1. Introduction and scope

PsyBird.AI (“PsyBird,” “we,” “our,” or “us”) provides an AI-supported platform that helps licensed mental-health professionals extend therapist-directed support to their patients between sessions. PsyBird is not a healthcare provider, therapist, crisis service, or a replacement for professional treatment.

This Privacy Policy explains how we handle personal information. Because different rules apply to different data, please note which framework governs what:

2. Our role: business associate and data controller

When we handle PHI on behalf of a Practice, we act as that Practice’s HIPAA business associate, and the Practice (the covered entity) remains responsible for its own HIPAA obligations. For personal data that is not PHI (such as data from website visitors, prospective users, and therapist account and technical data) we act as a controller (or, under some state laws, a processor) and this Policy applies. The same underlying data can shift between these regimes, so we apply the protections appropriate to each.

3. Information we collect

Patient information. Depending on how a Practice configures the Service, we may process: name; email address; account information; therapist-assigned plans and exercises; therapist-entered notes; conversation content with the AI companion; mood, theme, and engagement data; exercise and activity data; and reports or exports generated through the platform.

Therapist and Practice information. Name; email address; professional and practice information; licensing information when provided; and account and usage information.

Information collected automatically. When you use the Service or visit our website, we and our service providers may automatically collect technical data such as IP address, device and browser information, log data, and usage information, including through cookies and similar technologies (section 6). In the context of a mental-health service, some technical data may be linked to health information and treated accordingly.

4. Sources of information

We collect information directly from you (for example, when you create an account or use the Service); from the Practice or Therapist that invites and manages a Patient; and automatically through your use of the Service and website.

5. How we use information

We use information to: provide AI-supported supportive interactions; deliver therapist-assigned exercises; maintain accounts; enable therapists to review engagement and act on flags; support communication between patients and therapists; generate reports and exports; support clinical-documentation and Remote Therapeutic Monitoring workflows where applicable; and maintain and improve the security and reliability of the Service.

Consent for sensitive data. Mental-health information is “sensitive” or “consumer health” data under many laws, which require opt-in consent to collect, use, or share it. Where consent is required, we (and the Practice, as applicable) obtain it before processing, and you may withdraw consent as described in sections 12–13. We do not use sensitive data for purposes incompatible with providing the Service.

6. Cookies and tracking technologies

We use cookies and similar technologies to operate the Service, keep you signed in, remember preferences, and understand usage so we can improve reliability and security.

No advertising trackers on health data. We do not place third-party advertising or cross-site tracking technologies (such as advertising pixels) on pages or flows that handle patient health information, and we do not use such data for targeted advertising. We honor recognized opt-out preference signals, including Global Privacy Control (GPC), where required.

7. Artificial intelligence and automated processing

The Service uses AI to generate supportive interactions and summaries. AI may encourage reflection, offer emotional support, reinforce therapist-assigned exercises, and support continuity between sessions. The AI does not diagnose, make treatment decisions, replace a licensed professional, or provide emergency services, and its output can be inaccurate. Discuss important concerns or treatment decisions with your therapist.

No training of public AI models on patient content. We do not use patient conversation content to train public or third-party AI models, consistent with our provider agreements. The AI does not make decisions that produce legal or similarly significant effects about you without a Therapist in the loop.

8. Conversation data

To provide continuity, the AI companion uses a limited window of recent conversation as context. That AI-context window is distinct from what the platform stores as the record of care: your Practice’s account retains conversation records, summaries, letters, and related data as needed to provide the Service and support your care, subject to the retention practices in section 14 and to your Practice’s own policies. Therapists may access patient conversations when authorized for treatment purposes.

9. How we share information

We do not sell your data. We do not sell personal information or consumer health data, and we do not share it for targeted advertising. Any “sale” of consumer health data would require your separate signed authorization, which we do not seek.

We share information only as follows:

• Treating Therapist / Practice: patient information is shared with the Practice responsible for the patient’s care.
• Service providers: vendors that help operate the Service, under contractual privacy and security obligations and, where they handle PHI, a BAA (section 10).
• Legal and safety: when required by law, regulation, or legal process, or where necessary to protect the safety, rights, or security of individuals or the Service.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy and applicable law.

