Accurecord AI Privacy Policy

Effective Date: October 26, 2026 | Last Updated: October 26, 2026 | Governing Law: California

This Privacy Policy explains how Accurecord AI, LLC ("Accurecord AI," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with your use of our websites, applications, and services (collectively, the "Services"), including icd10codingpro.com and accurecord.io. By creating an account or using the Services, you agree to the practices described in this Privacy Policy. If you do not agree, do not use the Services.

1. Scope and PHI Boundary

1.1 This Privacy Policy covers all personal information Accurecord AI collects in connection with the Services, including account and contact data, usage and device data, billing information, and — for customers under an executed Business Associate Agreement ("BAA") — Protected Health Information ("PHI") as defined under HIPAA.

1.2 PHI Boundary. Accurecord AI applies two sets of PHI rules, depending on whether the account has an executed BAA in effect:

• Accounts without an executed BAA (individual ICD-10 Coding Pro accounts, organization accounts that have not executed a BAA, and all Free or reference-only tiers): PHI must not be entered, uploaded, or transmitted. These Services are not designed or configured to handle PHI under HIPAA without an executed BAA; individual coding workspaces are session-only and no case, note or chart excerpt is saved (search text is processed to return results and is not retained in usage records, logs or caches of customer search text; see Section 2.2). Individual accounts must not be used to enter, upload, paste, or transmit real patient charts or identifiable patient information. Professional case work involving PHI requires an organization account, the applicable current BAA, and an enabled PHI workflow. Drug Match is a non-PHI reference lookup available to all accounts, with or without a BAA. Enter drug and condition names only; do not include patient details, clinical charts, or notes. The optional AI action tidies the two lists; it does not de-identify patient information. Session-only processing does not create an exception to the individual-account PHI restriction. Submitting PHI through an ineligible account or workflow is prohibited and does not authorize the processing or create an agreed PHI service. Accurecord AI will restrict the affected processing and handle any PHI received according to the applicable agreement and law, including incident assessment and any required safeguarding, preservation, return or deletion. This restriction does not waive a duty that applies under law.
• Accounts with an executed BAA (ICD-10 Coding Pro organization accounts, ICD-10 Coding API Pro and Enterprise tiers, and the enterprise Platform, once Accurecord AI confirms its activation for the customer): PHI is supported only on these BAA-eligible plans and only to the extent permitted by the applicable BAA and HIPAA. On ICD-10 Coding Pro organization accounts, saved coding cases, including clinical facts, chart excerpts, accepted AI-assisted content, and coder attestations associated with a case, may contain PHI. In the event of any conflict between this Privacy Policy and the BAA with respect to PHI, the BAA and HIPAA obligations control.

"AI Features" means any feature of the Services that sends customer-submitted content to, retrieves information for, or receives output from a machine-learning or artificial-intelligence model or service, including the AI Coding Guide, workspace assistant, optional Drug Match list tidy-up, clarification drafting, code suggestions, and, where supported by an organization plan, accepted AI-assisted case actions. References to AI-powered features have the same meaning. This definition does not authorize PHI or identifiable patient information on an individual account.

Drug Match is a reference lookup available to all accounts, whether or not an account has a BAA. Its Medications and Conditions inputs are for drug names and condition names only, and its results show indication matches based on FDA labeling. It is not designed to receive clinical charts, notes, patient identifiers, or patient-linked information. If you choose the optional AI tidy-up, the two lists are sent to OpenAI solely to normalize the entries. Accurecord AI does not persist input or output content; input logging records its length only. The inference provider processes the request under verified configurations that do not use its content to train models and do not retain it after the request. These statements do not permit PHI in Drug Match or extend an organization BAA to an individual account.

1.3 This Privacy Policy does not apply to third-party websites or services linked from our Services. Accurecord AI is not responsible for the privacy practices of any third party.

