Privacy & Security at the Core
We don't just claim it — protections are built into the platform's layers. Your patient data never reaches an AI model in identifiable form. Each protection below is labelled with its real status today, so you always know what is live versus what is on the roadmap.
Before any text reaches an AI model, client and guardian names, phone numbers, and emails are replaced with reversible placeholders. The model only ever processes de-identified text; full names are restored in the response only for you.
Every time a client record is viewed, created, edited, or deleted, an append-only entry is written to your audit log — with the action, record, time, and source IP. The log can be read but never altered from the app.
Every clinical record is scoped to the therapist who owns it. Each account's clients, sessions, notes, and finances are queried only within that account — practitioners never see each other's data.
Because redaction happens before the request leaves the platform, the AI provider receives no raw patient identifiers in the first place — independent of any provider-side data-retention policy.
HTTPS/TLS in transit and encrypted database storage at rest are configured at deployment. They depend on the hosting environment and are not yet guaranteed on every install.
The platform is being built toward U.S. HIPAA and Canadian PIPEDA controls (encryption, audit trails, access controls). Formal compliance also requires organizational measures and signed agreements with providers, which are in progress — not yet certified.
You write notes
Your notes contain client names, phone numbers, and emails.
PII redactor strips data
Names become [[NAME_1]], phones become [[PHONE_1]], emails become [[EMAIL_1]].
AI processes safely
The model receives only anonymized, de-identified text.
Names restored for you
You see full names in the response; the model never did.
Before — what you type
"Maya Tremblay called at 514-555-1234 about her session"
After — what the AI sees
"[[NAME_1]] called at [[PHONE_1]] about her session"
These are real, append-only entries from your own audit trail — the same record that makes access to patient data accountable.