Privacy Policy

InfyNote, LLC ("InfyNote," "we," "us," or "our") values your privacy and is committed to protecting the information entrusted to us. This Privacy Policy explains how we collect, use, store, process, and protect information when you access or use the InfyNote platform (the "Service").

This Privacy Policy applies to Organizations and Users that access or use the Service. It does not apply to third-party websites, applications, or services not controlled by InfyNote.

InfyNote, LLC ("InfyNote," "we," "us," or "our") values your privacy and is committed to protecting the information entrusted to us. This Privacy Policy explains how we collect, use, store, process, and protect information when you access or use the InfyNote platform (the "Service").

This Privacy Policy applies to Organizations and Users that access or use the Service. It does not apply to third-party websites, applications, or services not controlled by InfyNote.

1. Scope and Role of InfyNote

InfyNote provides a documentation, workforce management, scheduling, reporting, and operational management platform used by organizations.

Organizations control how the Service is used and what information is entered into the platform.

Organizations are responsible for the information they upload, enter, manage, export, or share through the Service.

InfyNote acts solely as a service provider that processes data on behalf of Organizations. InfyNote does not independently determine the purpose, meaning, or use of Organization Data.

2. Information We Collect

Account Information

We collect information necessary to create and manage accounts, including:

• Name
• Email address
• Phone number (where provided)
• Password and authentication information
• Organization name
• User role information
• Account settings and preferences

This information is used to authenticate users and manage access to the Service.

Organization Data

Organizations may upload or enter information into the Service, including:

• Documentation and notes
• Attendance records
• Goals and objectives
• Reports and summaries
• Scheduling information
• Staff information
• Workforce management records
• Contact details, such as phone numbers and mailing or physical addresses
• Photographs and images uploaded by authorized Users (for example, client, staff, or profile photos)
• Health, medical, behavioral, medication, and related sensitive information where an Organization chooses to enter it (for example, in clinical, therapy, or healthcare settings)
• Client, participant, student, or employee information entered by authorized Users

This information ("Organization Data") is controlled by the Organization and entered at its discretion.

Technical Information

We may automatically collect limited technical information necessary to operate and secure the Service, including:

• IP address
• Browser type
• Device information
• Operating system information
• Authentication logs
• Error logs
• Usage and activity logs
• Security-related activity logs
• Push notification tokens (device identifiers used to deliver notifications to your device)

This information is used to improve reliability, maintain security, investigate issues, and operate the Service.

Location Information

When a User enables location-based features — such as mileage tracking or geofenced clock-in and clock-out — the Service collects the User's precise device location (GPS coordinates). For time tracking, location is recorded when a User clocks in and when they clock out. In addition, where the User's Organization has enabled geofence exit reminders or automatic clock-pausing, the Service checks the User's location periodically while the User is clocked in so it can detect when they leave the assigned job-site geofence.

Location is accessed only while the User is actively clocked in and the app is in the foreground. The Service does not collect location in the background, when the app is closed, or at any time the User is clocked out or off shift — the mobile apps request "while in use" location only and hold no background-location permission, so continuous tracking between shifts is not technically possible. Location records may be visible to the User's Organization for attendance, mileage, and workforce-management purposes. Users may decline location permission, in which case these features are unavailable.

3. How We Use Information

We use information collected through the Service to:

• Provide, operate, and maintain the platform
• Authenticate users and manage accounts
• Generate reports and summaries
• Generate AI-assisted reports and insights when enabled
• Improve system performance and reliability
• Communicate service notices and support responses
• Monitor platform security
• Prevent misuse, fraud, and unauthorized access
• Support approved third-party integrations

InfyNote does not sell, rent, or trade personal information or Organization Data.

4. AI-Assisted Features

Some InfyNote features may use artificial intelligence to generate:

• Reports
• Summaries
• Recommendations
• Operational insights
• Suggested documentation

AI-generated content is created solely from information provided by the Organization.

InfyNote does not use Organization Data to train public AI models.

Organizations remain responsible for reviewing, validating, and approving AI-generated content before use.