10. Third-party service providers

We rely on providers to operate the Service, which currently include Google Cloud (database, authentication, serverless functions, and file storage, via Firestore, Identity Platform, Cloud Run/Functions, and Cloud Storage) and Anthropic (AI processing), among others. Providers that handle PHI do so under a BAA and are limited to using data as needed to provide services to us. We maintain a vendor inventory and confirm appropriate agreements are in place before any provider handles health data.

11. HIPAA and protected health information

Where we provide services to a Practice that is a HIPAA covered entity or business associate, and PHI is involved, we act as a business associate under a BAA and maintain administrative, technical, and physical safeguards designed to protect PHI, including authentication, access controls, encryption in transit and at rest, logging, and incident-response procedures. For PHI, your rights under HIPAA (such as access and amendment) are generally exercised through your healthcare provider, whose HIPAA Notice of Privacy Practices describes them.

12. Washington consumer health data (My Health My Data Act)

If you are a Washington resident, or your consumer health data is collected in Washington, the Washington My Health My Data Act may give you additional rights regarding health data that is not covered by HIPAA. These include the right to confirm whether we collect, share, or sell your consumer health data; to access it; to have it deleted; to withdraw consent; and to obtain a list of the third parties and affiliates with whom it has been shared. We do not sell consumer health data, and we do not operate geofences around healthcare facilities to identify, track, or message individuals.

Separate policy. These rights, and the categories, sources, purposes, and recipients of consumer health data, are described in our separate Consumer Health Data Privacy Policy, linked distinctly from our homepage as required by MHMDA. To exercise MHMDA rights, use the contact method there, or contact us below.

13. Your privacy rights and choices

Depending on where you live, you may have rights under state privacy laws (for example, California’s CCPA/CPRA and the Virginia-model laws now in effect in roughly twenty states). Whether a given law applies depends on the law’s thresholds and your residence. These rights may include:

How to exercise your rights. Contact us using the button at the end of this Policy. We will verify your request as required, allow use of an authorized agent where permitted, and respond within the timeframe the applicable law requires (generally within 45 days). For PHI, please contact your healthcare provider, as HIPAA rights are exercised through them.

14. Data retention and deletion

We retain personal information only as long as needed to provide the Service, support care and documentation workflows, comply with legal obligations, resolve disputes, and maintain security. Retention of PHI is governed by the BAA and the Practice’s instructions. On request, and consistent with the BAA and applicable law, we make patient records available for export and return or delete data, with backups purged on our standard cycle. You may contact us for information about applicable retention periods.

15. Data security and breach notification

We use administrative, technical, and organizational safeguards designed to protect information, including authentication, permission-based and restricted access, encryption, secure infrastructure providers, and monitoring and incident-response procedures. No method of electronic storage or transmission is completely secure.

Breach notification. If a breach affecting your information occurs, we will provide notifications as required by applicable law, which may include HIPAA’s Breach Notification Rule (via the affected Practice), the FTC’s Health Breach Notification Rule, and state breach-notification laws.

16. Children’s privacy

The Service is intended for use under the direction of a licensed professional. A minor may use the Service only where permitted by law and with the consent of a parent or guardian and/or the supervising Practice, consistent with applicable minor-consent laws. We do not knowingly collect personal information from children under 13 except as permitted under the Children’s Online Privacy Protection Act (COPPA).

17. International users

The Service is intended for use in the United States, and information is processed and stored in the United States. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law.

18. Changes to this Privacy Policy

We may update this Policy from time to time. We will post the updated Policy with a new effective date and, for material changes, provide reasonable notice (for example, by email or in-app notice). For new categories of health data or new purposes, we will obtain any consent required by law before the change takes effect.

1. Agreement to these terms

Applies to: all users

These Terms of Service (“Terms”) are a binding agreement between you and PsyBird.AI (“PsyBird,” “we,” “our,” or “us”) governing your access to and use of the PsyBird platform, applications, and related services (the “Service”). By creating an account, accepting these Terms, or using the Service, you agree to them. If you do not agree, do not use the Service.