2. Information We Collect

2.1 Information You Provide to Us

• Account and contact information: name, email address, phone number (collected for anti-abuse and account verification only, not used for marketing), job title, and organization name.
• Billing information: payment method details are processed and stored exclusively by Stripe. Accurecord AI stores only your Stripe customer ID and subscription status. Accurecord AI never has access to your full payment card number, CVV, or bank account details.
• Support communications: messages, emails, or other communications you send to Accurecord AI support.
• Customer Content: data, text, files, and other content you submit to the Services, including coding queries, uploaded organization guidelines (Corporate plans), and AI Coding Guide messages. You must not submit PHI as Customer Content unless your account has an executed BAA in effect.

2.2 Information Collected Automatically

• Usage data: pages visited, features used, necessary operational information about searches, such as the search feature, time, result count and response time, codes looked up, session duration and clickstream data. Operational records may be linked to your account or organization as disclosed in this Policy and follow Section 7. Search text is processed to return results and is not retained in our usage records, hosting, network, application or error logs, or caches of customer search text. Query-string and referrer values containing search text are omitted or masked in the log records we retain. Product-improvement statistics are handled under Section 3. Reference content may be cached independently of customer search content using code identifiers, edition identifiers or curated nonpatient reference inputs, subject to applicable content licences and access restrictions. We do not retain customer-entered search text, question-derived identifiers or customer-specific AI answer content in cross-request answer caches. Necessary non-content operational metadata follows Section 7. This does not authorize caching patient information or reusing saved-case content for product improvement.
• Device and network information: IP address, browser type and version, operating system, device type, referring URLs, and time zone.
• Cookies and similar technologies: see Section 8 for details.
• Telemetry and performance metrics: application performance data, error logs, and system health metrics. Accurecord AI applies PII redaction to telemetry data before export to any monitoring system. AI chat messages are not included in telemetry logs.

2.3 PHI (Customers with an Executed BAA Only)

PHI may be submitted only on a BAA-eligible plan: an ICD-10 Coding Pro organization account, the ICD-10 Coding API Pro or Enterprise tiers, or the enterprise Platform, once Accurecord AI confirms its activation for the customer. Before new PHI processing, the account must have the current applicable Business Associate Agreement affirmatively accepted by an authorized representative of the customer, and PHI processing must be enabled. For ICD-10 Coding Pro organization accounts, only an authenticated organization owner or administrator who affirms authority may accept. PHI use must be permitted by that BAA and HIPAA. Individual ICD-10 Coding Pro accounts and Free or reference-only tiers do not support PHI or real patient charts. Accurecord AI uses and discloses PHI only as required to provide the Services to you and as permitted under the BAA and HIPAA. PHI is never used to train AI models, and is subject to the retention and destruction obligations set forth in your BAA.

3. How We Use Your Information

Accurecord AI uses the information it collects for the following purposes:

• Providing and operating the Services: authenticating your account, processing subscriptions, delivering AI Coding Guide responses, and enabling all product features.
• Account management and billing: processing payments via Stripe, managing subscription status, issuing receipts, and handling trial and renewal cycles.
• Customer support: responding to your inquiries, diagnosing technical issues, and resolving disputes.
• Security and fraud prevention: detecting and preventing unauthorized access, abuse, fraud, and other harmful activity; phone numbers collected at signup are used solely for anti-abuse verification (e.g., OTP via Twilio) and are not used for marketing.
• Product improvement: using appropriately de-identified aggregated statistics, such as grouped search counts and result rates, and curated test searches containing no patient information, to improve features, performance and user experience. We do not use raw customer search text for this purpose. Removal of account, organization, IP-address and precise-time links alone does not establish de-identification. PHI or saved-case content is not used for our own product-improvement purposes without a specific lawful basis and any permission required under the applicable BAA and law.
• Legal compliance: complying with applicable laws, regulations, court orders, and government requests; enforcing Accurecord AI's Terms of Service and other agreements.
• Communications: sending transactional emails (account confirmations, payment receipts, password resets). Accurecord AI does not send marketing emails unless you have opted in. You may opt out of any marketing communications at any time by emailing [email protected] or clicking unsubscribe.

