Encrypted in the app
Clinical free text is encrypted with AES-256 before it reaches the database, as well as in transit and at rest.
Alongside the caseload you trained for, private practice hands you a second one: consent forms, retention rules, encryption questions, and the low hum of “am I doing GDPR right?”
Privacy & consent
Their trust, protected by default.
Send consent documents to a client's app and keep the signed record. Around that, the platform encrypts clinical notes, limits every record to you and your client, and gives you the paperwork a UK practice needs.
Why it helps
Specifics, not reassurance
01
Consent on record
Clients sign in their app. You see who has signed, who has not, and whose signature is out of date.
02
Encrypted before it is stored
Session notes, safety plans and what clients write in their tools are encrypted in the app, then stored.
03
Yours and your client's only
Each record is limited to the two of you, and the database enforces it.
How it's built
The specifics, plainly
This is how client data is protected in CBT Flow.
Access enforced in the database
Every record is tied to one therapist and one client. A request for anyone else's record is refused by the database itself.
Sign-in you can harden
Two-factor authentication, a PIN lock for when you step away, and a privacy mode that hides client names when others can see your screen.
UK GDPR, EU hosting
Data is hosted in the EU (Ireland). You get a data processing agreement, and you can export your data on any plan.
Consent, documented
Start from our informed consent template and make the wording yours. Each client is asked to sign it in their app by typing their name. Their profile shows what is signed, pending or out of date.
A signed record you can produce
Each signature downloads as a PDF with the exact wording signed, the typed name, the date and time, and a fingerprint of the text.
Notes that cannot be quietly changed
Sign a session note and it is locked. Later additions are dated addenda, so the record shows what was written and when.
In writing
The paperwork behind the promises
Read them yourself: the privacy policy and the data processing agreement are public. The Privacy & Security page sets out encryption, access, exports and every subprocessor.
Bring your data protection questions
Book a 20-minute demo. We will show where everything is stored and who can read it.
20 minutes · Google Meet · no obligation