Encrypted where it matters most
Clinical free text carries field-level AES-256 encryption before it reaches the database — a leak yields ciphertext, not notes.
Worksheets photographed on a kitchen table. A GAD-7 forwarded as a PDF. “Did you get my email?” Between-session work deserves better than attachments — and your evening deserves fewer of them.
Client App
Every client you invite gets their own app — on the web today, coming soon to the App Store and Google Play. It holds exactly what you decide it should: this week's between-session work, a check-in when one is due, the next session, and a private thread to you. Nothing else. No feed, no noise — nothing to scroll at 2am.
Coming soon to the app stores — clients use it install-free on the web today.
Why it helps
Completed worksheets and check-ins reach you ahead of time — review in two minutes, not in the first ten of the session.
One list, due dates, gentle nudges. No lost paper, no “sorry, I forgot which one”.
Tools, check-ins and documents appear only when you decide — the app follows your formulation, not the other way round.
Inside the app
Five quiet surfaces — every one of them yours to control.
A client opening the app at a hard moment finds their work, not a dashboard — this week's tasks, the next session, and nothing to scroll at 2am.

Type an email address — that's the only detail you need. Your client taps the link and lands in their app.

Homework appears when you assign it. Check-ins appear only when one is due, and disappear when it's done. Tools like Activities or Behavioural Experiments appear only after you activate them for that client — the app is quiet by design.

Push notifications nudge gently — the evening before homework is due, the morning a check-in closes — and you choose which nudges each client gets, per assignment or as per-client defaults. Notifications never contain clinical content; they land on lock screens, so they simply say something needs attention.

A structured crisis plan the client can open in two taps — built with you in session, always in their pocket.
Private by design
Therapy runs on trust, so the client app is built not to leak it. The specifics, plainly:
The specifics — encryption, access, exports, incident response and every subprocessor — are public on the Privacy & Security page.
Clinical free text carries field-level AES-256 encryption before it reaches the database — a leak yields ciphertext, not notes.
Every record is scoped to the therapist–client relationship, enforced in the database — not by interface rules.
CBT Flow staff functionally cannot read client records; internal tooling sees anonymised counts, not content.
EU-hosted (Ireland), UK GDPR throughout, a DPA for your practice, and compliance housekeeping done in the background.
Plans
The client app is identical on Flow Solo and Flow Pro — the plans differ in practice tools, not the client experience.
The clinical essentials
£2.50per active client / month · from £7.50
The full client experience — pay only for the clients you work with.
Running the whole practice
£3.00per active client / month
Everything in Solo, with the money side handled.
Prices in GBP per month.
See how CBT Flow fits your practice — book a 20-minute demo with our team.
20 minutes · Google Meet · no obligation