How Clincor Handles Health Information

HIPAA practices notice for the Clincor service · Effective September 21, 2026

This notice explains how Coach OS LLC handles protected health information ("PHI") when a practice uses Clincor. Patients: your clinician's own Notice of Privacy Practices governs how your health information is used and shared; Clincor works for your clinician as a business associate.

Our role

Coach OS LLC is a business associate of the practices that use Clincor. We handle PHI only on a practice's behalf, only after the practice has signed the Clincor Business Associate Agreement, and only to provide secure transcription and optional drafting assistance.

Where health information lives

• On the practice's computers. Notes, patient lists, measurements, care plans, imported files and each note's record of actions are stored inside the Clincor application on the practice's own computers. They are not uploaded to Coach OS.
• In a BAA-covered AWS account, briefly. When the practice sends a dictation for transcription, the audio passes through Clincor's server to Amazon Web Services, is transcribed by Amazon Transcribe Medical, and the text is returned. Audio is encrypted and deleted within 30 days.
• Never in our account system. The system that manages sign-in and billing receives only the clinician's name, email and practice name, and a count of finalized notes with an opaque reference. It never receives patient names or note content.

What we will not do

• Sell PHI or use it for marketing.
• Use PHI to train any model.
• Send PHI to any transcription, drafting or analytics service other than AWS under our business associate addendum.
• Listen to recordings or read transcripts, except when the practice asks for help with a specific problem and gives written permission.

Safeguards

Encryption in transit and at rest; a hash-chained record of every action on every note, which shows if an entry is changed or removed; per-practice separation of records; logging on our servers that records ids and status codes only, never clinical content.

If something goes wrong

We will report a breach of unsecured PHI to the practice without unreasonable delay and no later than 30 days after discovery, so the practice can meet its own notification duties.

Questions

Coach OS LLC · Miami, Florida · support@coachingos.org