4. How We Share Your Information

Accurecord AI does not sell your personal information. We do not share personal information for cross-context behavioral advertising. We may share information in the following limited circumstances:

• Service providers and subprocessors: Accurecord AI shares information with third-party vendors who provide infrastructure, payment processing, authentication, monitoring, and communication services on our behalf. All subprocessors are bound by data processing agreements that restrict their use of your data to the purposes for which it was shared. See Section 5 for the current subprocessor list.
• Corporate account administrators: If you use the Services under a Corporate account, your organization's designated administrators may have access to your account activity and usage data within the organization's workspace.
• Legal compliance and protection: Accurecord AI may disclose information when required by law, subpoena, court order, or other legal process; to protect the rights, property, or safety of Accurecord AI, its users, or the public; or to detect or prevent fraud or security incidents.
• Business transactions: If Accurecord AI is involved in a merger, acquisition, asset sale, or other corporate transaction, personal information may be transferred to the successor entity, subject to confidentiality obligations. Affected users will be notified as required by applicable law.
• De-identified and aggregated data: Accurecord AI may share de-identified or aggregated data that cannot reasonably be used to identify any individual, for analytics, research, or business purposes.
• With your consent: Accurecord AI may share your information for any other purpose with your explicit consent.

5. Subprocessors

Accurecord AI uses the following primary subprocessors that may process personal information or Customer Content on Accurecord AI's behalf. All subprocessors are under contract with appropriate data protection obligations. Accurecord AI will provide at least thirty (30) days' advance notice before adding or replacing a subprocessor that processes Customer Content.

6. AI Data Handling

6.1 AI Chat Messages. Accurecord AI processes inference prompts and completions through the AI Features using the providers and configurations disclosed in Section 6.5, subject to the applicable account, workflow and BAA restrictions. Accurecord AI does not persist inference prompt or completion content after the response, except clinical content an authorized organization user saves or accepts and the decisions, history and operational provenance described in the applicable service agreement. Uploaded customer files and retrieval indexes are separate storage flows governed by their stated terms. Search and usage metadata follow their separate disclosures; patient information must not be entered in search.

• Not used to train, fine-tune, retrain, benchmark, or otherwise improve any AI model operated by Accurecord AI or any third-party AI provider.
• Transmitted exclusively over TLS 1.2+ encrypted connections to HIPAA-eligible cloud infrastructure.
• Not retained by the Microsoft-hosted Azure OpenAI and direct OpenAI inference endpoints after the request. Those endpoints are configured and verified not to retain prompt and response content after the request. Microsoft approved modified abuse monitoring for our Azure subscription on 7 September 2026, which removes the default thirty (30) day storage of prompts and completions. This statement does not describe saved cases, uploaded reference files or retrieval indexes, which follow Section 7.
• Processed under Business Associate Agreements that Accurecord AI has executed with Microsoft Azure and OpenAI as required sub-processors. Microsoft-hosted Azure services and the direct OpenAI API are separate provider paths, each under its own executed Business Associate Agreement.

6.2 Org-Uploaded Guidelines. Corporate Pro + AI subscribers may upload organization-specific coding guidelines (PDFs). These documents are stored in encrypted blob storage (Microsoft Azure), and a copy is held, as an organization reference document, in a file-search store at Microsoft Azure (Azure OpenAI Service) and/or OpenAI so that they can be searched; they are used solely to generate AI coding guidance within your organization's account. They are not shared with other organizations or used to train any AI model.

6.3 Embeddings. Text extracted from uploaded guideline PDFs may be converted into vector embeddings for semantic search and AI retrieval. These embeddings are stored in your organization's isolated vector store and are deleted when the document is deleted; on account termination, uploaded guidelines are handled as described in Section 7.

