HIPAA is a U.S. federal law that establishes standards for protecting sensitive health information, including details about diagnosis, treatment, and clinical history. It defines who can access protected health information and requires organizations to implement specific administrative, physical, and technical safeguards to keep it private and secure.

Notehouse can be used in a HIPAA-compliant way when account owners implement the required administrative and procedural measures within their organization. Our platform provides the technical security features needed to support HIPAA compliance, including end-to-end encryption, granular access controls, and comprehensive audit logs.

A Business Associate Agreement can be signed during the sign-up process and is also available at getnotehouse.com/baa. The BAA formally documents our responsibilities for safeguarding your protected health information under HIPAA regulations.

GDPR (General Data Protection Regulation) is a European Union law that regulates how personal data of EU residents is collected, stored, and protected. It grants individuals strong rights over their personal data—including the right to access, correct, and delete it—and requires organizations to implement appropriate security measures to protect that data.

Yes, Notehouse is fully GDPR compliant and meets all EU data protection requirements. Our platform includes robust encryption, role-based access controls, and detailed audit logs to help you manage client data securely while meeting your regulatory obligations.

When you create an account, accepting the Terms of Service and Privacy Policy also constitutes acceptance of our Data Processing Agreement. No separate signature is required—your acceptance at sign-up is legally binding under GDPR, and the DPA remains in effect for as long as you use the service.