This document explains which data PsychSupervisor AI processes, why, for how long it is kept and who it is shared with. It describes what the product actually does; it is not a generic template.
1. What this product is and who uses it
PsychSupervisor AI is a working tool for mental health professionals: it transcribes their own sessions and prepares a structured clinical report based on the chosen therapeutic approach. The account holder is the professional. Clients are not users of this product; client data enters the system only when the professional uploads it.
The tool provides clinical decision support. It does not diagnose and does not replace professional judgement.
2. Roles: who is responsible for what
For client data, the controller is the professional who uploads it. We process that data on the professional's instructions and only for the function of the tool. Obtaining the client's consent and complying with applicable law is the professional's responsibility.
For the professional's own account data (name, email, phone) we are the controller.
3. Data we process
Account data
- Name, email address, phone number, country, interface and report language
- Verification state (email and SMS), session security settings
- Membership plan, plan period and usage counters
- If you used a promo code: the code and the date you used it
Clinical data uploaded by the professional
- Client file: alias and profile fields. Real names are not requested; the product is designed on the assumption that an alias is used
- Session recording (audio file) or a transcript written by the professional
- The processed transcript, the report, and the professional's session notes
Usage and security data
- Sign-in and session timestamps
- Rate limit counters (phone number stored masked)
- Administrative action logs: who performed which admin action and when
- Document codes printed into report PDFs and the record of their issuance
- Feedback messages you send
- Your device notification token, if you allowed notifications
Local assistant (only if you use it)
- On our server: your access status (free plan or purchase; if you made a purchase, the store, the order number and the date), whether your account is in the pilot, and the number of model download links issued per day
- Only on your phone: the model file, a signed access document, the fact that you have read the information notice, your chat history and a copy of your completed reports (both encrypted). What you type to the assistant and its answers never leave your phone
Data we do not process
- Location, contacts, calendar, photo gallery
- Advertising identifiers, ad tracking, advertising cookies. Website analytics cookies run only with your consent (section 7a)
- Other files on your device: file selection uses the system picker and only the file you choose is read
4. Why we process it and the legal basis
- To deliver the function of the tool (transcript, report, PDF): performance of a contract
- Account security, abuse prevention, rate limits: legitimate interest
- Session content, which is health data: the client's explicit consent obtained by the professional, together with the professional's own legal basis. We process this data on the professional's behalf
- Website analytics (Google Analytics): your consent. Without it, it does not run
- Compliance with legal obligations
No data is processed for advertising, profiling or resale.
5. Audio recordings and retention
A raw recording is kept for two purposes only: producing the transcript and letting you review it.
- The moment you approve the transcript, the recording is deleted
- If you do not approve it, the recording is deleted automatically within seven days at the latest
- Transcripts, reports and notes are kept according to the retention setting in your account (two, five or ten years; you choose)
- Data you delete is fully gone within seven days at the latest, because of the backup recovery window. We do not claim "deleted instantly", because that would not be true
- Feedback messages and administrative logs are retained for product safety; they contain no session content
- If you used a promo code, a keyed hash of your phone number is kept even after you delete your account, so that the same number cannot use a code a second time. The number itself is not stored; the hash is used only for this check
6. Where data is processed
Hosting, database, file storage and the server run on Google Cloud and Firebase in the European Union region (Belgium, europe-west1). Converting audio into text also runs on our own infrastructure in the same region; the recording is not sent to a third party for that purpose.
