Privacy Policy

Last updated: July 16, 2026.

This Privacy Policy explains how Itaca collects, uses, shares, and protects personal information when you use our websites, including https://itaca.ai and https://app.itaca.pro/sign_up?locale=en, Itaca mobile applications and related services (collectively, the “Services”).

Professional users are responsible for obtaining the necessary authorizations, privacy notices, and other legal bases to incorporate patient information into the Services.

Information We Collect

We may collect the following categories of information:

Account Information and Authentication: Name, email, encrypted password where applicable, account identifiers, and data necessary to log in and maintain the session.
Professional and organizational information: specialty, function, workplace, preferences, and other information that the user provides to configure the Services.
Clinical Information and User-Provided Content: Patient data, notes, appointments, forms, documents, attachments, and other content that the user enters, uploads, or generates through the Services.
Audio recordings: When the user starts a recording, we process the voice and sounds within it to provide transcription, documentation, and clinical workflow features.
Technical and Usage Information: activity within the product, device and application information, technical logs, performance data, and diagnostics necessary to operate, protect, and improve the Services.
Billing Information: Information needed to manage your subscription and billing. Full payment method details are processed directly by Stripe and are not stored by Itaca.

Sign in with Google and Apple

Google. When the user decides to connect their Google account, we can request access to Google Calendar and Google Contacts through user-authorized permissions. Calendar access allows for displaying, creating, or updating events related to Itaca sessions when authorized by the user. Contacts access allows for reading basic contact information to help link them to records in Itaca; we do not create, modify, or delete contacts in the Google account. Google tokens are stored encrypted and can be revoked from Google or Itaca settings.

Apple. When the user signs in with Apple, we receive an Apple user identifier, and when provided by Apple, their name and email address. If the user chooses “Hide my email,” we receive a private relay address from Apple instead of their real address. We use this information solely to create, authenticate, and manage the account. Apple controls the email forwarding and the relay address.

Mobile Apps and Permissions

Mobile applications request microphone access when the user is utilizing a recording feature. During a user-initiated recording, the application may continue audio capture if it moves to the background to complete the session. Itaca does not use the microphone to capture audio continuously or for purposes unrelated to a user-initiated recording.

The application can also open system selectors for the user to choose documents or audio files they wish to attach. Itaca does not automatically access the device's photo, document, or file library.

How do we use information?

Provide, authenticate, personalize, maintain, and protect the Services.
Process audio, documents, notes, and other content to generate transcriptions, text extraction, drafts, and other user-requested features.
Manage subscriptions, payments, support, and operational communications.
Understand product usage, resolve errors, maintain performance, and improve Services.
Fulfill legal obligations, prevent fraud, and protect the rights, safety, and integrity of Itaca, its users, and third parties.

Artificial intelligence processing

To perform certain functions, Itaca may send necessary content for the request to infrastructure and artificial intelligence providers, including Amazon Web Services, OpenAI, Google/Gemini, Mistral AI, and ElevenLabs. For example, these providers may be involved in storage, transcription, optical character recognition, draft generation, or language processing. The involvement of each provider depends on the function being used.

Clinical and patient information processed through Itaca is not used to train artificial intelligence models. The results generated by AI are support for the workflow and must be reviewed by the responsible professional before being used in patient care or in a clinical record.

Analytics and diagnostics

We use Amplitude to measure product interactions and understand usage, and Bugsnag to detect and resolve technical failures. In the current mobile configuration, Amplitude can receive account or device identifiers, version and platform information, interaction events, and app lifecycle data. We do not enable advertising identifiers, location, Session Replay, or the intentional sending of clinical content, file names, URLs, tokens, or free text to Amplitude.

Bugsnag receives diagnostic information to help identify errors. We configure error handling to exclude clinical content and sensitive authentication values from managed errors. Public websites may also use cookies or similar technologies necessary for their operation and measurement; applicable choices are displayed on the site where relevant.

Payments

We use Stripe to securely process payments. When you make a purchase, payment information is collected and processed directly in accordance with Stripe's privacy policy. Itaca does not store or have access to full card details or other payment methods.

How do we share information

We do not sell or rent personal information. We share information only when it is necessary to provide the Services, for example with hosting, storage, AI processing, transcription, payment, analytics, and diagnostics providers described in this policy; when you connect a third-party service; with your organization when it manages your account; or when required or permitted by law.

Providers can process information in the countries where they operate. We apply reasonable contractual and technical measures, as appropriate, to protect information shared with service providers.

Security

We protect data with reasonable technical and organizational measures. Data is encrypted in transit and at rest, and we implement access controls and security measures appropriate to the nature of the Services. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Retention and disposal

We keep account information and content needed to maintain and provide the Services for as long as the account is active or as long as is necessary for the purposes described in this policy. Raw audio recordings are typically scheduled for deletion within two days of processing completion; they may be temporarily retained during processing, retries, or error handling.

When requesting the deletion of an account, we disable access and delete or restrict information in accordance with record ownership, organizational obligations, legal, tax, accounting, or regulatory requirements, and the need to maintain minimal information for security or resolution of requests. Billing data is retained for the period required by applicable law. Connected service data is handled in accordance with the connection and current permissions; the user can disconnect or revoke them.

Your rights and options

Under applicable law, you can request access, correction, updating, portability, restriction or objection to the processing, as well as deletion of your information. You can also manage Google connections and other preferences from the Services when available. To exercise your rights or request account deletion, write to us info@itaca.ai.

Changes to this Policy

We may update this Privacy Policy as our Services, practices, or legal requirements change. We will post the updated version on this page and indicate the date of the latest revision. When required by law, we will provide additional notice or seek your consent.

Contact

For questions about this Privacy Policy or the processing of personal information, please contact Itaca at info@itaca.ai.