InfyNote does not guarantee the accuracy, completeness, or suitability of AI-generated output.

5. Connecting Outside AI Assistants

An Organization administrator may choose to connect an outside AI assistant — for example ChatGPT or Claude — to their InfyNote workspace. This is off by default. Nothing is connected unless an administrator signs in, approves a specific application on a consent screen, and chooses what it may do.

When such a connection is active, information the assistant requests from InfyNote is sent to the company that operates that assistant, and is then handled under their privacy policy and terms, not ours. InfyNote has no agreement with those companies about how they store, use, or retain what passes through them.

What a connected assistant can reach:

• Names and identifiers of the people and jobs the Organization tracks, so that work can be filed against the right one
• The Organization's own threads and written notes on them
• The titles of tasks, reminders, cards and checklists already on the Organization's lists

What it cannot reach:

• Daily notes, session notes, or the contents of any note
• Goals, care plans, or treatment plans
• Uploaded documents, or the names of uploaded files
• Attendance records
• Financial records, expenses, or invoices

Work an outside assistant sends into InfyNote arrives as a thread for a person to review. A connected assistant cannot write a note, a goal, a task or a client record directly, and cannot overwrite anything already in the workspace.

Organizations subject to HIPAA or FERPA should note that InfyNote does not have a Business Associate Agreement or a school-official agreement with the operators of outside assistants. Asking a connected assistant about individuals may therefore be a disclosure the Organization is responsible for accounting for. InfyNote displays this warning on the consent screen before such a connection is approved.

A connection can be revoked at any time from Settings, which takes effect immediately. Every request a connected assistant makes is recorded in the Organization's audit log.

7. QuickBooks Online Integration

When an authorized administrator connects a QuickBooks Online account to InfyNote, an OAuth authorization process is initiated with Intuit.

The administrator authenticates directly with Intuit and authorizes InfyNote to interact with the selected QuickBooks company.

Depending on the functionality used, InfyNote may transmit:

• Employee names
• Employee email addresses
• Employee mapping identifiers
• Approved time entries
• Shift dates and times
• Workforce management information necessary to support payroll-related workflows

Transmission occurs only in response to Customer-authorized actions.

Customers may disconnect the integration at any time.

8. Gusto Integration

When an authorized administrator connects a Gusto account to InfyNote, an OAuth authorization process is initiated with Gusto.

The administrator authenticates directly with Gusto and authorizes InfyNote to interact with the selected Gusto company.

Depending on the functionality used, InfyNote may transmit:

• Employee names
• Employee email addresses
• Employee identifiers
• Approved work hours
• Shift dates
• Workforce management information necessary to support payroll-related workflows

Transmission occurs only in response to Customer-authorized actions.

Customers may disconnect the integration at any time.

9. Credentials for Connected Services

When a Customer connects a third-party service, InfyNote may store OAuth access tokens and refresh tokens issued by the connected provider.

These credentials are:

• Encrypted at rest
• Scoped to the Customer's organization
• Accessible only to authorized service processes
• Used solely to provide requested integration functionality

When a connection is revoked or disconnected, InfyNote removes the associated credentials from active use.

10. Service Providers and Subprocessors

InfyNote may share information with trusted service providers that help us operate the Service.

These providers may include:

• Cloud hosting providers
• Database providers
• Email delivery providers
• Payment processors
• Authentication providers
• AI service providers
• Payroll and accounting integration providers
• Security and monitoring providers

These providers are authorized to process information only as necessary to provide services to InfyNote and are subject to appropriate confidentiality and security obligations.

Where a subprocessor may process protected health information (PHI) on InfyNote's behalf, InfyNote requires that subprocessor to be bound by a Business Associate Agreement or equivalent data-protection terms. A current list of subprocessors is available upon request.

11. Data Security

InfyNote implements administrative, technical, and organizational safeguards designed to protect information from unauthorized access, disclosure, alteration, or destruction.

Security measures include:

• Encrypted HTTPS/TLS communications
• Role-based access controls
• Multi-factor authentication support
• Audit logging
• Encrypted credential storage
• Security monitoring
• Infrastructure monitoring
• Automated backup procedures

No method of electronic transmission or storage can be guaranteed to be completely secure.