7. Who we share it with
Data is never sold. It is shared only with the service providers needed to run the tool, and only to the extent needed:
- Google Cloud / Firebase — hosting, authentication, database, file storage, notification delivery. European Union region
- Twilio — delivery of the SMS verification code. The data shared is the phone number. Where a transfer outside the European Union is required, it relies on standard contractual clauses
- Brevo — email delivery (for example the reply to your feedback). The data shared is the email address and the message itself
- Stripe — card payments made on the website. Card details are entered on Stripe's page; we do not see or store card numbers. The data shared is the email address and the subscription details
- Google Play and Apple App Store — subscriptions bought in the mobile app. The store processes the payment; we receive only the subscription status and a purchase identifier
- Sentry (Functional Software, Inc.) — error and crash reports from the app, so that faults can be fixed. Reports contain technical details (device model, app version, error trace), not session content, screenshots or recordings. Stored in the European Union (Germany)
- Uploaded documents — a transcript you upload as a document is not masked automatically; it is sent to the artificial intelligence provider below as you uploaded it. Remove names and identifying details before uploading
- Artificial intelligence provider — to produce the report, the masked transcript is sent to the provider's programming interface. NVIDIA is currently used; the provider can be changed from the admin panel and the alternatives are OpenRouter and Alibaba Cloud (Qwen) models. The analysis tier you use is visible in the app
- Artificial intelligence provider — text YOU WRITE in the AI chat and in the case file is sent to that same programming interface without masking. On this path you write the text and you know what is in it; whether you type a real name is your decision and your responsibility. The app keeps this stated under the chat box. Masking on the audio path (section 9 below) is unaffected
- Cloudflare, Inc. (R2) — download of the optional local assistant's model file. During the download Cloudflare sees only your IP address and the technical details of the request; no client data, transcript, report or account information is sent. The file is stored preferably in Europe; Cloudflare may serve the request from its global network, and transfers outside the European Union rely on standard contractual clauses
- Google Analytics (Google Ireland Limited) — website analytics, only if you consent. Details in section 7a
Data may be disclosed where there is a legally binding request from a competent authority. In that case you are informed unless we are legally prohibited from doing so.
7a. Website analytics and cookies
On the website and the web version of the app (psychsupervisor.com), Google Analytics is used to see, in aggregate, how the site is used. It runs only if you consent: before you do, no request is sent to Google and no analytics cookie is set. The Android app has no such analytics.
- Collected if you consent: the page visited, the time and length of the visit, browser and device type, screen size, language, the address that referred you, and approximate location derived from the IP address (country, city). Google Analytics does not store the IP address itself
- Not collected: name, email, account identifier, client information, audio recordings, transcripts, reports or any text you write. Your account is not linked to the analytics
- Advertising features are off: Google signals and ad personalisation are not used
- Cookies: _ga and a cookie starting with _ga_, for up to 13 months. Your choice is kept in your browser's local storage, not in a cookie, and you are asked again after twelve months
- Visit-level analytics data is kept in Google Analytics for up to 14 months; after that only aggregate counts that cannot be linked to anyone remain
- Google may also process this data outside the European Union, in the United States. That transfer relies on the EU-US Data Privacy Framework and standard contractual clauses
You can withdraw your consent at any time: choose "Decline" under the "Cookie preferences" link at the bottom of the privacy page (psychsupervisor.com/privacy). Analytics stops and the analytics cookies are deleted from your browser.
8. Artificial intelligence and training
Nothing you upload is used to train artificial intelligence models. We require the providers we use not to use data sent through their programming interface for training purposes.
A report is the output of a model and can be wrong. The product ties every heading of the report to its basis in the transcript; checking that tie is the professional's work.
The local assistant's model (section 8a) runs on your phone and is not trained with your questions or reports.
8a. Optional local assistant
Under Settings > On-device Assistant you can download an artificial intelligence model that runs on your phone (Gemma 4 E2B by Google, Apache-2.0 licence). If you do not download it, the app works as before. The assistant does not run on our servers; in your account it carries out only the actions you approve (see below).