If you accept these Terms on behalf of a healthcare practice or other organization (a “Practice”), you represent that you are authorized to bind that organization, and “you” includes that organization.

Related documents. These Terms incorporate by reference the PsyBird Privacy Policy and, for Patients, the Patient Consent. For a Practice that is a HIPAA covered entity or business associate, a separate Business Associate Agreement (“BAA”) governs the handling of protected health information (“PHI”); to the extent the BAA conflicts with these Terms regarding PHI, the BAA controls (see section 12).

2. Definitions

Applies to: all users

• Practice: a licensed provider or group that subscribes to the Service and invites Patients.
• Therapist / Authorized User: an individual authorized by a Practice to use the Service.
• Patient: an individual invited by a Practice to use the Service as part of that Practice’s care.
• Content: information submitted to or generated through the Service, including messages, notes, exercises, summaries, and letters.
• PHI: protected health information as defined under HIPAA.

3. Eligibility, accounts, and minors

Applies to: all users

Eligibility. To create an account or accept these Terms you must be at least 18 years old and able to form a binding contract.

Minors. A Patient under 18 may use the Service only where permitted by law and with the consent of a parent or legal guardian and/or the supervising Practice, consistent with applicable minor-consent laws. The Practice is responsible for obtaining and documenting any consent required to enroll a minor. PsyBird does not knowingly allow children under 13 to create accounts.

Account security. You are responsible for maintaining the confidentiality of your credentials, for all activity under your account, for providing accurate information, and for not sharing your account. Notify us immediately of any suspected unauthorized access.

4. Description of the Service

Applies to: all users

PsyBird is an AI-supported platform that helps licensed mental-health professionals extend therapist-directed support to Patients between sessions. Features may include AI-supported supportive conversations, therapist-assigned exercises and activities, engagement tracking, therapist dashboards, progress information, and data exports supporting documentation workflows. The Service supports, and does not replace, therapist-directed care.

Changes to the Service. We may modify, add, or discontinue features from time to time. We will not make changes that materially reduce core functionality for a paid Practice during a paid term without notice.

5. Not medical advice or a healthcare provider

Applies to: all users

PsyBird is not a healthcare provider, therapist, psychologist, counselor, physician, or emergency service, and does not practice medicine or provide healthcare. PsyBird does not diagnose conditions, provide independent clinical assessments, make treatment decisions, provide emergency intervention, or replace professional healthcare. All clinical decisions and care are the sole responsibility of the licensed professional. Nothing generated through the Service is medical advice.

6. Crisis situations and emergencies

Applies to: all users

The Service is not designed for emergencies and is not monitored in real time. Content that appears concerning may be summarized or flagged to the Patient’s Therapist for later review; this is not real-time monitoring and is not a substitute for emergency care. Do not use the Service to request urgent or emergency help.

If you are in crisis: call 911 (or your local emergency number), or call or text 988 (U.S. Suicide & Crisis Lifeline). The Service may also direct you to these resources.

Practice responsibility. Practices remain solely responsible for clinical monitoring, for their own duty-to-warn, mandatory-reporting, and safety-planning obligations, and for acting on any flags or information surfaced through the Service.

7. Artificial intelligence disclosure

Applies to: all users

The Service uses artificial intelligence to generate supportive interactions and summaries. You acknowledge that: you may be interacting with an AI system rather than a person; AI output can be inaccurate, incomplete, or otherwise flawed and may “hallucinate”; AI output is not professional or medical advice and does not reflect the views of any licensed provider; and the AI does not replace communication with your Therapist. Discuss significant concerns or treatment decisions with a licensed professional.

8. Practice and Therapist responsibilities

Applies to: Practices & Therapists

Practices and Therapists are responsible for: determining whether the Service is clinically appropriate for a given Patient; obtaining any patient consents required to use the Service and to enroll minors; reviewing Patient information as clinically appropriate and acting on flags; maintaining professional standards of care and making all treatment decisions; maintaining accurate medical documentation; supervising Authorized Users; and ensuring their billing and coding practices (including RTM) comply with applicable requirements. PsyBird provides technology tools and does not determine clinical appropriateness or reimbursement eligibility.

