ChartLock is committed to protecting your privacy and safeguarding the minimal information necessary to operate a secure, HIPAA-aligned service. This Privacy Policy explains what limited personal information we may collect, why we collect it, how it is used, and the measures we take to protect it. ChartLock does not store your dictations, clinical content, or any chart data — all user-generated content is processed in real time and permanently deleted immediately after use.
We do not sell, rent, or share your personal information with third parties for advertising, analytics, profiling, or any commercial purpose. Any information we collect is used solely to support your ChartLock account, maintain system security, meet regulatory obligations, and provide the services you request.
This Privacy Policy ("Policy") describes how ChartLock ("ChartLock," "we," "us," or "our") collects, uses, safeguards, and, where applicable, retains limited personal information provided by users of our website, applications, and associated services (collectively, the "Services").
This Policy applies to all interactions you have with ChartLock through our website, platform, or customer support channels. Because we operate with a strict privacy-first model, ChartLock collects only the minimal information necessary to create and manage your account, process billing securely, comply with HIPAA and other applicable regulations, and maintain the security and integrity of the Services.
ChartLock does not collect, store, retain, or analyze the content of your dictations, clinical information, or charting data. All such content is processed in real time and permanently deleted immediately upon completion. Our systems are designed to avoid unnecessary retention of data, and we do not use your information for advertising, behavioral tracking, analytics, or profiling.
ChartLock provides clinicians with an AI-powered documentation platform designed to transform spoken dictation into structured medical charts in real time. Our service processes your dictations securely, generates the chart output you request, and immediately deletes the underlying content once processing is complete. ChartLock does not store your dictations, clinical notes, or chart data after generation.
ChartLock is not an electronic health record (EHR) system and does not function as a long-term repository for medical information. Your generated chart is returned to you in the ChartLock browser interface for your review and intentional transfer into your chosen EHR according to your workflow. Our role is limited to secure real-time processing — never retention — of your clinical content.
ChartLock is built on a strict privacy-first framework. We collect only the minimum information necessary to create and maintain your account, deliver the services you request, process billing securely, and comply with HIPAA and other applicable regulations. We do not collect unnecessary data, and we do not use your information for advertising, behavioral tracking, or profiling.
Over the last 12 months, we have collected the following categories of personal information:
Your email address and IP address. These are used for secure account creation, login verification, customer communication, and security or regulatory purposes.
When a physician or other clinician creates a ChartLock account, they provide an email address and create a password through ChartLock's Microsoft-hosted customer login environment. Microsoft handles the authentication credential, and ChartLock does not store the user's password. ChartLock does not collect practice or organization information, job title, employer information, employment history, telephone numbers, or other professional background information as part of account signup.
We maintain only the limited information needed to manage your subscription, such as plan type, subscription status, and billing status. During signup, you provide an address of your choosing, such as a home or work address, along with your credit-card information through Stripe-hosted payment services. That information is handled by Stripe. ChartLock does not store your password or full payment-card information. We do not store, retain, or archive the content of your dictations, clinical data, or any information you submit through the platform for chart generation. All chart content is processed in real time and permanently deleted immediately after completion.
We do not track, store, or analyze your browsing behavior, search history, click patterns, or usage-based behavioral analytics. We collect only essential system-level technical logs necessary for security, fraud prevention, and HIPAA compliance. These logs do not include the content of your dictations or charts.
We do not collect or store your job title, employer, practice or organization information, employment history, or other professional background details. We do not use professional information for profiling or marketing.
Dictations and charting content you create on the platform are processed solely for the purpose of generating your chart and are immediately and permanently deleted once processing is completed. We do not retain, analyze, review, or repurpose your clinical content for any reason.
We receive general location information derived from your IP address, which is necessary for secure server communication and regulatory compliance. We do not request or track precise GPS-based location information.
ChartLock collects only the minimal information required to create your account, authenticate your access, and securely manage your subscription payments. We do not collect additional data for marketing, analytics, profiling, behavioral tracking, or any unrelated purpose.
When you sign up for a ChartLock account, you provide an email address and create a password through ChartLock's Microsoft-hosted customer login environment. Microsoft handles the authentication credential, and ChartLock does not store the password. You then provide an address of your choosing, such as a home or work address, and your credit-card information through Stripe-hosted payment services. Stripe handles that payment information, while ChartLock receives only the limited subscription and payment-status information necessary to manage your account. ChartLock does not collect practice or organization information, job title, employer information, employment history, telephone numbers, or other professional background information as part of account signup.
Unlike platforms that gather extensive behavioral or marketing-related data, ChartLock does not collect or track:
We believe that your privacy is fundamental. For that reason, we intentionally avoid collecting unnecessary information of any kind.
When you access ChartLock, we receive only the limited technical information required to maintain secure server communication and HIPAA-aligned operation — such as your IP address and general location derived from it. We do not use this information for advertising, analytics, or profiling.
ChartLock does not obtain information about you from outside sources, marketing companies, data brokers, or social platforms for advertising, marketing, or profiling purposes. Your account identity and authentication are handled through ChartLock's Microsoft-hosted customer login environment, and payment-card processing is handled through Stripe-hosted payment services. ChartLock receives only the limited account, subscription, and payment-status information necessary to provide and manage the Services.
Any dictations or chart content you submit are processed in real time and permanently deleted immediately after your chart is generated. We do not store, analyze, or reuse your clinical content for any purpose.
We use the limited personal information we collect only to:
We do not use your personal information for:
All clinical content is excluded from long-term use and is deleted immediately after real-time processing.