- A single chat uses all of your completed reports that have been downloaded to your phone. For each question, the report sections most relevant to it are selected on the phone and shown as sources in the answer (client alias, session and section). If the question names a client's alias, only that client's reports are used. Questions about using the app do not use reports
- For questions such as "most often" or "in how many clients", the table is built on your phone by counting the labels of the findings attributed to you in your reports; the model does not count. The table is not a measurement or a performance assessment and is shown only to you
- It does not diagnose, does not produce clinical interpretation of its own and does not replace professional supervision. When something is not in the report, it says so
- Your questions and the model's answers are processed on your phone; they are not sent to our server or to any artificial intelligence provider
- Your chats are kept until you delete them, only on your phone, encrypted and tied to your account (chat history). They are not copied to the phone's backup and no other account can see them. You can delete a single chat or all of them at any time
- While you use the assistant (you have access and the model is installed), the sections of your completed reports are downloaded to your phone automatically so that they can be explained without internet. They are stored encrypted and tied to your account, and are not copied to the phone's backup. When a report is refreshed its copy is updated, and a file or session you delete is removed from the phone too. If you turn off "Keep reports on this phone" under Settings > On-device Assistant, the copies on the phone are deleted
- From the chat you can ask to create a new client file, upload a session, open a file or a report, and share a report PDF. The assistant only proposes these: each action is shown on screen as a card and carried out WITH YOUR APPROVAL, one at a time. A proposal is based only on your question; wording in the text of a report cannot trigger an action. Deletion, payments and plan changes cannot be done this way
- An approved action is carried out by the same function as on the app's own screens, and the data processing this policy describes for that action applies: when a file is created, the alias, approach and consent declaration are written to our server; a session upload continues on the upload screen with the same steps (including masking and review)
- The model file (about 2.6 GB) is downloaded from Cloudflare R2 (section 7). Your right to download is checked on our server, with a daily limit
- On the free plan the assistant is included; on the Standard and Professional plans it is unlocked by a one-time purchase. Payment is made through Google Play or the App Store, and your card details never reach us. The purchase is verified with the store on our server and tied only to your account; if the store refunds it, access ends
- So that you can use it without internet, a signed access document tied to your account is stored on your phone. On the free plan it is valid for 30 days and is renewed when you are online
- You can remove the model at any time under Settings > On-device Assistant; this does not remove your right to use it. When you delete your account, the assistant records on our server, as well as the report copies and the chat history on the phone you delete it from, are deleted too
- The local assistant does not mean that all of the app's network traffic stops: account sync, session upload and cloud analysis still use the internet
9. Masking and review
Personal data in the transcript is masked automatically. Masking works in two ways:
- Personal names are REPLACED WITH OTHER NAMES. "Ayşe" becomes, for example, "Deniz" in the transcript, and the same person keeps the same name throughout. Putting a placeholder where the name was broke the grammar of the sentence and degraded the report; putting a name where a name was removes the real name without breaking the text. Which names in the transcript were put there is stated on the review screen
- Phone numbers, email addresses, identity numbers, IBANs, addresses and links are hidden behind labels (such as [TELEFON], [ADRES])
The mapping between the real name and the name put in its place is not recorded anywhere; it is gone once the job finishes. Masking cannot be undone.
Masking is not perfect: an expression can slip through. That is why the transcript is presented for the professional's review, and can be corrected, before it is sent for analysis.
**The AI chat and the case file are OUTSIDE this path.** There the text is not produced by a machine but written by the professional: the question you type, the case information you give and the session report you add go to the analysis provider unmasked. The reason is the integrity of the text: changing a name inside the professional's own sentence would change what they wrote without their knowledge. On this path the professional knows what was written, and whether to type a real name is their decision; the app states this permanently under the chat box.
The chat and the documents added to a case file are stored under the client file and are deleted together with it.
10. Security
- All traffic travels over an encrypted channel (HTTPS)
- Access to data is locked to the account owner at the rules layer; no other user can read your files
- The admin panel cannot reach session content, transcripts or reports; only account metadata and aggregate counts are visible
- Device backup is disabled: session data is not copied into your phone's cloud backup
- Application integrity verification (App Check) is in place
No system is absolutely secure. If an incident affecting data security occurs, notification is made within the period required by law.
11. Your rights
You have the right to access your data, to ask for its correction or deletion, to object to processing, to receive your data in a portable form, and to withdraw a consent you have given.
Most of this you can do yourself inside the app:
- Settings > Data and privacy > Export: downloads your data as a file
- Settings > Data and privacy > Suspend account: use stops, data remains
- Settings > Data and privacy > Delete my account: account and all data are deleted
For written requests: info@probeside.com
12. Children
The product is not intended for use by anyone under eighteen. A professional uploading client data is responsible for obtaining the required consent from the legal representative if the client is a minor.
13. Changes to this document
When the text changes, the version number increases. For a significant change the app asks for consent again, and the version you accepted is recorded.
14. Contact
info@probeside.com
You can also use Settings > Feedback inside the app.