GDPR is not a checkbox for EU therapists — it is the legal framework governing every piece of patient data you handle. This page explains how Intuita is designed to work within that framework.
EU-configured session processing · Specific privacy controls · Therapist remains responsible
Many AI tools for therapists are built for the US healthcare market and adapted for Europe. HIPAA and GDPR are different legal frameworks for different jurisdictions — a HIPAA-compliant tool is not automatically GDPR-compliant. EU therapists need tools built within their regulatory context from the start.
Applies to all data subjects in the EU/EEA · Broad scope including therapy session data · Right to erasure, portability, restriction · High standards for health data (special category) · DPA enforcement per EU member state
Applies primarily to US covered entities · Different consent and breach notification standards · International transfers require separate GDPR compliance · Does not replace GDPR for EU data subjects
This is a general overview for context — not legal advice. Consult a qualified legal professional for your specific situation.
Intuita sends recorded audio to AssemblyAI’s EU asynchronous-transcription endpoint and analyses transcript text through Google Cloud’s European Vertex AI boundary. Structural speaker labels are pseudonymised, but names spoken in the dialogue can remain. Email and booking data can be processed outside the EEA.
Intuita does not use a vector database for session content. It stores the transcript and the notes, summaries and observations required for the documentation and continuity features selected by the therapist.
Account identifiers are excluded and structural speaker labels are replaced with generic roles. This reduces direct identifiers but does not anonymise the transcript: names and other identifiers spoken during the conversation can remain.
A valid Article 28 processor chain is required before real client data is processed. EU configuration is used for core session processing; where a provider processes data outside the EEA, the applicable DPA and transfer mechanism must be documented. Missing DPAs are a blocker, not a future safeguard.
Intuita applies automated checks intended to detect prohibited diagnostic, treatment and clinical-risk language. They reduce risk but do not replace source checking and therapist review.
Key AI-drafted surfaces display an AI disclosure and generated notes preserve draft provenance. Intuita does not yet claim exhaustive machine-readable marking or Article 50 compliance.
Intuita does not use session content to train its own models. Google’s managed Vertex AI terms restrict training without customer permission or instruction, and AssemblyAI states that files sent to its European servers are excluded from model training. Production account evidence must be retained.
Intuita is designed for documentation and continuity support. It does not diagnose, recommend treatment, score clinical risk, triage or make care decisions. Automated language checks reduce risk but the therapist must independently evaluate every output.
Professional secrecy remains with the practitioner and is not transferred to a software tool. Before using Intuita with real client data, the practitioner or clinic must establish the lawful basis and Article 9 condition, give the required information, obtain any permission required for recording, complete the controller–processor agreement, minimise data and independently assess generated content.
See the workflow with curated demo material and join the early-access list.
With your permission, we load our self-hosted Pulse analytics script to understand site use. Choose "Accept" to allow analytics or "Necessary only" to keep it off. Your choice is stored in this browser. Privacy Policy