ChartLock follows a strict privacy-first model. Because we collect only the minimal information necessary to create and maintain your account, we intentionally limit external disclosure of personal information.
ChartLock does not:
ChartLock uses only the limited information required for creating and securing your user account, authenticating your access, managing your subscription, and providing customer support when you request it. This includes your email address and limited subscription or payment-status information. Authentication credentials are handled through ChartLock's Microsoft-hosted customer login environment. Your chosen address, such as a home or work address, and your credit-card information are handled through Stripe-hosted payment services. ChartLock does not store user passwords or full payment-card information and does not collect practice or organization information, job title, employer information, employment history, telephone numbers, or other professional background information as part of account signup.
This information is used solely so you can log in, manage your subscription, and access the Services securely. It is not disclosed to unrelated parties for advertising, marketing, analytics, or other commercial exploitation. Limited information may be processed by contracted service providers, such as Microsoft Azure and Stripe, only as necessary to provide, secure, authenticate, host, or bill for the Services.
We may disclose account information only if required by law, subpoena, court order, or lawful request by government authorities. These rare cases are the only circumstances under which disclosure occurs outside the service-provider and operational uses described in this Policy.
If ChartLock ever undergoes a merger, acquisition, or sale of assets, minimal account information may be transferred solely to continue providing the Service. Any acquiring organization must honor this Privacy Policy and maintain identical or stronger privacy protections.
Because ChartLock permanently deletes all user-generated content immediately after your chart is produced:
There is nothing to disclose — by design.
ChartLock does not store or retain any clinical content. Dictations, chart text, and related clinical information are processed in real time and permanently deleted immediately after your chart output is generated.
We retain only the limited account and billing information necessary to maintain your active subscription, provide support and security, and comply with applicable legal and regulatory requirements. When no longer needed for these purposes, such information is deleted or anonymized where feasible.
ChartLock uses Microsoft Azure's HIPAA-aligned infrastructure and implements administrative, technical, and physical safeguards designed to protect your account information from unauthorized access, disclosure, alteration, or destruction.
ChartLock does not use advertising cookies, marketing cookies, tracking pixels, behavioral analytics cookies, or similar technologies designed to monitor your browsing activity for advertising, profiling, or marketing purposes.
We do not use:
ChartLock uses only the minimal technical elements necessary to provide and secure the Services. This may include temporary authentication or session tokens, cookies, or similar browser technologies required to keep you securely signed in, prevent fraud, maintain platform security, and support essential application functions. These elements are not used for advertising, profiling, behavioral analytics, or cross-site tracking.
ChartLock does not:
Your privacy is not a marketing opportunity — it is a design principle.
ChartLock does not engage in cross-site behavioral tracking or targeted advertising. Because browser "Do Not Track" signals are not needed to disable behavior that ChartLock does not perform, those settings do not materially change how ChartLock operates.
ChartLock does not use social media integrations, social login systems, embedded social pixels, marketing SDKs, data-sharing widgets, audience-building tools, or any other technology designed to pull information from social platforms.
We do not:
ChartLock does not receive, request, or harvest:
If you independently choose to talk about ChartLock on social media, that activity occurs entirely on those platforms and is governed by their privacy policies, not ours. ChartLock does not access or ingest that data.
The ChartLock application and website do not include outbound links to third-party services for tracking, marketing, analytics, or data collection. We also do not offer any functionality that connects your ChartLock account to other platforms to exchange or synchronize clinical data.
Your use of ChartLock is self-contained and isolated from social media and external marketing ecosystems.
Depending on where you live, you may have certain rights under applicable state privacy laws regarding the limited personal information we maintain about you (such as account and billing information). These rights may include the ability to:
You may exercise applicable privacy rights by contacting us using the information in the Contact section of this Policy. We may need to verify your identity before responding, which may include confirming your email address or basic account details. We will respond within the timeframes required by applicable law. If your request is limited or denied as permitted by law, you may have the right to appeal, and we will explain how to do so where required.
We will not discriminate against you for exercising any rights available to you under applicable privacy laws.
The ChartLock website and services are intended for licensed clinicians and other adult professionals and are not directed to individuals under the age of eighteen (18). We do not knowingly collect personal information from anyone under 18. If you are under 18, you should not use ChartLock or submit any information through the Services.
We also do not knowingly collect personal information, as defined by the U.S. Children's Online Privacy Protection Act ("COPPA"), from children under 13. If you are a parent or guardian and believe that a child has provided us with information in a way that is not permitted by law, please contact us using the information in the Contact section. We will remove such information to the extent required by applicable law.
ChartLock is based in the United States, and our Services are designed and operated in accordance with U.S. law. If you access ChartLock from outside the United States, any information you provide (such as account and billing information) will be processed and stored in the U.S.
By using the Services or providing us with information, you understand that your information may be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your country of residence.
ChartLock uses only the minimal personal information necessary to operate your account, including your email address, authentication/session information provided through ChartLock's Microsoft-hosted customer login environment, and limited subscription or payment-status information received from Stripe. Your chosen address, such as a home or work address, and your credit-card information are entered into and handled through Stripe-hosted payment services. ChartLock does not store user passwords or full payment-card information.
When you use ChartLock to generate documentation:
We may update this Privacy Policy periodically. Any revisions will be posted on our website with an updated effective date. Continued use of ChartLock following such updates constitutes acceptance of the revised Policy.
If you have any questions about this Privacy Policy or how ChartLock protects your information, you may contact us at:
Email: contact@chartlock.com