6.5 AI Inference Non-retention. Accurecord AI uses only Microsoft-hosted Azure OpenAI and the direct OpenAI API for AI inference. Inference prompts and completions are not used to train models and are processed only through configurations verified not to retain their content after the request. This requires the applicable provider-approved content non-retention controls, including exclusion of content from provider abuse-monitoring logs, and compatible account or project, endpoint, model and feature settings. Accurecord AI excludes stateful response storage, background processing, persistent prompt caching and other features that would retain inference content beyond the request from this processing path. A provider’s eligibility label or a request-storage flag alone does not establish these safeguards. If a provider or feature change makes a route incompatible, Accurecord AI must stop using that route for this processing until the required safeguards are restored. This inference-content commitment does not describe separately stored non-PHI reference files or retrieval indexes, accepted case content, evidence history or operational records, each of which follows its separately disclosed lifecycle. Non-content usage and billing metadata may be retained as separately disclosed.

7. Data Retention

Accurecord AI retains personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law. Specific retention periods are as follows:

• Account information: Duration of active account plus three (3) years following account closure, or as required for legal compliance.
• AI inference prompts and completions: Not persistently stored or logged by Accurecord AI after the response, except clinical content an authorized organization user saves or accepts into a coding case and the decisions, history and operational provenance that case records. Case content is governed by the saved-case retention terms in Section 7 (Data Retention). Uploaded customer files, retrieval indexes, search operational metadata, and usage metadata are separate data flows subject to the specific retention terms stated in this Policy; inference zero retention does not describe those flows. Inference prompts and completions submitted through the AI Features are processed only through Microsoft-hosted Azure OpenAI or the direct OpenAI API using configurations verified before use not to use that content to train models or retain it after completing the request. The scope of this inference safeguard is described in Section 6.5 of the applicable Privacy Policy; separate application-session, case, file and operational-record retention follows its stated terms.
• Usage logs and telemetry: Necessary detailed usage metadata, excluding search text, is removed from live systems no later than ninety (90) calendar days after the event, and earlier where its purpose permits. Request and access logs are retained for no more than thirty (30) calendar days; application telemetry is retained for no more than ninety (90) calendar days. A particular record may be preserved longer only for a documented legal duty, preservation requirement or justified security investigation, with restricted access, periodic review and deletion when the basis ends. Security and compliance documentation has its separately applicable documented retention schedule; not every log is documentation that HIPAA requires to be kept for six years. Saved-case records, evidence, decision histories and applicable rights-support records follow the BAA and their disclosed category-specific schedule, rather than this general usage-log limit. Residual backup copies of records deleted from live systems expire no later than ninety (90) calendar days after live deletion, subject only to documented lawful exceptions. They remain protected, are not used for ordinary analytics, and deletions are reapplied after restoration before ordinary service use. Properly de-identified aggregate statistics may be kept longer.
• Administrative audit records identify authorized staff activity and, where necessary, the account or record accessed. We do not routinely retain the free-text names, email addresses or other search text entered in administrative search boxes. Detailed administrative search-event metadata follows the ninety-day usage-metadata limit unless a particular record falls within a separately documented security, compliance or lawful-preservation schedule. Necessary record-access audit evidence follows its disclosed category-specific schedule.
• Uploaded guidelines (Corporate): Organization-uploaded guidelines covered by the data-export obligation remain exportable during the applicable organization service and for thirty (30) calendar days after its termination or expiration. They and associated retrieval indexes are then deleted from live systems, and applicable providers are instructed to delete their copies. Earlier customer-directed deletion and lawful preservation follow the applicable agreement. Backups and provider-held copies follow the specifically disclosed lifecycle; PHI remains subject to the BAA. Any different service schedule must be disclosed and reconciled with the export obligation before acceptance.
• Support communications: Three (3) years following resolution.
• Billing records: Seven (7) years for tax and legal compliance purposes, as required by applicable law.
• Marketing preferences: Until you opt out or close your account.
• Enterprise PHI other than saved ICD-10 Coding Pro cases: Retained, returned, and destroyed according to the applicable BAA and service-specific retention terms disclosed before processing.
• Saved coding cases (ICD-10 Coding Pro organization accounts): The organization may export its saved coding cases during the applicable organization service and for thirty (30) calendar days after termination or expiration of that service. At the end of that export period, Accurecord AI will delete the affected PHI from live systems and instruct each applicable subcontractor to delete its copies. The applicable BAA's backup protections, deletion after restoration and documented lawful exceptions continue to apply. Disaster-recovery copies expire no later than ninety (90) calendar days after live-system deletion, subject only to the documented exceptions stated in the BAA. Non-content deletion evidence is retained under the compliance-document retention schedule, and a destruction certificate is available on request. If return or destruction of particular PHI is legally or technically infeasible, the BAA protections continue and use or disclosure is limited to the purpose making return or destruction infeasible. A specific legal retention or preservation duty, or a documented return/destruction-infeasibility exception under the BAA, may require particular PHI to remain after the ordinary deletion date. We limit the records and use to that basis, maintain safeguards, inform the organization unless legally prohibited, and review the need for continued retention. Once the basis ends, we promptly complete lawful return or deletion. Other records follow their ordinary schedule. Routine account and saved-case exports, downloadable reports and worksheets, and product print layouts exclude licensed CPT® content, including CPT® code numbers, modifiers and descriptions, for all users. The applicable contractual export window and retention timetable continue to apply. This routine-output restriction does not limit access, return or other assistance required by applicable law or the applicable BAA. Required patient-record assistance and returns are handled through authorized organization representatives and are not conditional on an active CPT® subscription. The contractual export window does not shorten an overriding legal duty.
• Export classification decisions identify the authorized reviewer, time, record version and classification and are maintained with the coding case under its applicable retention schedule. They do not alter the underlying record. We do not copy the note into ordinary usage or administrative-search logs to record that decision.
• We retain the limited end-user, entitlement, country-validation, accepted-terms and royalty-reporting records needed for CPT® licensing through the end of the third calendar year following the year to which they relate, and longer only where required for a documented lawful hold or unresolved audit. Patient content and raw search text are not included in these licensing records.
• The saved-case schedule applies to saved coding cases. Uploaded guideline documents, provider-hosted files, and retrieval indexes follow their separately disclosed retention and deletion terms. Any PHI remaining in those stores continues to be protected under the applicable BAA, including its return or destruction obligations.
• An authorized representative of an organization provides documented instructions about saved-case retention and whether the records form part of the applicable covered entity's designated record set under HIPAA. Standard instructions are recorded through the designated acceptance process and a confirmation is provided to the organization. If the standard arrangement does not meet its requirements, the organization must resolve that issue with Accurecord AI before submitting the affected PHI. A different retention schedule requires documented agreement identifying the records and effective date. Corrections to record classification and changes to retention are recorded separately; a change does not automatically shorten retention or delete existing cases. Classification does not waive patient rights or change HIPAA's legal definition. Export, live deletion and backup handling follow the service-end schedule stated in this Section and the BAA, subject to documented lawful exceptions.

