Notfyr
Book a Demo

Privacy Policy

Effective date: October 8, 2026

Doxxa Inc. (“Notfyr,” “we,” “us,” or “our”) makes tools that help direct support professionals (DSPs) and caregivers write shift notes and keep care records for the agencies they work for. This policy explains what information we collect, why, who we share it with, how long we keep it, and the choices you have. It covers our website (notfyr.com), our web app, our mobile app, and the CareNote: Send to PHS browser extension (together, the “Services”). The Services are offered in the United States only.

If you have a question about this policy, email privacy@notfyr.co.

The short version

  • Most of what we hold, we hold for your agency. When a DSP writes a note about a person the agency supports, that note is part of the agency’s records, and we look after it under a contract with the agency called a Business Associate Agreement.
  • We do not sell personal information or health information, and we do not use it for advertising.
  • We do not train general-purpose AI models on your notes, recordings, or other health information.
  • We keep information in the United States.

1. Who is responsible for your information

Notfyr provides the Services to home-care and residential support agencies (“your agency”).

  • Health information about the people your agency supports (care notes, recordings, transcripts, goals, and similar records) is “protected health information” (PHI) under the Health Insurance Portability and Accountability Act (HIPAA). Your agency, as a covered entity or business associate under HIPAA, is responsible for it. We handle it only on your agency’s behalf, as its business associate, under a Business Associate Agreement (“BAA”). Where this policy and the BAA differ about PHI, the BAA controls.
  • Information about you as a user (your account, your use of the Services) we handle ourselves, as described here.
  • Information from visitors to notfyr.com we handle ourselves, as described here.

2. Information we collect

You give us directly

  • Account and contact information: name, email address, phone number, job title or role, your agency, and your password (stored only as a one-way hash).
  • Care documentation: shift notes you write or dictate, voice recordings, their transcripts, care-goal progress, and attachments. This usually includes PHI about the people your agency supports.
  • Work records: shifts, schedules, clock-in and clock-out times, time-off requests, shift reassignments, and expense and mileage reports, including receipt images.
  • Support messages: what you send us when you ask for help.

Collected automatically

  • Device and log information: device type, operating system, browser, IP address, and logs of requests to our servers, used to run, secure, and fix the Services.
  • Push-notification tokens: if you allow notifications in the mobile app, a token that lets us send you shift reminders and similar messages.
  • Cookies: the web app uses cookies that keep you signed in. See section 9.

From your agency

Your agency’s administrators may create your account, assign you to shifts and individuals, and enter the records of the people it supports, including their identifiers in the agency’s electronic health record (EHR).

What we do not collect

We do not collect your location. The mobile app asks for access to your microphone, to record notes, and to send you notifications; it does not ask for your location, contacts, or other device data. We do not collect payment card information.

3. How we use information

  • To provide the Services: turn recordings into transcripts and structured notes; help you complete documentation; route notes to the supervisors and reviewers your agency chooses; run schedules, time off, reassignments, and expenses; and, at your request, fill in your agency’s EHR forms (section 6).
  • AI processing: we use AI models to transcribe recordings, draft and check notes, and answer questions about notes. These models run on Amazon Web Services (AWS) in the United States, under our Business Associate Agreement with AWS. We do not use your notes, recordings, or other PHI to train general-purpose AI models.
  • To keep the Services working and safe: authenticate users, prevent fraud and abuse, investigate incidents, and fix problems.
  • To improve the Services: we look at how features are used, using de-identified or aggregated information, to find what is confusing or broken. When we check the quality of AI-drafted notes, we use de-identified notes only.
  • To communicate with you: account, security, and service messages, and replies to support requests. We do not send marketing to the people your agency supports.
  • To meet legal obligations and enforce our agreements, including the BAA.

We use PHI only as the BAA allows.

4. Why we are allowed to use it

We process information to perform our contracts with agencies, as HIPAA and the BAA permit for PHI, to meet legal obligations, and for our legitimate interest in running and securing the Services. The Services are not offered to people in the European Union or the United Kingdom.

5. Who we share information with

We do not sell personal information or PHI, and we do not share it for cross-context behavioral advertising. We share information only as follows, and PHI only as HIPAA and the BAA allow:

  • Your agency, and the supervisors and reviewers it designates.
  • Your agency’s EHR, when you use the browser extension to send a shift to it (section 6).
  • Service providers who run parts of the Services for us, under contracts that limit their use of the information:
    • Amazon Web Services: hosting, storage, databases, logs, email (Amazon SES), and AI processing (Amazon Bedrock), in the United States, under a Business Associate Agreement.
    • Expo: delivery of mobile push notifications. Notification text does not contain PHI.
  • Legal and safety: when the law requires it, or to protect the rights, property, or safety of Notfyr, our users, or others.
  • Business transfers: in a merger, acquisition, or sale of assets, under confidentiality protections, and for PHI with continued HIPAA compliance.
  • With your permission: for anything else, only with your consent.

