COMFORTNOTES · PRODUCT POLICIES
Security & Data Protection
Clear information about the product and the organisation behind it.
Who operates ComfortNotes?
ComfortNotes is operated by Homecare Comforts Ltd, trading as Comforts Hearing. ComfortNotes is the product name, not a separate legal company.
Registered company name: Homecare Comforts Limited. Company number: 12224982. Registered office: 65 Seymour Avenue, Morden, Surrey, SM4 4RF, United Kingdom. These pages concern ComfortNotes, not the separate Comforts Hearing clinic website.
Raymond Hill is responsible for ComfortNotes support, security incidents and privacy requests. Contact: info@comforts-hearing.co.uk. Include ComfortNotes and your clinic name. Do not email patient records, photographs, audio, passwords or API keys.
Our approach to NHS England guidance
ComfortNotes is being developed with reference to NHS England’s guidance on AI-enabled ambient scribing. Its workflow supports clinician review, correction and approval of AI-generated documentation. Formal clinical-safety, information-governance and deployment assurance remain separate requirements. This is not a claim of NHS approval, certification or full compliance with the guidance. Organisation-specific assessment and authorisation are still required before NHS deployment.
The guidance informs our development approach; it does not replace supplier evidence, clinical-safety documentation, data-protection assessments or the adopting organisation’s checks. A working integration or a clinician’s document approval is not deployment assurance.
PROTECTION AT A GLANCE
How your information is protected
ComfortNotes combines protected hosting with account and clinic-access controls to help safeguard confidential information.
Protected storage
Patient records and private ear photographs are stored using Supabase. Supabase states that customer data is encrypted at rest with AES-256 and in transit using TLS. It publishes SOC 2 Type II assurance and ISO 27001 certification.
Supabase security (opens in a new tab)Protected connections
Netlify hosts ComfortNotes and handles backend requests. Netlify publishes SOC 2 Type II assurance and ISO 27001 certification, alongside encryption, security testing and protection against distributed denial-of-service attacks.
Netlify security (opens in a new tab)Controlled access
ComfortNotes uses protected sign-in sessions, supports two-step sign-in and checks clinic membership. Saved consultations and photographs are private by default. Explicit sharing gives a named clinic colleague access only to the selected approved text document, not its sources or photographs. Clinic administration does not automatically provide access to colleagues’ patient records.
Provider statements checked 22 September 2026. Available features and report access may depend on the provider plan and contractual scope.
Privacy and your rights
Our Privacy Policy explains what information is processed, why it is needed, which providers handle it, retention arrangements and your rights under UK data-protection law, including UK GDPR.
Clear, accountable security
These credentials relate to our infrastructure providers, not certification of ComfortNotes itself. Security also depends on application settings, staff practices and ongoing oversight. No online service can guarantee absolute security.
The supplier, international-processing and recovery limitations described in these policies remain applicable. Provider credentials do not establish account-specific contractual coverage or UK-only processing. See the Privacy Policy for current supplier and transfer information.
Clinic and account boundaries
Clinic membership and record-access checks are enforced by the service. Saved consultations and photos remain private by default. Authors may explicitly share selected approved text documents with named active clinic colleagues when clinic sharing is enabled. Clinic administration does not automatically grant access to colleagues’ records, and platform oversight does not grant routine access to patient records.
Separation of access is not a claim that every clinic has a separate physical database. This page is not a security certification or a guarantee that incidents cannot occur.
Sign-in and clinical review
Server-held credentials and protected session cookies are used for hosted sign-in. Do not share accounts or include credentials in support messages. Review transcripts and drafts before approval. Image reviews are written and confirmed by clinicians; automated image evaluation is unavailable.
Backups, recovery and archiving
Photo originals are stored privately. Native database backups do not themselves contain Storage files; the app keeps a verified recovery copy of completed photo uploads within the existing database. This is not a separate off-site copy that survives loss of the whole project. Daily physical backups were observed on 21 September 2026. Individual-photo recovery and a fictional local database restore have passed; a hosted native-backup restoration has not been demonstrated.
The current Supabase Pro service provides access to seven days of daily backups. This is not a promise of recovery within a particular time or immediate erasure of every backup copy. Archiving preserves records, versions and photographs. The retention schedule is owner-approved, but complete disposal and restore-safe removal still require operational verification. See the provider’s backup explanation.
Report a concern
Report suspected unauthorised access, a privacy concern or a security issue to info@comforts-hearing.co.uk. Describe the issue without sending patient information or secrets. We will need to verify the report and agree a suitable way to receive any sensitive evidence.
Clinic Data Processing Agreement
The independent-clinic agreement template was approved by Raymond Hill on 21 September 2026. It covers documented instructions, confidentiality, safeguards, subprocessors, assistance with rights and incidents, audits, and return or deletion. An independent clinic must complete its identity, processing, supplier, security, retention and exit schedules and agree the contract before its patient processing begins. Viewing this page or receiving platform approval does not execute that agreement.
Comforts Hearing is a trading name of Homecare Comforts Limited, not a separate contracting clinic. No agreement between that company and itself is required for its own care records. Its controller responsibilities and production safeguards still apply.
The revised clinic-processing provisions are included in our Terms of Service for review and express agreement. They do not retrospectively amend the approved template or an existing clinic agreement. Contact us to complete the clinic and supplier schedule. Supplier transfer assessments, any required data-protection impact assessment and operational release checks remain separate from a clinician’s document sign-off.
Optional Ask the evidence research chat
Available to active clinic members with an assigned Audiology or Physiotherapy workspace. This separate research, reference and education tool searches public web sources; other professions are not enabled. It is not a diagnosis, prescription, emergency service, clinical approval or accredited learning activity. Linked citations and an automated source-audit pass do not guarantee accurate interpretation, complete coverage, access to full text or currency. Check original sources and professional applicability before relying on an answer.
Do not enter patient identifiers or confidential information. No consultation records or transcripts are automatically accessed. User-entered questions and up to three recent completed exchanges pass through the protected service to OpenAI; search queries may reach its search providers. OpenAI response storage is disabled, but provider security and operational retention may apply. ComfortNotes does not save this chat to consultation, CPD or evidence history. It is held in the open research page and clears when you leave that page, change profession, sign out or refresh. Usage counters remain for rate limiting. There is no claim of zero retention or UK-only processing.
The service checks clinic membership and workspace assignment server-side. A shared 20-request hourly limit applies per account; failed attempts may count. Research requests do not consume clinic consultation credits or document AI revisions. This separate allowance does not unlock clinical processing after trial expiry. Access and supplier arrangements remain subject to the clinic’s agreed scope; this notice does not retrospectively amend an existing agreement.