HIPAA and
dental AI
On-device audio. PHI not used to train models. A BAA with the practice. The full picture is on the Trust Center — this page does not over-claim.
What this page is for
Dental offices evaluating an AI scribe need a clear HIPAA story — not marketing adjectives. CareNotes is an ambient dental AI scribe built in two Manhattan group dental offices. It names HIPAA, PIPEDA, and GDPR on the site. This explainer restates the claims that are documented on the Trust Center and the Business Associate Agreement. It does not add extra certifications, appointed representatives, or time-saved statistics.
If you are doing a security review, start at Trust. Download the BAA PDF there. Email info@cnotes.ai for the security overview, retention policy, and subprocessors package. The same rules apply on the free core and on Premium. Core note-taking is free forever (AI note, recording, transcription, edit, History, Apple Watch, custom templates). Premium is PMS integration and schedule sync — see pricing. Download the iOS app or the Android app when you are ready to record a visit.
On-device audio
Speech-to-text runs on the device. Patient audio does not leave the phone. It is not uploaded or stored by CareNotes or sent to a third party for transcription. Only the resulting text is used to generate a note. Transcripts and notes are handled under HIPAA safeguards. If you enable cloud sync, U.S. customers use production infrastructure in the United States. Encryption is in transit (TLS) and at rest.
That is a narrower claim than “nothing ever leaves the building.” Audio stays on the device. Text that becomes the note is processed so you can review, edit, and — if you choose Premium — upload into the linked PMS. The Trust Center explains storage, deletion, backups (encrypted disaster-recovery backups expire in 30 days), and breach notification.
PHI is not used to train models
CareNotes states that PHI is not used to train models. The Trust Center is more specific: patient audio, transcripts, notes, your edits, and prompts are never used to train, fine-tune, or improve AI models, and providers are contractually prohibited from doing so. AI providers that process PHI do so under BAAs. The Trust Center names OpenAI under a BAA with zero data retention for transient processing. Patient data is not sold.
A BAA with the practice
A HIPAA Business Associate Agreement is executed with each subscribing practice before PHI processing — a separate BAA per legal entity. Read the agreement and download the PDF from the BAA page. The practice owns the notes; CareNotes processes data on the practice's behalf.
PIPEDA and GDPR are named alongside HIPAA. For questions about a specific region, write info@cnotes.ai.
Questions
Does patient audio leave the phone?
No. Speech-to-text runs on the device. Patient audio is not uploaded or stored. Only the resulting text is used to generate a note. Details are on the Trust Center.
Is PHI used to train models?
No. PHI is not used to train models. The Trust Center states that patient audio, transcripts, notes, edits, and prompts are never used to train, fine-tune, or improve AI models.
Will CareNotes sign a BAA?
Yes. A Business Associate Agreement is executed with each subscribing practice before PHI is processed. Read and download the BAA on this site.
Which privacy laws does CareNotes name?
HIPAA, PIPEDA, and GDPR are named on the site. For U.S. customers, production infrastructure is in the United States. Encryption is in transit (TLS) and at rest.
Where is the full compliance write-up?
The Trust Center is the source of truth. This page is a short explainer that points there and to the BAA.
Read the documents, then download the app
Trust Center and BAA first. Then start with the free core on iOS or Android.