9. Patient responsibilities and acceptable use

Applies to: all users

You agree not to: attempt to gain unauthorized access to the Service or another user’s information; circumvent or probe security controls; upload malicious code; use the Service for unlawful purposes; interfere with the Service’s operation; or submit information about third parties that you are not authorized to share. Patients should use the Service as a companion to, not a substitute for, professional care and emergency support.

10. Remote Therapeutic Monitoring (RTM)

Applies to: Practices & Therapists

The Service may help Therapists collect and export Patient engagement information that can support RTM workflows. PsyBird does not determine whether RTM or other billing requirements are met, submit insurance claims, guarantee reimbursement, or provide billing advice. Providers are solely responsible for verifying payer requirements and submitting accurate claims and documentation.

11. Fees, billing, and subscription renewal

Applies to: Practices (paying customers)

Fees. Subscription fees are set out in the plan you select and are payable in advance for each billing cycle. You authorize us (or our payment processor) to charge your payment method for all fees and applicable taxes.

Automatic renewal. Unless cancelled at least 30 days before the end of the then-current term, your subscription automatically renews for successive monthly or annual terms (matching the term you selected) at the then-current price. You may cancel at any time in your account settings; cancellation takes effect at the end of the current paid term.

Price changes. We may change fees on at least 30 days’ notice, effective at your next renewal.

Non-payment; taxes; refunds. We may suspend the Service for non-payment. Fees are exclusive of taxes, which are your responsibility. Except as required by law or expressly stated, fees are non-refundable.

12. Privacy, PHI, and the BAA

Applies to: all users

Our handling of information is described in the Privacy Policy, incorporated by reference. Patients acknowledge that their Therapist and Practice may access information generated through the Service, that we process information through approved technology providers (section 14), and that authorized providers may review AI interactions consistent with the Patient Consent.

PHI and the BAA. Where a Practice is a HIPAA covered entity or business associate and PHI is involved, the parties will enter a BAA, which governs PHI and controls over these Terms to the extent of any conflict regarding PHI. Practices are responsible for ensuring a BAA is in place before transmitting PHI through the Service.

13. Content, ownership, and licenses

Applies to: all users

Your Content. As between you and PsyBird, Practices and Patients retain ownership of their Content. You grant PsyBird a limited, worldwide, non-exclusive license to host, store, process, and transmit Content solely to provide, secure, and support the Service, and as permitted by the Privacy Policy and any applicable BAA.

AI training. PsyBird does not use Patient conversation Content to train public or third-party AI models, consistent with our provider agreements and Privacy Policy.

Feedback. If you give us feedback or suggestions, you grant us a perpetual, royalty-free license to use it without obligation to you.

14. Third-party services

Applies to: all users

The Service relies on third-party providers, which may include Google Cloud (database, authentication, serverless functions, and file storage, via Firestore, Identity Platform, Cloud Run/Functions, and Cloud Storage) and Anthropic (AI processing), among others. We evaluate and manage providers that handle PHI under applicable privacy and security requirements and appropriate agreements. Your use may also be subject to those providers’ terms; we are not responsible for third-party services outside our control.

15. Intellectual property

Applies to: all users

All rights, title, and interest in the Service (including its software, branding, design, and technology) are and remain the property of PsyBird and its licensors. Subject to these Terms, we grant you a limited, non-exclusive, non-transferable, revocable license to use the Service for its intended purpose. You may not copy, modify, reverse engineer, create derivative works from, resell, or redistribute the Service except as permitted by law or with our written consent.

16. Suspension and termination

Applies to: all users

We may suspend or terminate access if you violate these Terms, misuse the Service, create security or safety risks, fail to pay, or engage in unlawful activity, and (where practicable) we will give notice. You may stop using the Service at any time; Practices may cancel as described in section 11.

Effect of termination. On termination, your right to use the Service ends. On request and consistent with the BAA and applicable law, we will make Patient records available for export and will return or securely destroy Content within 30 days, subject to backups purged on our standard cycle. Provisions that by their nature should survive (including sections 5–7, 13, 15, and 17–22) survive termination.

