Encrypted where it matters most
Clinical free text carries field-level AES-256 encryption before it reaches the database — a leak yields ciphertext, not notes.
FAQ
Pricing questions
Private by design
Their trust, protected by default
Therapy runs on trust, so the platform is built not to leak it. The specifics, plainly:
The specifics — encryption, access, exports, incident response and every subprocessor — are public on the Privacy & Security page.
Access is per-person
Every record is scoped to the therapist–client relationship, enforced in the database — not by interface rules.
We can't browse your clients
CBT Flow staff functionally cannot read client records; internal tooling sees anonymised counts, not content.
UK GDPR, end to end
EU-hosted (Ireland), UK GDPR throughout, a DPA for your practice, and compliance housekeeping done in the background.
Ready when you are
Join the waitlist and we'll invite you into the private preview.
- Therapist onboarding in the App
- Choose Solo or Pro after the free period
- Payments & invoicing on Flow Pro