Security and privacy for AI-assisted therapy notes
See what happens to session data, what the AI can and cannot do, and the controls that keep the counsellor responsible.
Session processing configured in the EU · Intuiti does not train on session content · Counsellor stays in control
Session-data lifecycle
What happens to therapy session data
Intuiti is a processing layer for the counsellor, not the keeper of the clinical record. Here is the path from a conversation to a reviewed working copy.
- 01
Choose the input
The counsellor can use a live session, upload an existing recording or choose a typed post-session recap without recording the conversation. Before recording, the controller must give the client the required information and establish the appropriate legal basis and permission.
- 02
Transcribe within the EU
Recorded audio is sent to an EU-configured transcription service.
- 03
Create the working draft
The transcript is used to create notes, summaries and observations. Account identifiers are excluded from analysis requests.
- 04
Counsellor reviews the result
Key AI-drafted surfaces display an AI disclosure and generated notes remain editable. The counsellor checks accuracy, decides what belongs in the record and remains responsible for use.
- 05
Keep, export or erase
The counsellor can export an individual session report as PDF and instruct Intuiti to correct or erase the clinical working copy. Accountability records are set out in our data processing agreement.
Privacy and security controls
EU-configured session processing
Core session content is transcribed and analyzed through EU-configured services and stored on EU-hosted infrastructure. Email data can be processed outside the EEA; our data processing agreement lists each sub-processor and its safeguard.
Intuiti does not train on session content
Intuiti does not use session content to train its own models, and its processing providers are contractually bound not to train on it; our data processing agreement gives the exact scope.
Works without recording
Prefer not to record a conversation? Use the post-session recap. The counsellor describes what came up and confirms the resulting session summary.
Your data, your rights
Clients exercise rights through the counsellor or practice that controls the session data. Intuiti acts on that controller's instruction — session-report PDF export, correction and erasure are in place.
Observations, not judgments
Intuiti is designed for documentation and continuity support. It does not diagnose, recommend treatment, score clinical risk or make care decisions. Where a feature provides supporting transcript evidence, the counsellor can inspect it; not every generated field has a universal source link.
AI stays visible and reviewable
Key AI-drafted surfaces display an AI disclosure and generated notes preserve draft provenance.
Trust
Intuiti is built to a register of rules, each recorded under its own reference.
- PHI-06
We never train on your sessions
Client data is not used to train AI models, and not for any unrelated purpose of ours.
- PHI-02
Fenced to the treating counsellor
Session content is visible only to the psychologist responsible for the client. Intuiti does not train on it and does not use it for any other purpose.
- INT-04
Transcripts are never kept for reuse
Intuiti never asks a provider to keep a transcript for reuse across requests. Only instruction text that contains no client data may be reused. Changing that needs a new risk assessment, not a config flag.
- INT-01 · INT-03
Processing stays in Europe
Transcription and analysis are deliberately configured for European processing, not the defaults these providers ship with.
- PHI-05
Erasure is complete, and receipted
Erasing a client removes the client, the sessions, everything derived from them, the audio and the analytics. Surviving audit records are anonymized and a receipt is written.
- INT-05
Seven days' notice before anyone new touches data
You get at least seven days' written notice before a new sub-processor handles client data, and we stay responsible for how it performs.
- PHI-10
Email never carries session content
Transactional email carries identifiers and titles you wrote yourself, never transcript text, notes, summaries or engine output.
Security and privacy questions
Is recording a therapy session required?
No. A counsellor can type a post-session recap without recording the conversation. Before any recording, the controller must provide the required information and establish the appropriate legal basis and permission.
Is therapy session data used to train AI models?
Intuiti does not use session content to train its own models, and its processing providers are contractually bound not to train on it; our data processing agreement gives the exact scope.
Where is therapy session content processed?
Core session content is transcribed and analyzed through EU-configured services and stored on EU-hosted infrastructure. Email data can be processed outside the EEA.
Can AI-generated notes be reviewed and corrected?
Generated notes remain editable and key AI-drafted surfaces display an AI disclosure. The counsellor must verify the content.
Can a client ask for their information to be deleted?
Yes, where the right applies. The client asks the counsellor or practice, which acts as controller and instructs Intuiti. Limited content-free accountability records can remain.
Does Intuiti diagnose or recommend treatment?
No. Intuiti creates documentation aids. It does not diagnose, recommend treatment, score clinical risk or make decisions about care. The counsellor retains clinical judgment and responsibility.
Privacy controls described openly
The full legal detail — sub-processors, rights — is set out in our data processing agreement.