17. Disclaimer of warranties

Applies to: all users

The Service is provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory, including implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement. We do not warrant that AI output will be accurate or reliable, that the Service will be uninterrupted or error-free, or that use of the Service will produce any particular clinical outcome. Some jurisdictions do not allow certain disclaimers, so some of the above may not apply to you.

18. Limitation of liability

Applies to: all users

To the maximum extent permitted by law, PsyBird and its officers, employees, and suppliers will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or for lost profits, revenue, data, or goodwill, arising out of or relating to the Service or these Terms, whether in contract, tort, or otherwise, even if advised of the possibility.

PsyBird’s total aggregate liability arising out of or relating to the Service or these Terms will not exceed the greater of (a) the fees paid to PsyBird in the twelve (12) months before the event giving rise to the claim, or (b) US$100.

Clinical decisions, diagnoses, treatment, and outcomes are the sole responsibility of licensed providers, and PsyBird is not liable for them. Nothing in these Terms limits liability that cannot be limited by applicable law.

19. Indemnification

Applies to: Practices & users

You will defend, indemnify, and hold harmless PsyBird from third-party claims, damages, and reasonable costs (including attorneys’ fees) arising out of or relating to: (a) your use of the Service; (b) your violation of these Terms or of applicable law; (c) your Content or data; (d) your clinical decisions, care, or documentation; and (e) your billing, coding, or RTM submissions. We will promptly notify you of the claim, give you control of the defense (with our reasonable cooperation), and not settle without your consent where the settlement imposes obligations on you; you will not settle in a way that admits fault by, or imposes obligations on, PsyBird without our consent.

20. Governing law and dispute resolution

Applies to: all users

Governing law and venue. These Terms are governed by the laws of the State of Washington, without regard to conflict-of-law rules. The state and federal courts located in King County, Washington have exclusive jurisdiction, and the parties consent to that venue.

Informal resolution. Before filing a claim, the parties will try in good faith to resolve it by contacting us at the address below.

21. Changes to these Terms

Applies to: all users

We may update these Terms from time to time. For material changes, we will provide reasonable advance notice (for example, by email or in-app notice) before they take effect. Your continued use of the Service after the effective date of updated Terms constitutes acceptance. If you do not agree, stop using the Service.

22. General

Applies to: all users

Assignment. You may not assign these Terms without our consent; we may assign them in connection with a merger, acquisition, or sale of assets.

Force majeure. Neither party is liable for delays or failures caused by events beyond its reasonable control.

Severability; waiver. If any provision is unenforceable, the rest remains in effect; failure to enforce a provision is not a waiver.

Entire agreement. These Terms, with the Privacy Policy, Patient Consent, and any BAA or order form, are the entire agreement and supersede prior agreements on their subject matter.

Notices; electronic communications. You consent to receive communications electronically. Notices to you may be sent to your account email.

Relationship; no third-party beneficiaries. The parties are independent contractors; these Terms create no agency or partnership and no third-party beneficiary rights.

By creating an account or using the Service, you acknowledge that you have read, understood, and agree to these Terms.

This Washington Consumer Health Data Privacy Policy (“CHD Policy”) describes how PsyBird.AI (“PsyBird,” “we,” “us,” or “our”) collects, uses, shares, and protects “consumer health data” as defined by the Washington My Health My Data Act, RCW 19.373 (“MHMDA”). It applies to consumers who are Washington residents and to consumers whose consumer health data is collected in Washington.

What this policy does not cover. This CHD Policy applies only to consumer health data governed by MHMDA. It does not apply to protected health information (PHI) that we handle for a licensed practice under HIPAA and a Business Associate Agreement (that information is described in the practice’s HIPAA Notice of Privacy Practices), or to other information exempt from MHMDA (including information governed by HIPAA, and employment-related data).

