Privacy notice

We collect account identity (name, email, authentication provider), organization profile (legal name, state, specialty, optional NPI, scribe vendor), and order records. The public registry publishes organization name, jurisdiction, suite, Certificate ID, status, and dates — that disclosure is the product.

We do not want PHI. Do not paste clinical notes, recordings, or patient identifiers into PolicyXAI. If you do so by accident, email hello@policyxai.com for deletion.

Payment details, when Stripe is connected, are processed by Stripe. We store the order amount and status, not the full card number.

You may request export or deletion of your account (except Certificate IDs already shown to third parties, which remain as a historical public record unless law requires otherwise).