Privacy & Security

Privacy & Security at the Core

We don't just claim it — protections are built into the platform's layers. Your patient data never reaches an AI model in identifiable form. Each protection below is labelled with its real status today, so you always know what is live versus what is on the roadmap.

Zero PII to AI
Active

Before any text reaches an AI model, client and guardian names, phone numbers, and emails are replaced with reversible placeholders. The model only ever processes de-identified text; full names are restored in the response only for you.

Access Audit Trail
Active

Every time a client record is viewed, created, edited, or deleted, an append-only entry is written to your audit log — with the action, record, time, and source IP. The log can be read but never altered from the app.

Per-Therapist Isolation
Active

Every clinical record is scoped to the therapist who owns it. Each account's clients, sessions, notes, and finances are queried only within that account — practitioners never see each other's data.

De-identified to Providers
Active

Because redaction happens before the request leaves the platform, the AI provider receives no raw patient identifiers in the first place — independent of any provider-side data-retention policy.

Encryption In Transit & At Rest
Planned

HTTPS/TLS in transit and encrypted database storage at rest are configured at deployment. They depend on the hosting environment and are not yet guaranteed on every install.

HIPAA / PIPEDA Alignment
Planned

The platform is being built toward U.S. HIPAA and Canadian PIPEDA controls (encryption, audit trails, access controls). Formal compliance also requires organizational measures and signed agreements with providers, which are in progress — not yet certified.

How your data stays private
1

You write notes

Your notes contain client names, phone numbers, and emails.

2

PII redactor strips data

Names become [[NAME_1]], phones become [[PHONE_1]], emails become [[EMAIL_1]].

3

AI processes safely

The model receives only anonymized, de-identified text.

4

Names restored for you

You see full names in the response; the model never did.

Before — what you type

"Maya Tremblay called at 514-555-1234 about her session"

After — what the AI sees

"[[NAME_1]] called at [[PHONE_1]] about her session"

Your recent access log
Live

These are real, append-only entries from your own audit trail — the same record that makes access to patient data accountable.

Loading your audit trail…
Privacy