Encrypted where it matters most
Clinical free text carries field-level AES-256 encryption before it reaches the database — a leak yields ciphertext, not notes.
Worksheets photographed on a kitchen table. A GAD-7 forwarded as a PDF. “Did you get my email?” Between-session work deserves better than attachments — and your evening deserves fewer of them.
Client App
Every client you invite gets their own app — on the web today, coming soon to the App Store and Google Play. It holds exactly what you decide it should: this week's between-session work, a check-in when one is due, the next session, and a private thread to you. Nothing else. No feed, no noise — nothing to scroll at 2am.
Coming soon to the app stores. Join the launch list for public-access updates.
Why it helps
Completed worksheets and check-ins reach you ahead of time — review in two minutes, not in the first ten of the session.
One list, due dates, gentle nudges. No lost paper, no “sorry, I forgot which one”.
Tools, check-ins and documents appear only when you decide — the app follows your formulation, not the other way round.
Inside the app
Five quiet surfaces — every one of them yours to control.
A client opening the app at a hard moment finds their work, not a dashboard — this week's tasks, the next session, and nothing to scroll at 2am.

Type an email address — that's the only detail you need. Your client taps the link and lands in their app.

Homework appears when you assign it. Check-ins appear only when one is due, and disappear when it's done. Tools like Activities or Behavioural Experiments appear only after you activate them for that client — the app is quiet by design.

Push notifications nudge gently — the evening before homework is due, the morning a check-in closes — and you choose which nudges each client gets, per assignment or as per-client defaults. Notifications never contain clinical content; they land on lock screens, so they simply say something needs attention.

A structured crisis plan the client can open in two taps — built with you in session, always in their pocket.
Private by design
Therapy runs on trust, so the client app is built not to leak it. The specifics, plainly:
The specifics — encryption, access, exports, incident response and every subprocessor — are public on the Privacy & Security page.
Clinical free text carries field-level AES-256 encryption before it reaches the database — a leak yields ciphertext, not notes.
Every record is scoped to the therapist–client relationship, enforced in the database — not by interface rules.
CBT Flow staff functionally cannot read client records; internal tooling sees anonymised counts, not content.
EU-hosted (Ireland), UK GDPR throughout, a DPA for your practice, and compliance housekeeping done in the background.
Plans
The client app is identical on Flow Solo and Flow Pro — the plans differ in practice tools, not the client experience.
The clinical essentials
£2.50per active client / month · from £7.50
The full client experience — pay only for the clients you work with.
Running the whole practice
£3.00per active client / month · claim 60 days through the launch waitlist
Everything in Solo, with the money side handled.
Prices in GBP per month.
Claim 60 days of Flow Pro now. Your 60 days begin when you activate your invitation.
60 days of Flow Pro · no card required to begin