Organizations acknowledge and accept this inherent risk.

12. Data Retention and Deletion

Organization Data is retained for as long as the Organization maintains an active account.

Separately from account status, records age out on a fixed schedule. A nightly job permanently deletes records older than the Organization's retention window, measured from the date each record was created:

The seven-year default reflects the HIPAA record-retention floor. An Organization that is not a healthcare provider may shorten its window to three years in Settings.

Upon termination of service:

• Organizations may request export of their data
• Data may be retained for backup, legal, security, or operational purposes
• Data is removed from active systems after the applicable retention window above

InfyNote is not responsible for data loss after the export period expires.

Users may request deletion of their account and associated personal information, or deletion of specific data without closing their account, as described on our Data & Account Deletion page. Records that an Organization owns and controls should be requested through that Organization's administrator. We may retain limited information where required by legal, regulatory, tax, healthcare, education, or security obligations.

13. Data Exports and Disclosure Decisions

Authorized users may export, download, print, email, or otherwise transmit information from the Service.

The Organization is responsible for:

• Selecting appropriate recipients
• Choosing transmission methods
• Determining authorization to receive information
• Compliance with applicable laws, regulations, and internal policies

Once information is exported from InfyNote, the Organization controls subsequent disclosure and handling of that information.

By exporting, downloading, printing, or emailing any document generated through InfyNote — including incident reports, behavioral reports, monthly summaries, client files, daily reports, and AI-generated summaries — the Organization acknowledges that the resulting document may contain PHI or other sensitive information. The Organization is solely responsible for selecting an authorized recipient, the channel of transmission, the recipient's subsequent handling, and compliance with the HIPAA minimum-necessary standard. InfyNote's responsibility for the document ends at the point of secure delivery to the Organization-designated recipient or to the device used by the authorized user.

14. FERPA and HIPAA Compliance

If the Service is used by educational institutions subject to the Family Educational Rights and Privacy Act (FERPA), InfyNote acts as a school official with legitimate educational interest and processes student records solely on behalf of the educational institution.

Educational institutions retain ownership and control of student data stored within the Service.

Where an Organization uses the Service to create or maintain protected health information (PHI) and is a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA), InfyNote acts as a business associate and processes such information solely on behalf of, and under the direction of, the Organization pursuant to the parties' agreement. The Organization is responsible for determining what health information is entered into the Service and for its own compliance obligations.

InfyNote does not use student or health information for advertising or marketing purposes.

15. Children's Privacy

The Service is intended for use by organizations and authorized adult users.

InfyNote does not knowingly collect information directly from children.

Any information relating to minors is entered solely at the direction and responsibility of the Organization using the Service.

16. Legal Requirements

InfyNote may disclose information if required to do so by law, legal process, government request, court order, or regulatory obligation.

Where legally permitted, we may notify affected Organizations before making such disclosures.

17. Business Transfers

If InfyNote is involved in a merger, acquisition, reorganization, financing, or sale of assets, information may be transferred as part of that transaction subject to appropriate confidentiality protections.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Material updates may be communicated through the Service, by email, or by other reasonable means.

Continued use of the Service after changes become effective constitutes acceptance of the updated Privacy Policy.

19. SMS/Text Messaging

InfyNote offers optional SMS text messaging for account security. Where a User chooses to enable SMS two-factor authentication, they provide their mobile number and give express consent to receive one-time verification codes by text message. These messages are transactional account-security messages only — sent when the User signs in or performs a sensitive action — and are never marketing or promotional.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text-messaging originator opt-in data and consent will not be shared with any third parties. We use a User's mobile number solely to deliver the account-security messages the User has requested and to operate the Service.

Message frequency varies and depends on the User's sign-in and account activity. Message and data rates may apply. Users can opt out at any time by replying STOP to any message, and can reply HELP for assistance. Carriers are not liable for delayed or undelivered messages.

20. Contact Information

InfyNote, LLC

Email: support@infynote.com

Website: https://www.infynote.com