Account deletion is handled under the category-specific retention periods above. Saved organization cases and uploaded guidelines follow the applicable service-end export and deletion schedule, rather than a separate account-deletion clock. Other personal information is deleted or de-identified within thirty (30) calendar days of a valid deletion request, subject to the specific periods and lawful exceptions stated above. PHI is handled under the applicable BAA and is not de-identified as a substitute for a required return or deletion without lawful authority.

8. Cookies and Tracking Technologies

8.1 Accurecord AI uses the following categories of cookies and similar technologies on its websites:

• Essential cookies: Required for the Services to function, including session management, authentication tokens, and security. Cannot be disabled.
• Preference cookies: Store non-essential settings such as your theme preference. May be disabled through your browser.

Accurecord AI does not use third-party analytics or advertising cookies (for example, Google Analytics or Azure Application Insights). See the Cookie Policy for the full inventory.

Where our referral program is enabled, we use FirstPromoter to connect referral visits with eligible signups and purchases, attribute referrals and administer affiliate commissions. Its referral-attribution script loads only on our pricing, plan-selection, signup and billing pages. It does not load on code-search, clinical-documentation or saved-case pages. Depending on the referral flow, FirstPromoter processes referral identifiers, account identifiers, the signup email and limited signup, subscription, conversion and commission information. We do not send patient information, search text, clinical documentation, saved-case content or AI prompts and responses to the referral tracker.

