Skip to main content

Privacy Policy

Last Updated: 01/19/2026

1. Information We Collect

When you use Joyera's AI-powered healthcare services ("Services"), we collect information that you provide directly to us, including:

  • Account Information: Name, email address, phone number, professional credentials, and NPI number
  • Protected Health Information (PHI): Patient data you input into our Services for clinical documentation, including clinical notes, diagnoses, treatment plans, and billing codes
  • Usage Data: Features accessed, time spent, interaction patterns, and error logs
  • Device Information: IP address, browser type, operating system, device identifiers, and session data
  • Communications: Support requests, feedback, and correspondence with Joyera

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our AI-powered clinical documentation Services
  • Process your clinical documentation requests through AI models
  • Personalize your AI assistant experience by learning your preferences, commonly used codes, documentation style, and workflow patterns
  • Send administrative information, service updates, and security alerts
  • Respond to your support requests and questions
  • Comply with federal, state, and local legal obligations, including HIPAA, HITECH, FERPA (where applicable), SOC 2-aligned security practices, NIST Cybersecurity Framework-aligned controls, state privacy laws (CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, MHMDA), and applicable state, county, and city privacy ordinances where required
  • Detect, prevent, and respond to fraud, abuse, security incidents, and technical issues
  • Perform aggregated analytics on de-identified data to improve Services (never using identifiable PHI)
  • Develop and improve AI capabilities, learned behaviors, and service enhancements that benefit all users (these improvements are part of the Joyera platform)

3. AI Processing and Third-Party Providers

Critical Disclosure: Our Services use third-party AI providers to process your clinical documentation. By using our Services, you acknowledge and consent to the following:

  • PHI you submit is processed by HIPAA-compliant AI providers (each bound by Business Associate Agreements)
  • Different AI providers may be used for different features based on their Business Associate Agreement terms. Designated Record Set features (clinical documentation for paid plans) use AI providers that permit maintaining PHI as part of a designated record set. Non-DRS features, trial accounts, and backend operations may use different AI providers as appropriate
  • AI providers process PHI solely to provide Services and are prohibited from using it for their own purposes, including model training
  • We do NOT use identifiable PHI to train AI models. De-identified and blinded data may be used to support medical research and improve billing outcomes for our users
  • AI processing occurs on servers located in the United States
  • We maintain a current list of all subprocessors handling PHI, available upon request via our privacy contact form
  • We will notify you at least 30 days before adding new AI subprocessors that handle PHI

4. HIPAA Privacy Protections

As a HIPAA Business Associate, we implement comprehensive safeguards:

  • Administrative, physical, and technical safeguards compliant with HIPAA Security Rule
  • We do NOT use PHI for marketing, advertising, or commercial purposes
  • We do NOT sell PHI to third parties under any circumstances
  • We do NOT use identifiable PHI to train AI models. De-identified data may be used for service improvement
  • We maintain comprehensive audit logs of all PHI access for 7 years
  • We encrypt PHI at rest and in transit using industry-standard encryption
  • Employee access to PHI is role-based and logged
  • All employees undergo HIPAA training and background checks

5. Information Sharing and Disclosure

We may share your information only in these limited circumstances:

  • With Your Consent: When you explicitly authorize disclosure
  • Service Providers: With HIPAA-compliant vendors (cloud hosting, AI providers, payment processors) all bound by BAAs and prohibited from using PHI for their own purposes
  • Legal Requirements: When required by valid subpoena, court order, or law (we will notify you unless prohibited)
  • Law Enforcement: Only when legally required with valid legal process; we will challenge overly broad requests
  • Business Transfers: In connection with merger, acquisition, or sale (with 30 days' notice and continued privacy protections; you may delete your data before transfer)
  • To Prevent Harm: When necessary to prevent imminent harm or serious threat to health/safety

We do NOT sell, rent, or share PHI with third parties for marketing or advertising purposes.

