Trust

What we hold,
and how we hold it.

intuitiveEMDR holds psychotherapy records, so this page says plainly where they live, who processes them, how they are protected and how long they stay. Each section names the document its claims come from. Ask us for any of them.

We sign a Business Associate Agreement

intuitiveSuite, Inc. acts as a Business Associate to every clinician who uses intuitiveEMDR. The agreement is presented at sign-up and signed before any client information can be entered. It is drafted from the HHS sample agreement, and every change to it is a new version that each account signs again.

Everyone who processes records on our behalf is bound in writing to the same restrictions. Who they are is the next section.

Source: the Business Associate Agreement, version 2026-10-15.1, paragraphs 2(d) and 2(e).

Who processes your records

Who	What for	Client data?	Agreement
Google Cloud (Cloud Run, Cloud SQL, Identity Platform, Vertex AI, Cloud Logging, Firebase Hosting), region us-east1	Runs the application, stores the records, signs clinicians in, drafts notes, keeps the audit log.	Yes. This is where the records live.	Business Associate Agreement executed; held by intuitiveSuite, Inc.
OpenAI	Transcribes session audio when the in-session scribe is on.	Audio, in processing only. Nothing is stored there.	Business Associate Agreement executed 2026-08-18. Zero Data Retention verified 2026-08-26 and re-read 2026-10-12.
Stripe	Subscription billing.	No. Your name, email and payment details only.	None needed: no client data.
Supabase	The light sync between your screen and the client's during bilateral stimulation.	No. Whether the stimulation is running and how fast, signed, with no name and no record.	None needed: no client data.

Nobody else receives client information. The application's own security policy names the hosts it may send data to, and nothing outside that list.

Source: the Security Risk Assessment, §1.2 (system inventory) and §1.4 (agreements).

Encryption

In transit. HTTPS only, everywhere. The database accepts encrypted connections only, and it has no public address at all: the only route to it is a private tunnel.
At rest. The database and the log archive are encrypted at rest with Google-managed keys.
In the browser. The page's Content Security Policy pins the hosts it may connect to and the hosts it may load images from, so the application cannot send anything anywhere else, and a test fails the build if that list widens.

Source: the Security Risk Assessment, §2.4 (transmission security) and §2.6 (encryption at rest).

Access controls

A verified identity on every request. Two-step sign-in with an authenticator app is required on every route that can reach client information, and the server enforces it: a modified browser gains nothing.
Separation decided by the database. Row-level security means one clinician's records do not exist for another clinician's account. An isolation test suite proves that before every release, and a failing run stops the deploy.
Least privilege. The clinical role cannot change subscriptions, the billing role cannot read clinical content, and the maintenance role can run four named functions and read no table.
An audit trail. Every view and change to a client's record is logged, append-only, and kept for seven years.

Source: the Security Risk Assessment, §2.1 (access control), §2.2 (audit controls) and §2.5 (authentication).

How long things stay

Session audio is never stored (since 2026-10-12, #203). The browser records the session in pieces of a few minutes; each piece is held only in the API's memory for its transcription request and is gone when the response is sent (api/src/routes/recordings.ts). What persists is the transcript text, under the same RLS as every clinical table. Transcript retention (migration 119, 2026-10-26): the transcript is deleted the moment the session's clinical note is signed — a database trigger clears transcript and transcript_segments on every session_recordings row of the session in the same statement that stamps ehr_note_signed_at, so it holds however the signature arrives — and a transcript whose note is never signed is deleted by the weekly purge after 30 days (TRANSCRIPT_TTL_DAYS in scripts/deploy-cloudrun.sh; src/__tests__/transcript-retention-guard.test.ts pins both). No client data is used to train any model: Vertex AI under the Google BAA and OpenAI under its BAA with Zero Data Retention.

In plain words: audio is never kept. When you sign a note, the transcript behind it is deleted in the same instant. A transcript whose note is never signed is deleted after thirty days. Nothing of your clients' is used to train a model.

Your records stay as long as your account does (Business Associate Agreement, paragraph 6(a)). The audit trail is kept for seven years. When an account closes, the records remain available for export for thirty days and are destroyed within sixty, backups expiring in their ordinary course (paragraph 6(c)).

Source: the Security Risk Assessment, §2.1, as amended 2026-10-26, quoted without change; the Business Associate Agreement, paragraphs 6(a) and 6(c).

Your records, on request

The records are yours. You can view and export them in intuitiveEMDR at any time, and when you ask, we produce a complete machine-readable copy of your account's records. Write to info@intuitivesuite.health.

If a client asks us directly for access to their records, we forward the request to you within ten business days. We do not answer it ourselves.

Source: the Business Associate Agreement, paragraphs 2(e) and 6(c).

What we do not claim

We do not put a compliance badge on the product. Compliance under HIPAA is something a practice achieves, with its software as one part; what software can do is say exactly who holds what, under which agreement, protected how, and for how long. That is this page.

Google Cloud's infrastructure is independently audited under SOC 2 Type II. That report is Google's, about Google's infrastructure. Our own Security Risk Assessment, modelled on NIST SP 800-30 and mapped to the HIPAA Security Rule, was approved by the owner on 2026-08-19 and is reviewed annually and after any material change; its review by healthcare counsel is outstanding.

Source: the Security Risk Assessment, title block (status, approval and review cadence).

What we hold,and how we hold it.