@abekonge In HedgeDoc v1 there are no granular permission system. We rely on the basic permissions and you not sharing the link to the document for it to remain private.
HedgeDoc v2, which is currently in alpha, has a better permission system that allows inviting individual users to a note. (When can you run it in Production, you ask? We don't know yet 
but it'll certainly be in the future!)