6. Data Security

We implement industry-leading security measures:

  • Industry-standard encryption for data at rest and in transit
  • Multi-factor authentication (MFA) required for all accounts
  • Annual third-party security audits and penetration testing
  • Employee security training, background checks, and documented HIPAA training
  • 24/7 intrusion detection and prevention systems
  • Automatic session timeouts and password requirements
  • Role-based access controls with least-privilege principles
  • Regular vulnerability scanning and patch management

7. Offline Mode and Local Device Storage

Availability: Paid plans only.

For paid subscribers who enable our optional Offline Mode feature, we store encrypted copies of PHI locally on your device using secure browser storage.

What We Store:

  • Recent patient session data you've accessed (encrypted)
  • Local audit logs of PHI access

Important Security Requirements:

  • Your device must have a passcode/biometric lock and device-level encryption enabled
  • Cached data automatically expires after 3 days
  • Logging out clears all locally stored PHI

Your Responsibility:

You are responsible for the physical and logical security of devices with locally stored PHI. This includes protecting against loss or theft and maintaining device security controls. See our Terms of Service Section 9 for liability details.

8. Data Breach Notification

In the event of a data breach involving personal information, PHI, or student records:

  • We will notify affected users in accordance with applicable federal, state, and local laws, including HIPAA, FERPA, and state breach notification requirements
  • Notification timelines vary based on the type of data affected and applicable regulations, ranging from immediate notification to 60 days depending on jurisdiction and data type
  • Notice will include: description of breach, types of information involved, steps we're taking, steps you should take, and contact information
  • We will notify appropriate regulatory agencies as required by law, including HHS for HIPAA breaches, state attorneys general, and educational institutions for FERPA breaches
  • We maintain cyber liability insurance and incident response procedures
  • You may request information about any breach affecting your data by submitting a request via our privacy contact form

9. Data Retention and Deletion

Designated Record Set Status:

For paid subscribers, clinical and educational documentation saved to patient/student records constitutes a Designated Record Set under HIPAA/FERPA. Free trial accounts do not maintain a Designated Record Set (session-only storage with no persistence). You are responsible for reviewing and approving all AI-generated documentation and ensuring compliance with applicable record retention laws.

Our Retention Schedule:

  • Clinical & Educational Documentation: 7 years (paid plans) or session-only (free trial). You may request deletion at any time.
  • Audit Logs: 7 years for HIPAA/FERPA compliance (metadata only, not PHI content).
  • Account & Billing Records: 7 years after account closure or final transaction.
  • Support Communications: 3 years (PHI should not be included in support requests).

Your Responsibilities as a Healthcare Provider or Educational Professional:

  • You are solely responsible for determining what constitutes your official legal health record or educational record
  • You must transfer any AI-generated documentation to your official EHR or student information system for it to become part of the legal record
  • You must review and approve all AI-generated content before it becomes part of a patient's or student's legal record
  • You are responsible for maintaining compliance with applicable medical record and educational record retention laws (typically 7+ years depending on state, specialty, and record type)
  • Our retention of chat conversations is provided as a convenience, backup, and collaboration tool, but does NOT constitute or satisfy your legal record retention requirements
  • You are responsible for responding to patient/student requests for access, amendment, or accounting of disclosures from your designated record set

After retention periods expire, we securely delete data using industry-standard deletion methods (cryptographic erasure, secure wiping). You may request early deletion of saved documentation at any time through your account settings, subject to legal audit log retention requirements.

10. Your Privacy Rights

Designated Record Set Rights (Paid Plans):

For paid subscribers, the following HIPAA rights apply to clinical and educational documentation saved to patient/student records (Designated Record Set). Free trial accounts and non-clinical features are not subject to these Designated Record Set obligations.

HIPAA Rights:

  • Right to Access: Request copies of your PHI (we respond within 30 days)
  • Right to Amend: Request corrections to inaccurate PHI
  • Right to Accounting of Disclosures: Request list of PHI disclosures for past 6 years
  • Right to Restriction: Request restrictions on certain uses/disclosures of PHI
  • Right to Confidential Communications: Request PHI communications by alternative means
  • Right to Copy: Receive electronic or paper copies of your PHI

State Privacy Rights (California, Virginia, Colorado, etc.):

  • Right to Know: What personal information we collect and how we use it
  • Right to Delete: Request deletion of personal information (subject to legal retention)
  • Right to Correct: Request correction of inaccurate personal information
  • Right to Opt-Out: Opt out of sale of personal information (we do not sell PHI)
  • Right to Data Portability: Receive your data in portable format (JSON, CSV, or PDF)
  • Right to Non-Discrimination: Exercise rights without penalty

To exercise these rights, submit a request via our privacy contact form. We respond within 30 days for HIPAA requests and 45 days for state privacy law requests.