1. Categories of consumer health data we collect

“Consumer health data” is personal information linked or reasonably linkable to a consumer that identifies the consumer’s past, present, or future physical or mental health status, including information derived or extrapolated from non-health data. We may collect the following categories:

• Information that identifies you as seeking mental-health-related services (for example, when you contact us or interact with our website or intake flows).
• Mental-health status or related information you provide, or that is inferred from your interactions with us, outside of a HIPAA-covered treatment relationship.
• Technical and usage information from our website which, in the context of a mental-health service, may be linked or reasonably linkable to health status.

2. Sources of consumer health data

We may collect consumer health data from:

• You directly: for example, through forms, inquiries, or intake interactions.
• Your interactions with our website or app: for example, navigation or inquiry pathways that indicate health-related intent.

3. Purposes for collecting and using consumer health data

We use consumer health data only for the following purposes, and only with your consent or as necessary to provide a product or service you have requested:

• To respond to your inquiries and requests.
• To provide, operate, secure, and improve our website and services.
• To connect you with a licensed practice where you have asked us to.
• To comply with legal obligations and to protect against security incidents, fraud, or illegal activity.

We do not use consumer health data for targeted advertising, and we do not use it for purposes that are incompatible with those described here.

4. Categories of consumer health data we share

We share only the categories of consumer health data listed in section 1, and only where necessary for the purposes described in section 3. We do not share consumer health data with advertising or cross-site tracking vendors.

5. Categories of third parties with whom we share

Where we share consumer health data, we do so only with:

• Service providers and processors that perform functions on our behalf (for example, website hosting, secure form and database operation) under contracts requiring them to protect the data and use it only under our instructions.
• Government entities or others when required by law or legal process, or as necessary to protect safety, rights, or security.

6. Specific affiliates with whom we share

MHMDA requires that affiliates be named specifically, not by category. We do not share consumer health data with any affiliates.

7. No sale of consumer health data; no geofencing

No sale. We do not sell consumer health data. Under MHMDA, any sale would require your separate, written, and signed authorization, which we do not seek.

No geofencing. We do not use a geofence around any entity that provides in-person health care services to identify or track consumers, to collect consumer health data, or to send notifications, messages, or advertisements related to consumer health data or health care services.

8. Your rights under the My Health My Data Act

If you are a Washington consumer, you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data.
• Obtain a list of all third parties and affiliates with whom we have shared your consumer health data, together with active contact information for each recipient.
• Have your consumer health data deleted, including by our direction to processors and affiliates that received it.
• Withdraw consent to our collection and sharing of your consumer health data.

9. How to exercise your rights

To exercise any of these rights, contact us using the method in section 11. We will take steps to authenticate your request as permitted by law. We will respond without undue delay and within 45 days of receipt; where reasonably necessary, we may extend that period once by an additional 45 days and will notify you of the extension and the reason. To withdraw consent, use the same contact method.

10. Changes to this policy

We may update this CHD Policy from time to time and will post the updated version with a new effective date. If we intend to collect new categories of consumer health data, or to use consumer health data for new purposes, we will disclose those changes and obtain your consent as required by MHMDA before doing so.

11. Contact us

A plain-language consent your patients see before their first chat. Template for review.

Psy is an AI companion, not your therapist. It supports the plan your therapist set and cannot diagnose or treat.

Your therapist stays informed. Conversations are summarized into check-ins your therapist can read, and anything concerning is flagged to them. Letters from Psy reach you only after your therapist approves them.

In a crisis, go beyond the app. If you are in danger or thinking about harming yourself, call or text 988 (US) or your local emergency number. Psy will remind you of this too.

Your data. What you write stays within your practice’s space, is never sold, and can be exported or deleted on request.

Isolation by design. Every row of clinical data is bound to a single practice; database-level rules make cross-practice access structurally impossible, not merely forbidden.

Encryption. All traffic is encrypted in transit; data is encrypted at rest by our infrastructure provider.

AI runs server-side. Model keys and prompts never reach a browser or phone. Every AI call is authenticated, authorized against the database, and metered.

No shared numbers. Patients and therapists communicate only through PsyBird; personal phone numbers are never exchanged or stored for messaging.

Revocation. Removing a patient severs data access instantly and signs out their sessions everywhere.

Disclosure. Found something? Email security@psybird.ai.