The observed attribution cookies are _fprom_tid, _fprom_ref and _fprom_details. Our campaign cookie lifetime is configured for sixty days. A referral parameter may be held in this browser’s local storage for use for up to sixty days, and is removed when passed to FirstPromoter or on the next access after expiry. A signup email may be held in the tab’s session storage to continue attribution through sign-in or checkout. It expires for attribution use after thirty minutes and is cleared when sent, on sign-out, when leaving the signup or checkout flow, or on the next access after expiry.

Referral attribution and commission records are retained for the period needed to attribute eligible referrals, administer and resolve commissions, prevent referral fraud and satisfy applicable recordkeeping duties. Retention is reviewed against those purposes, and deletion or de-identification is applied when continued retention is no longer justified, subject to a documented legal duty. FirstPromoter processes the relevant records under our data-processing terms. The Cookie Policy and vendor retention disclosure identify the applicable configured periods and deletion lifecycle. Requests concerning referral information may be sent to [email protected].

8.2 You may manage or disable non-essential cookies through your browser settings. Disabling essential cookies may impair your ability to use the Services.

8.3 Accurecord AI's websites do not currently respond to "Do Not Track" signals from browsers, as there is no industry-standard definition of what such signals require. Accurecord AI does not sell data to advertisers. Referral attribution operates only as described in Section 8.1 and our Cookie Policy. It may link a visit through a referral link with a later signup or purchase for attribution and commission administration.

9. Data Security

9.1 Accurecord AI implements commercially reasonable administrative, physical, and technical safeguards to protect personal information against unauthorized access, disclosure, alteration, and destruction. These safeguards include:

• Encryption in transit: TLS 1.2 or higher for all data transmitted between your browser and Accurecord AI's servers.
• Encryption at rest: AES-256 encryption for stored Customer Content and account data.
• Access controls: OAuth 2.0 and JWT-based authentication; role-based access controls limiting employee access to personal information on a need-to-know basis.
• Audit logging: Application-level audit logs. In the Accurecord API, high-risk shaped identifiers (SSN, MRN) are redacted from audit detail; account identifiers such as email addresses are deliberately retained, because an audit trail that cannot identify the actor cannot serve its forensic purpose.
• We retain necessary request and access metadata, including client IP information where needed for security, for no more than thirty calendar days in ordinary operation. Search text is omitted or masked in the request-URL and referrer fields of the hosting, network and application log records we retain. A particular record may be preserved longer only for the documented lawful or justified security basis described in Section 7, with restricted access and deletion when that basis ends.
• Infrastructure security: HIPAA-eligible cloud infrastructure operated by Microsoft Azure with physical security controls, availability SLAs, and independent security certifications (SOC 2, ISO 27001).
• Incident response: Formal security incident response procedures with defined breach notification timelines consistent with the BAA and applicable law.

9.2 No security system is completely impenetrable. Accurecord AI cannot guarantee that unauthorized third parties will never be able to defeat its security measures. In the event of a data breach affecting your personal information, Accurecord AI will notify you as required by applicable law.

10. International Data Transfers

10.1 Accurecord AI, LLC is based in the United States. If you access the Services from outside the United States, your personal information may be transferred to, stored, and processed in the United States or other countries where Accurecord AI's service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

10.2 For transfers of personal information from the European Economic Area (EEA), United Kingdom (UK), or Switzerland to the United States, Accurecord AI relies on lawful transfer mechanisms, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other mechanisms recognized under applicable data protection law.

10.3 By using the Services, you acknowledge and consent to the transfer of your personal information to the United States and other jurisdictions as described in this Privacy Policy.

11. Children's Privacy

The Services are not directed to individuals under the age of eighteen (18). Accurecord AI does not knowingly collect personal information from children under 18. If Accurecord AI becomes aware that it has collected personal information from a child under 18, it will take prompt steps to delete that information. If you believe Accurecord AI has collected information from a child under 18, please contact us at [email protected].