6. The CareNote: Send to PHS browser extension

Our Chrome extension lets a DSP enter a shift they documented in CareNote into their agency’s EHR, PHS. It works only after the agency has turned the feature on and set it up, and only when the DSP presses Send to PHS in CareNote.

  • What it handles. The shift documentation the DSP confirmed in CareNote, which includes PHI; the individual’s name and Medicaid ID, used to find the right person in PHS; and the name PHS shows for the signed-in DSP, used to check that PHS is signed in as them. It reads PHS pages to recognize which page is showing, and to check the person, date, and time before it fills in a form. It never fills in or reads the DSP’s PHS password, and it never submits or signs a form: the DSP does that.
  • What Notfyr receives. Which forms were filled in and submitted, whether the DSP changed a filled form before submitting it, and where a step could not be completed. The extension does not send PHS page content or PHS credentials to Notfyr.
  • What stays on the computer. Nothing from the shift. The send is held in the browser’s session memory only, and is cleared when the send ends or the browser closes.
  • What it removes. When a send ends, and each time the browser starts, the extension signs out of PHS and removes PHS’s cookies, site data, and browsing-history entries from that computer, so the next person on a shared computer cannot open the previous DSP’s session or pages. When a send ends it also signs the DSP out of CareNote. It does not read or remove any other site’s data.
  • PHS’s messages. While a send is running, PHS’s pop-up messages in that tab are shown in the extension’s panel instead. In other PHS tabs they appear as usual. In any PHS tab, PHS’s “leave this page?” prompt on Backspace is answered No, so a filled form is not lost.
  • Limited Use. Information received through the extension is used only to fill in the EHR forms the DSP asked it to fill. It is not sold, not transferred except as section 5 describes, and not used for advertising, creditworthiness, lending, or any purpose unrelated to that. Notfyr’s use of information received from the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

The extension is not made by, affiliated with, or endorsed by the maker of PHS.

7. Where information is stored

We store and process information in the United States, on AWS. We do not transfer it outside the United States.

8. How long we keep information

  • Care documentation and work records are kept while your agency uses the Services. When the agency’s contract ends, they are deleted, as the BAA requires. Agencies are responsible for keeping any records the law requires them to keep, and can export them before the contract ends.
  • Voice recordings are not kept. A recording is deleted once its transcript is made, and temporary files from transcription are removed within an hour.
  • Your sign-in is deleted when you close your account or your agency removes you. Your name stays on the notes and records you wrote, which are part of your agency’s records.
  • Server logs are kept for 90 days.
  • Database backups are kept for 35 days.
  • De-identified debugging records of AI drafting are deleted after 30 days.
  • Sign-in sessions expire after at most 7 days.

We may keep information longer when the law requires it, or to resolve a dispute.

9. Cookies

Our web app uses cookies that keep you signed in and protect your session. These are needed for the app to work. We do not use advertising, retargeting, or cross-site tracking cookies. See our Cookie Policy for details and how to manage cookies.

10. How we protect information

We encrypt information in transit and at rest, require a one-time verification code at every sign-in to the web app, limit access to the staff who need it, log access, and follow the HIPAA Security Rule’s safeguards. On shared computers, the browser extension clears PHS’s session after each send (section 6). No system is completely secure, and we cannot guarantee that information will never be accessed without permission. If a breach affects PHI, we notify your agency as the BAA and HIPAA require.

11. Your rights and choices

  • Requests about PHI (to see or correct health records, or to get an accounting of disclosures) go to your agency, which controls those records. If you send one to us, we pass it to your agency.
  • Your own account: you can ask us to show you, correct, or delete the personal information in your account by emailing privacy@notfyr.co. Some of it may be part of your agency’s records (for example, notes you wrote), and we will tell you if so.
  • State privacy rights: depending on where you live (for example California, Colorado, Connecticut, Virginia, or Texas), you may have the right to know, access, correct, and delete personal information, and to opt out of its sale, its sharing for targeted advertising, or profiling. We do not sell or share personal information for those purposes. We will not treat you differently for using a right, and you may use an authorized agent.
  • Notifications: you can turn off push notifications in your device settings.

We answer requests within 45 days, and may need to confirm your identity first. If we turn down a request, you can appeal by replying to our answer.

12. Children

The Services are for adult care professionals and are not directed to children. We do not knowingly collect personal information directly from children under 13. Care records may describe minors who receive care from your agency; those records are your agency’s, handled under the BAA.

13. Links to other sites

The Services may link to sites we do not run, including your agency’s EHR. Their privacy practices are their own.

14. Changes to this policy

When we change this policy, we post the new version here with a new effective date. For a material change, we also email your agency’s administrators at least 30 days before it takes effect.

15. Contact us

Privacy questions: privacy@notfyr.co. Support: support@notfyr.co.

Mail: Doxxa Inc., 5512 Billenca Ln, Upper Marlboro, MD 20772