11. Cookies and Tracking Technologies

Critical Privacy Protection - No Third-Party Tracking Pixels on PHI Pages:

On pages where Protected Health Information (PHI) or student education records may be present, we do not use Meta Pixel (Facebook), TikTok Pixel, or other advertising trackers. This includes all authenticated pages, patient portals, clinical documentation interfaces, scheduling systems, and billing pages. Our public marketing website (joyera.ai) may use standard analytics tools like Google Analytics, but these are never present on the application (app.joyera.ai) where PHI is processed.

Technical Safeguards:

  • PHI Firewall: Third-party scripts are blocked from loading on authenticated pages through Content Security Policy (CSP) headers and code-level controls
  • No Pixel Transmission: No URL parameters, page paths, form data, or any information that could identify patients or their health conditions is transmitted to third-party advertising or analytics platforms
  • Marketing/App Separation: Marketing tracking (if any) is strictly limited to our public marketing website (joyera.ai) and is never present on the application (app.joyera.ai) where PHI is processed
  • Audit Controls: We maintain technical audit logs verifying that no third-party tracking scripts execute on PHI-containing pages

Cookies We Use:

  • Essential Cookies (First-Party Only): Required for authentication, session management, CSRF protection, and security. These are strictly necessary and cannot be disabled. No data is shared with third parties.
  • Functional Cookies (First-Party Only): Remember your preferences, settings, and UI customizations. Stored locally, never transmitted externally.
  • First-Party Analytics: We use privacy-preserving, first-party analytics to understand usage patterns. This data is aggregated, never includes PHI, and is never shared with third parties like Google or Meta.
  • Security Cookies (First-Party Only): Detect fraud, prevent unauthorized access, and support rate limiting. No external transmission.

What We Explicitly DO NOT Use:

  • Meta Pixel (Facebook/Instagram tracking)
  • Google Analytics, Google Ads, or Google Tag Manager on authenticated pages
  • TikTok Pixel or any social media tracking pixels
  • Third-party advertising networks or retargeting services
  • Session replay tools (Hotjar, FullStory, etc.) on PHI pages
  • Any technology that transmits user data to third parties on pages containing PHI

Marketing Website Only:

Our public marketing website (joyera.ai, not the application) may use limited, privacy-compliant analytics to measure marketing effectiveness. These tools: (1) are never present on authenticated application pages; (2) do not collect health information; (3) are configured to anonymize IP addresses; (4) do not use cross-site tracking. You may opt out via browser settings or our cookie consent banner on the marketing site.

Your Controls:

You can control non-essential cookies through your browser settings or our cookie consent interface. Disabling essential cookies will prevent you from using the Services, as they are required for authentication and security.

12. Children's Privacy and FERPA Compliance

General Privacy for Minors:

Our Services are intended for licensed healthcare providers and educational professionals 18 years or older. We do not knowingly collect personal information directly from individuals under 18. If we discover we have collected information from a minor without proper authorization, we will delete it immediately.

FERPA (Family Educational Rights and Privacy Act) Compliance:

For educational professionals who work with students (including school psychologists, speech therapists, special education providers, and school-based clinicians), we comply with FERPA requirements for protecting student education records:

  • Educational Records Protection: Student education records, including IEPs, academic records, and school-based therapy notes, are protected under FERPA with the same security controls as PHI
  • Consent Management: We support proper consent mechanisms for accessing and sharing student educational records in accordance with FERPA requirements
  • Student Privacy Rights: Parents and eligible students have rights to inspect, amend, and control disclosure of educational records
  • Audit Logging: All access to student education records is logged and retained for 7 years for compliance and accountability
  • Institutional Responsibilities: Educational institutions maintain control over their student data and can request access logs, amendments, or deletion subject to legal retention requirements
  • Directory Information Controls: We support appropriate controls for directory information vs. non-directory educational records
  • NYC-Specific: For school-based services in NYC, we comply with Chancellor's Regulation A-820 for student data privacy

Data Classification: Student educational records are classified as Tier 1 (Highly Sensitive) and receive the same protections as PHI, including encryption at rest and in transit, role-based access controls, and comprehensive audit logging.

