Therapy is built on trust.

Before any technique, tool, formulation, intervention, progress note, or treatment plan, there is a basic agreement between therapist and client: what is shared in the room will be treated with care.

That matters because therapy records are not ordinary records. They can contain trauma history, family conflict, sexual experiences, risk concerns, identity questions, grief, shame, anger, fear, hope, and the kinds of private details people may not share anywhere else.

So when we think about AI documentation for therapists, privacy cannot be a checkbox at the end of the product roadmap. It cannot be something sprinkled over the top with a reassuring paragraph in a privacy policy.

It has to shape the product from the inside out.

At AirNote, our view is simple: privacy should be architectural, not cosmetic.

Start with the most sensitive material

The most sensitive part of therapy documentation is often not the final note. It is the raw session material.

A written note is already sensitive, of course. But a recording of a therapy session contains far more. It includes the client’s voice, the therapist’s voice, pauses, tone, emotion, uncertainty, names, context, and the natural messiness of human conversation.

That makes session audio incredibly useful for documentation. It also makes it deeply sensitive.

This is why AirNote is designed as a native Mac app with local transcription. Session audio is recorded on the therapist’s Mac, and transcription happens locally on the device using on-device speech recognition. Raw audio is not uploaded to AirNote’s servers for transcription, and it is deleted after transcription.

That is one of the most important privacy decisions in the product.

The point is not just technical elegance. The point is restraint. If the raw audio does not need to leave the therapist’s device, it should not leave the therapist’s device. If AirNote does not need to keep a recording, it should not keep a recording.

In a world where many products quietly move more data to the cloud because it is convenient, we think the better question is: what can we avoid moving at all?

For therapy, that question matters.

Send less, not more

AI systems need context to produce useful outputs. A good therapy note cannot be generated from nothing. It needs the session transcript, the therapist’s context, the selected note template, and sometimes relevant prior process-note context where the therapist has enabled that.

But “useful” should not mean “send everything everywhere”.

AirNote is designed around minimising unnecessary data transfer. For note generation, the app sends the text-based material needed to complete the specific task. The goal is not to collect as much clinical material as possible. The goal is to use the minimum necessary material to help the therapist produce a better draft.

That same principle applies to storage and logging.

AirNote is built to avoid persistent cloud storage of clinical records wherever possible, and to prevent clinical content from appearing in operational logs. In plain English, therapy content should not leak into the machinery around the product.

No accidental transcript snippets in debug logs. No client names in routine backend logs. No clinical notes sitting in places they do not belong simply because a system was easier to build that way.

Privacy is often described in big abstract terms, but in practice it is made up of small product and engineering decisions like these. What gets sent? What gets stored? What gets logged? Who can see it? How long does it remain there? Was it needed in the first place?

Our answer, wherever possible, is to send less, store less, and expose less.

Keep the therapist in control

Privacy is not only about where data goes. It is also about who remains in control of the work.

AirNote’s AI outputs are drafts. That applies to Clinical Notes, Process Notes, client summaries, professional letters, homework documents, and Ask AirNote responses.

The therapist reviews them. The therapist edits them. The therapist decides what is accurate, what is proportionate, what should be saved, and what should be shared.

AirNote does not diagnose. It does not make risk determinations. It does not replace clinical judgement. It does not automatically send documents to clients, GPs, insurers, employers, schools, or third parties.

That boundary is important because clinical records are not just text. They are professional documents. They can affect future care, client understanding, safeguarding decisions, onward referrals, employment processes, insurance claims, legal disclosure, and the therapist-client relationship itself.

A privacy-respecting AI product should not quietly move clinical material through automated workflows without deliberate human review. It should support the therapist’s judgement, not obscure it.

The therapist should remain the person who decides what a note says, what a document includes, and where that document goes.

Support should not mean access

Many software products are built around a simple assumption: if something goes wrong, support staff can look inside the account.

That may be convenient, but it is not the right default for therapy records.

AirNote staff do not have routine access to therapists’ local client records, transcripts, notes, or documents. If support is needed, the therapist chooses what to share. Diagnostic logs are designed not to include clinical content.

This may make support more careful. Sometimes it may mean asking the therapist to describe a problem rather than simply opening their data. Sometimes it may mean building better diagnostic tools that explain what happened without revealing what was said in a session.

We think that trade-off is worth it.

A therapy documentation product should not turn private clinical material into support material just because that is easier for the software company.

Compliance matters, but architecture matters too

AirNote is built to support GDPR and HIPAA-compliant use.

That means having the right legal, operational, and security foundations in place: data processing agreements, business associate agreements where required, subprocessor controls, incident response procedures, breach registers, support access policies, operational security controls, and privacy-focused logging standards.

For HIPAA workflows, protected health information is routed only through BAA-backed infrastructure and services.

These things are important. Compliance is not just paperwork. It creates responsibilities, boundaries, and accountability.

But compliance is not the whole story.

A product can have policies and still collect more data than it needs. It can have legal documents and still make poor architectural choices. It can promise security while routing sensitive material through avoidable cloud processes. It can technically meet a requirement while still making therapists feel uneasy about where their client data is going.

Our aim is different. We want the privacy-preserving choice to be the default product choice.

That means local transcription where possible. Minimal cloud processing where cloud processing is needed. No unnecessary clinical telemetry. No routine staff access to local client records. Therapist-reviewed outputs. Clear separation between formal clinical records and therapist-facing reflections.

It also means being honest about what the product does and does not do. Privacy is not helped by vague promises or magical language. Therapists deserve plain explanations.

Privacy should feel calm

Therapists should not need to become infrastructure experts to understand how their documentation tool treats client data.

They should be able to ask simple questions.

Where does the recording go? Is raw audio uploaded? Who can access my client records? Is clinical content stored in logs? Does AI make decisions for me? Can I review everything before it is saved or shared?

AirNote is being designed so those answers are clear.

The recording stays on the Mac. Raw audio is not uploaded for transcription. Clinical records are not routinely accessible to AirNote staff. Operational logs should not contain clinical content. AI outputs are drafts. The therapist reviews and approves what matters.

That is the kind of privacy we believe therapy software should offer: practical, understandable, and built into the way the product works.

Not privacy as a slogan.

Privacy as a set of decisions.

Privacy as restraint.

Privacy as respect for the therapeutic relationship.