Security and privacy for AI-assisted therapy notes
See what happens to session data, what the AI can and cannot do, and the controls that keep the therapist responsible.
Session processing configured in the EU · Intuita does not train on session content · Therapist stays in control
Session-data lifecycle
What happens to therapy session data
Intuita is a processing layer for the therapist, not the keeper of the clinical record. Here is the path from a conversation to a reviewed working copy.
- 01
Choose the input
The therapist can use a live session, upload an existing recording or choose a typed post-session recap without recording the conversation. Before recording, the controller must give the client the required information and establish the appropriate legal basis and permission.
- 02
Transcribe within the EU
Recorded audio is sent to an EU-configured transcription service.
- 03
Create the working draft
The transcript is used to create notes, summaries and observations. Account identifiers are excluded from analysis requests.
- 04
Therapist reviews the result
Key AI-drafted surfaces display an AI disclosure and generated notes remain editable. The therapist checks accuracy, decides what belongs in the record and remains responsible for use.
- 05
Keep, export or erase
The therapist can export an individual session report as PDF and instruct Intuita to correct or erase the clinical working copy. Accountability records are set out in our data processing agreement.
Privacy and security controls
EU-configured session processing
Core session content is transcribed and analyzed through EU-configured services and stored on EU-hosted infrastructure. Email data can be processed outside the EEA; our data processing agreement lists each sub-processor and its safeguard.
Intuita does not train on session content
Intuita does not use session content to train its own models, and its processing providers are contractually bound not to train on it; our data processing agreement gives the exact scope.
Works without recording
Prefer not to record a conversation? Use the post-session recap. The therapist describes what came up and confirms the resulting session summary.
Your data, your rights
Clients exercise rights through the practitioner or clinic that controls the session data. Intuita acts on that controller's instruction — session-report PDF export, correction and erasure are in place.
Observations, not judgments
Intuita is designed for documentation and continuity support. It does not diagnose, recommend treatment, score clinical risk or make care decisions. Where a feature provides supporting transcript evidence, the therapist can inspect it; not every generated field has a universal source link.
AI stays visible and reviewable
Key AI-drafted surfaces display an AI disclosure and generated notes preserve draft provenance.
Trust
Intuita is built to a register of rules, each recorded under its own reference.
- PHI-06
We never train on your sessions
Client data is not used to train AI models, and not for any unrelated purpose of ours.
- PHI-02
Fenced to the treating therapist
Session content is visible only to the psychologist responsible for the client. Intuita does not train on it and does not use it for any other purpose.
- INT-04
Transcripts are never kept for reuse
Intuita never asks a provider to keep a transcript for reuse across requests. Only instruction text that contains no client data may be reused. Changing that needs a new risk assessment, not a config flag.
- INT-01 · INT-03
Processing stays in Europe
Transcription and analysis are deliberately configured for European processing, not the defaults these providers ship with.
- PHI-05
Erasure is complete, and receipted
Erasing a client removes the client, the sessions, everything derived from them, the audio and the analytics. Surviving audit records are anonymized and a receipt is written.
- INT-05
Seven days' notice before anyone new touches data
You get at least seven days' written notice before a new sub-processor handles client data, and we stay responsible for how it performs.
- PHI-10
Email never carries session content
Transactional email carries identifiers and titles you wrote yourself, never transcript text, notes, summaries or engine output.
Security and privacy questions
Is recording a therapy session required?
No. A therapist can type a post-session recap without recording the conversation. Before any recording, the controller must provide the required information and establish the appropriate legal basis and permission.
Is therapy session data used to train AI models?
Intuita does not use session content to train its own models, and its processing providers are contractually bound not to train on it; our data processing agreement gives the exact scope.
Where is therapy session content processed?
Core session content is transcribed and analyzed through EU-configured services and stored on EU-hosted infrastructure. Email data can be processed outside the EEA.
Can AI-generated notes be reviewed and corrected?
Generated notes remain editable and key AI-drafted surfaces display an AI disclosure. The therapist must verify the content.
Can a client ask for their information to be deleted?
Yes, where the right applies. The client asks the practitioner or clinic, which acts as controller and instructs Intuita. Limited content-free accountability records can remain, and a shared couple record requires a separate request.
Does Intuita diagnose or recommend treatment?
No. Intuita creates documentation aids. It does not diagnose, recommend treatment, score clinical risk or make decisions about care. The therapist retains clinical judgment and responsibility.
Privacy controls described openly
The full legal detail — sub-processors, rights — is set out in our data processing agreement.