If you believe we have information from a minor without proper authorization, or if you have questions about FERPA compliance, please submit a request via our privacy contact form.

13. International Data Transfers

Your information is processed and stored on servers located in the United States. If you access our Services from outside the U.S., your information will be transferred to, stored, and processed in the U.S. where our servers are located and our central database operates. By using the Services, you consent to this transfer. We implement appropriate safeguards for international transfers, including Standard Contractual Clauses where required.

14. Automated Decision-Making and AI

Our Services use AI to assist with clinical documentation. You acknowledge that:

  • AI-generated content is assistive only and requires human review before clinical use
  • You retain full control over all clinical decisions and documentation
  • You may reject, modify, or override any AI suggestions
  • We do not make automated decisions about patient care without human oversight
  • You bear sole responsibility for verifying accuracy of AI outputs

15. Marketing Communications

We may send you:

  • Transactional Emails: Service updates, security alerts, billing notices (you cannot opt out)
  • Marketing Emails: Product updates, feature announcements, educational content (you can opt out anytime)

Opt out of marketing emails by clicking "unsubscribe" in any marketing email or by submitting a request via our privacy contact form. We will honor opt-out requests within 10 business days.

16. California Privacy Rights

California residents have additional rights under CCPA/CPRA:

  • Right to Know: Categories of personal information collected, sources, business purposes, and third parties we share with
  • Right to Delete: Request deletion of personal information (subject to legal exceptions)
  • Right to Correct: Request correction of inaccurate information
  • Right to Opt-Out of Sale: We do NOT sell personal information or PHI
  • Right to Limit Sensitive Personal Information: You may limit use of sensitive data (we only use for essential Services)
  • Right to Non-Discrimination: We will not discriminate for exercising privacy rights

Do Not Sell My Personal Information: We do not and will not sell your personal information. To exercise your California privacy rights, submit a request via our privacy contact form.

17. Data Portability and Export

You may export your data at any time:

  • Available formats: JSON, CSV, PDF
  • Includes: All clinical notes, patient data, account information, and usage history
  • Export initiated through account settings or by submitting a request via our privacy contact form
  • Exports provided within 30 days of request
  • You may request exports up to once per month without charge

18. Third-Party Services and Links

Our Services may contain links to third-party websites or integrate with third-party services (e.g., EHR systems, billing platforms). We are not responsible for the privacy practices of these third parties. We recommend reviewing their privacy policies before providing information. Third-party services that access PHI are required to sign BAAs with us.

19. Business Transfers and Corporate Changes

If Joyera is involved in a merger, acquisition, bankruptcy, or sale of assets:

  • We will notify you at least 30 days before your information is transferred
  • The acquiring entity must maintain the same privacy protections
  • You will have the option to delete your data before transfer
  • HIPAA protections will continue to apply to PHI
  • You may terminate your account if you object to the transfer

20. Changes to Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or Services. Material changes will be communicated via:

  • Email notification at least 30 days before effective date
  • Prominent notice in the Services
  • Updated "Last Updated" date at top of this page

Continued use after changes constitute acceptance. If you do not agree to changes, you must stop using the Services and may request deletion of your data.

21. Contact Us and Privacy Officer

For questions, concerns, or to exercise your privacy rights, contact our Privacy Officer:

Submit a Privacy Request via our privacy contact form. Response Time: Within 30 days for HIPAA requests; within 45 days for state privacy law requests.

You also have the right to file a complaint with:

  • HHS Office for Civil Rights: For HIPAA violations (www.hhs.gov/ocr/privacy/hipaa/complaints)
  • State Attorney General: For state privacy law violations
  • California Attorney General: For CCPA violations (oag.ca.gov)

We will not retaliate against you for filing a complaint.