Skip to content
Noteable
Back to Home

Privacy Policy — Noteable

Effective Date: December 1, 2025

Last updated: 19 September 2026

Noteable (“we”, “our”, “us”) is operated by Matthew Giglio, based in Adelaide, South Australia. Noteable is an Australian documentation platform for sole traders and small NDIS providers.

1. Privacy Commitment

We are subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We handle personal information responsibly, securely, and transparently.

2. Information We Collect

We collect information needed to provide and improve the service, including:

  • Account information: Name, email address, and contact details.
  • User content: Session notes, transcripts, audio uploads, and documents you provide.
  • Client information: Client goals, interventions, and related clinical context entered by your team.
  • Usage information: Product analytics and technical logs used for quality and security.
  • Payment information: Processed securely by Stripe. We do not store full card details.

3. How We Use Information

We use information to:

  • Provide session documentation, progress tracking, and reporting workflows.
  • Operate accounts, tenant workspaces, and customer support.
  • Improve reliability, safety, and product performance.
  • Meet legal, security, and compliance obligations.

We do not sell, rent, or trade your personal information.

4. Storage and Security

  • Infrastructure: Clinic records and workspace data are hosted and stored in Sydney, Australia.
  • Encryption: Data is encrypted in transit (TLS) and at rest where supported.
  • Access controls: Production access is restricted and monitored.

5. AI Processing

We use third-party AI providers to generate drafts and summaries from content you submit. Sending content to those providers is processing, not Australian storage.

  • xAI (SpaceXAI LLC), api.x.ai: Used for session-note drafting, transcription, cleanup, client-context extraction, care-team summaries, monthly summaries, progress-report narratives, and related documentation tasks. Categories sent can include the session capture (typed notes, transcripts, uploaded document text), audio for transcription, client first name or other context included in the prompt, goals, and confirmed profile details used as context. xAI’s published API documentation (checked 19 September 2026) states that xAI does not train on API inputs or outputs without explicit permission, and that API requests are stored by default for 30 days for abuse auditing unless Zero Data Retention is enabled for the xAI team. Zero Data Retention is an account setting, not something Noteable can prove from application code. We do not claim it is enabled.
  • OpenAI (OpenAI OpCo, LLC / OpenAI Ireland Ltd as applicable), api.openai.com: Not on the default clinical draft path. Founder and internal outreach drafting is configured for OpenAI; the current send path uses approved templates and does not send participant session notes. If an operator later enables OpenAI for clinical drafts, session content would be sent to OpenAI’s API. OpenAI’s API data-controls documentation (checked 19 September 2026) states that API data is not used to train OpenAI models unless you opt in, and that abuse-monitoring logs may be retained for up to 30 days by default. A request-level store:false flag is not the same as organisation-level Zero Data Retention. Noteable does not currently set that flag.
  • Our models: We do not use your clinical content to train Noteable’s own models.
  • Storage versus processing: Clinic records and workspace data are hosted and stored in Sydney, Australia, where that hosting arrangement is in place. xAI and OpenAI processing may occur in the United States or other regions those providers use. We do not claim that all information stays in Australia.
  • Human review: AI drafts can be wrong or incomplete. You review and edit before a draft becomes the session record. Finalising a note saves the record you approved. It does not separately confirm every suggested memory item or interpretation.
  • Australian privacy and US health-privacy labels: We handle personal information, which can include health information, under the Privacy Act 1988 (Cth). That is not the same as HIPAA “protected health information.” We do not claim a US HIPAA Business Associate Agreement covers every Australian record.
  • Transport: Data sent to AI providers is encrypted in transit.

6. Retention and Deletion

  • Retention period: Client-related records are retained for a minimum of 7 years from last service date, matching common clinical record-keeping practice. Noteable is not a guaranteed 7-year NDIS-compliant archive.
  • After cancellation: Workspace access may become read-only so records remain accessible.
  • Requests: You can request data export or deletion via hello@noteable.com.au.
  • Deletion processing: Data is removed from active systems within 30 days where feasible; backups may persist for disaster recovery up to 90 days.

7. Your Rights

Under the APPs, you may request access, correction, export, or deletion of personal information.

If unresolved, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

8. Cookies and analytics

The marketing site and the public trial pages load product and advertising analytics so we can understand how people find Noteable and whether trial sign-up works: Google Analytics, HubSpot, Vercel Analytics, and Meta Pixel (Facebook / Instagram ads). Authenticated clinical pages do not load those third-party marketing scripts. You can write to us if you have questions about this processing.

Analytics processors (Google Analytics, HubSpot, Vercel Analytics, Meta) may process data outside Australia. Clinic records and workspace data remain hosted and stored in Sydney, Australia. AI processing is described in section 5 and is separate from that storage. If you need a specific processing arrangement, contact us before relying on this site for that purpose.

Meta Pixel and Meta’s Conversions API are used only to measure and improve Noteable ads on the marketing site and public trial pages. The browser pixel does not receive your email. The server-side Conversions API may send a hashed (SHA-256) copy of your account email, plus IP address and browser type, so Meta can attribute a trial start if the pixel is blocked. We do not send session notes, transcripts, client records, or unhashed email. Click identifiers such as fbclid are not stored on your organisation record.

9. Contact

Noteable
Operated by Matthew Giglio
Email: hello@noteable.com.au
Adelaide, South Australia