Security at PsyBird.
A therapy record is among the most private things a person ever writes down. Here is how we keep it safe.
- BAA with every practice
- Encrypted in transit
- Never used to train AI
A BAA with every practice
Every practice signs one when it joins, and we hold one with our cloud provider, which stores the data and runs every AI model. Every clinician and clinic owner can open their signed agreements, the BAA among them, at the version they accepted, under Settings, Agreements, and gets a copy by email at signing. Data is encrypted in transit.
Client data never trains AI
Not by us, and not by our provider. A conversation is used only to write Psy’s reply, and each client’s Psy works from that client’s own record.
Notes stay with the clinician
Session notes, private notes and unapproved drafts are kept apart from the client’s record, so the client’s app never receives them. Clients are told their clinician can read their chats.
In a clinic, access is given
Every person has their own login and only the access the owner gives them. Opening a clinician’s records is read-only, and every view is logged; a clinic that bills for a clinician can also mark attendance and edit billing details.
Payments carry no health data
To charge a card we send the processor an amount and a random reference, nothing about the client. Card numbers go straight to the processor; PsyBird never sees one.
Your records are yours
Export any time, per client or the whole practice, and clients can download their own data. If a practice leaves, we offer its records for export and delete our copies within 30 days.
How Psy handles a crisis
Psy is PsyBird’s AI companion. This is our published protocol for what happens when someone talking with Psy may be in danger. Last reviewed October 15, 2026.
Psy is an AI, and says so. Before their first chat, every client accepts a consent that says Psy is an AI and not a person. The chat screen says it too, and if someone asks Psy what it is, it answers plainly. Psy never claims to be a person or a licensed professional.
Not an emergency service. PsyBird is not an emergency or crisis service, and nobody watches the chats as they happen. Psy cannot send anyone to help.
Thoughts of suicide or self-harm, or harm to or from someone else. Every message a client sends Psy is checked twice before Psy answers: against a fixed list of risk phrases, and by a separate AI safety check. When either finds a risk, Psy’s reply points the person to the 988 Suicide & Crisis Lifeline (call or text 988 in the US) and, for immediate danger, to 911.
The clinician is told at once. When Psy flags a risk, the client’s clinician gets an alert on their phone and an email right away, and again about an hour later if they have not opened the client’s file. The alert and the email say that a client’s chat needs attention, never what was said; the flag waits on the client’s file.
A physical emergency. For a client of a physical therapist, messages are also checked against a list of physical red flags, such as chest pain, trouble breathing, fainting or signs of a stroke. Psy’s reply tells the person to call 911 or go to the emergency room. PsyBird checks the reply before it is sent, and if it still leaves that out, a fixed message saying it goes out instead. The physical therapist is flagged.
Other concerns. When Psy summarizes a conversation for the clinician, safety concerns come first, including signs of an eating disorder, misuse of a substance or medication, abuse, or a sharp turn for the worse.
People looking for a therapist. On Find a therapist, if someone’s answers suggest they may want to die, or to harm themselves or someone else, the form shows them 988 at once (for physical therapy, 911 when it reads as an emergency), and the request is flagged for the clinician who receives it.
Young people. Clients aged 13 to 17 use PsyBird only with a mental health clinician and with a parent or guardian’s consent, and the same protocol applies to them. When the practice knows a client is under 18, Psy reminds them every three hours of a continuing chat that it is an AI and to take a break. Physical therapy clients must be adults.
If you are in danger now, call or text 988, call 911, or go to the nearest emergency room. Do not wait for Psy or for your clinician.
Found a vulnerability?
Email . We’ll confirm receipt, keep you posted and credit you if you like. Please don’t test against real client data.
Need a BAA or a security review?
BAA copies, security questionnaires and compliance questions go to the same address, and a person answers.