes from the facts you record, transcribe and structure dictations, and keep your records available across devices.
- To run your account: sign you in, send verification codes and service emails (welcome, payment and subscription notices), and provide support.
- To process payments: manage subscriptions and invoices through our payment processor.
- To keep the Service safe and reliable: detect abuse, prevent unauthorized access, measure performance and cost, and fix defects.
- To meet legal obligations and enforce our terms.
We do not use your clinical content for advertising or marketing, and we do not use it to build profiles of you or your clients. We do not use your content to train our own AI models.
04AI processing
Note Composer uses third-party large language models to (a) extract structured information from treatment plans, (b) rewrite your recorded facts into fluent note text and check that the text matches them, and (c) structure transcribed dictations. To do this, the relevant content, which can include clinical information, is sent over encrypted connections to our AI providers, currently OpenAI and Anthropic Claude through Amazon Web Services (Bedrock). We may change or add providers; the categories of providers are always listed in Section 08.
- We use the providers' business API services. Under their current terms, content sent through these APIs is not used to train their models by default.
- Only the content needed for the specific request is sent. Account details such as your email address are not part of AI requests.
- Generated notes are drafts. AI can make mistakes. Our system constrains the writer to your recorded facts and runs automated checks, but you must read, correct and approve every note before using it.
- We keep operational metrics of AI use (Section 02) but not the prompts or responses.
05Voice dictation
If you use the mobile app to dictate a session, the recording is uploaded to our servers over an encrypted connection and sent to our transcription provider, AssemblyAI, which converts speech to text. To improve accuracy, we may send the provider a list of clinical terms taken from the selected client's treatment plan (for example, behavior and intervention names).
- We delete the transcript from the transcription provider as soon as the job finishes.
- We keep the original audio on our private storage for 7 days and then delete it automatically. You can delete a dictation, together with its audio, at any time.
- The transcribed text is kept with your account until you delete it, so that you can review it and generate the note.
Dictating requires your explicit action in the app (starting a recording). You are responsible for making sure that recording is permitted in your setting and that people who can be heard are informed as your agency's policies and applicable law require.
06Storage and retention
| Information | How long we keep it |
|---|---|
| Account information | While your account is open, and for a short period afterwards for security, fraud prevention and legal purposes. |
| Client records, treatment plans, uploaded plan files | Until you delete them or your account is deleted. |
| Session entries and generated notes | Until you delete them or your account is deleted. Deleting a note does not give back a free note already used. |
| Dictation audio | 7 days, then automatically deleted (sooner if you delete the dictation). |
| Dictation transcripts | Deleted at the transcription provider when processing ends; kept in your account until you delete them. |
| AI usage metrics, security and server logs | Retained for a limited period needed for security, billing and reliability. |
| Billing and tax records | As long as the law requires. |
Information you delete is removed from our live systems. Encrypted backups and logs may keep copies for a limited time until they are overwritten in the normal backup cycle, and are not used to restore deleted content except in a disaster recovery.
07Security
We apply administrative, technical and physical safeguards appropriate to the sensitivity of the information we handle, including:
- Encryption in transit (TLS) for every connection between your device, our servers and our providers.
- Encryption at rest for the database, its backups, file and audio storage, and server disks.
- Authentication with short-lived access tokens, revocable sessions and email verification.
- Strict separation between accounts: you can only see and change your own clients, plans and notes.
- Private cloud storage for uploaded files and audio, with no public access, hosted in the United States.
- Restricted, logged administrative access, and secrets kept outside of the code.
No system is perfectly secure. If we learn of a security incident that affects your information, we will notify you and the relevant authorities as the law requires.
09Clinical information and HIPAA
Treatment plans and session notes can contain protected health information ("PHI"). If you are a covered entity or work for one (for example, an ABA agency), you are responsible for deciding whether and how to use the Service for PHI and for complying with HIPAA and applicable state law, including having the client's authorization or another lawful basis, and following the "minimum necessary" principle.
We designed the Service to support those obligations: access controls, encryption in transit and at rest, hosting under a Business Associate Agreement with Amazon Web Services, limited retention of audio, no use of clinical content for advertising or model training, and no storage of AI prompts or responses. When you use the Service with PHI on behalf of a covered entity, we are prepared to enter into a Business Associate Agreement (BAA). Please contact us at the address in Section 14 before you use the Service with PHI so that the agreement and the provider arrangements that apply to your account can be confirmed in writing.
Using Note Composer does not by itself make you or your agency HIPAA-compliant. Compliance depends on how your organization configures and uses the Service and on agreements between you and us.
10Your choices and rights
You can, at any time:
- Access and correct your account, clients, plans, dictations and notes directly in the app.
- Delete individual clients, plans, notes and dictations in the app.
- Request deletion of your account and associated data, or a copy of your information, by contacting us.
- Withdraw consent to optional features by not using them (for example, voice dictation or Google sign-in) or by uninstalling the extension or app. Uninstalling does not delete your account; contact us for that.
- Opt out of non-essential emails. We still send the messages needed to operate your account.
Depending on where you live (for example California, Colorado, Connecticut, Virginia and other U.S. states, or the European Economic Area and United Kingdom), you may have additional rights, such as to know what we hold about you, to correct or delete it, to receive a portable copy, and to object to or restrict certain processing. We do not sell or share personal information as those terms are defined by U.S. state privacy laws, and we will not discriminate against you for exercising your rights. To exercise a right, contact us; we may need to verify your identity, and we will respond within the time the law allows. You may also lodge a complaint with your local data protection authority or state attorney general.
Where a client's information is submitted by a provider, the provider (not Infinity Code) usually decides how it is used. If you are a client or a client's guardian, please direct requests to the provider or agency that treats you; we will help them respond.
11Children and clients
The Service is intended for adult professionals. It is not directed to children, and we do not knowingly allow anyone under 18 to create an account. Providers may enter information about the children and other clients they serve; that information is handled as described in Sections 02 to 09. If you believe a minor has created an account, contact us and we will delete it.
12International processing
We operate from the United States. The Service, its database and its file storage are hosted in the United States, and requests to Claude through AWS Bedrock are processed in U.S. regions. Other providers listed in Section 08 may process information in the United States or other countries under their own terms. If you use the Service from outside the United States, you understand that your information will be transferred to and processed in the United States, where data-protection laws may differ from those of your country. Where required, we rely on appropriate safeguards for these transfers.
13Changes to this policy
We may update this policy as the Service or the law changes. When we do, we will change the "Last updated" date at the top and, for material changes, notify you by email or in the app before they take effect. Continuing to use the Service after an update means that you accept the revised policy.
14Contact us
Questions, requests or concerns about privacy, or to request a Business Associate Agreement:
- Infinity Code LLC
- Email: privacy@infinitycodellc.com
- WhatsApp: +1 786-644-7422
- Website: infinitycodellc.com