12. Your Rights and Choices

12.1 General Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• Access: Request a copy of the personal information Accurecord AI holds about you. Routine account exports provide personal data without licensed CPT® content. Licensed CPT® code numbers, modifiers, descriptions, guidelines, reference tables and other CPT® materials are excluded from routine account and saved-case exports, downloadable reports and worksheets, and product print layouts, including Save as PDF. This applies to all users, including users with CPT® access. Excluded content may be omitted or replaced with “[CPT® content withheld]”. Unrelated personal information is not excluded merely because it resembles a code. These routine exports are not the process for obtaining records required under applicable law or a BAA. To request your account information, contact [email protected]. Authorized organization representatives may use the same contact to request access to or return of records under the applicable agreement or BAA. We verify authority and provide required records to the authorized organization through the record-request process within applicable deadlines. Patients should request their records from the responsible healthcare provider or health plan; we assist the relevant organization as required by law and our BAA. The routine CPT® export restriction does not limit rights required by law, and an active CPT® subscription is not required to exercise those rights.
• Correction: Request correction of inaccurate or incomplete personal information.
• Deletion: Request deletion of your personal information, subject to legal retention requirements. Contact [email protected] to request account deletion.
• Portability: Request a copy of your personal information in a structured, machine-readable format.
• Opt-out of marketing: Unsubscribe from marketing communications at any time via the unsubscribe link in any email or by contacting us.

To exercise any of these rights, contact Accurecord AI at [email protected]. Accurecord AI will respond within thirty (30) days, or as otherwise required by applicable law. Accurecord AI may need to verify your identity before processing your request.

12.2 California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: Request disclosure of the categories and specific pieces of personal information collected about you, the sources, the business or commercial purpose, and the categories of third parties with whom it is shared.
• Right to Delete: Request deletion of personal information collected from you, subject to certain exceptions (e.g., legal compliance, completing a transaction).
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: Accurecord AI does not sell your personal information and does not share it for cross-context behavioral advertising. No opt-out is required.
• Right to Limit Use of Sensitive Personal Information: Accurecord AI uses sensitive personal information only for purposes permitted under CCPA, including providing the Services.
• Right to Non-Discrimination: Accurecord AI will not discriminate against you for exercising your CCPA rights.

Categories of personal information collected in the past 12 months: identifiers (name, email, phone, IP address); commercial information (subscription history, billing records); internet/network activity (usage logs, device information); professional information (job title, organization); and inferences drawn from the above for security and fraud prevention purposes.

To submit a CCPA request: email [email protected] with subject line "CCPA Request," or call 612-845-3432. You may designate an authorized agent to make a request on your behalf; Accurecord AI may require verification of your identity and the agent's authority before processing the request.

12.3 EEA / UK / Swiss Residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, your personal information is processed under the General Data Protection Regulation (GDPR) or equivalent law. Accurecord AI processes your personal information on the following legal bases:

• Performance of a contract: processing necessary to provide the Services you have subscribed to.
• Legitimate interests: fraud prevention, security monitoring, product improvement (aggregated statistics), and enforcing Accurecord AI's terms.
• Legal obligation: compliance with applicable laws and regulations.
• Consent: for any marketing communications (where required).

In addition to the rights in Section 12.1, EEA/UK/Swiss residents have the right to object to processing based on legitimate interests, and the right to lodge a complaint with a supervisory authority in your jurisdiction. To exercise your GDPR rights, contact [email protected].

13. Modifications to This Policy

Accurecord AI may update this Privacy Policy. If Accurecord AI makes material changes, it will provide notice by: (a) posting the updated Privacy Policy on the applicable website with an updated "Last Updated" date; and (b) sending notice to your registered email address at least thirty (30) days before material changes take effect, and it will obtain any consent required by law or an applicable agreement. Continued use of the Services does not expand a Business Associate Agreement, accept changed contractual fees, or give a consent that law or an applicable agreement requires.

14. Contact Information

For questions, concerns, or requests regarding this Privacy Policy or Accurecord AI's data practices:

© 2026 Accurecord AI, LLC. All rights reserved.