Personvernerklæring

1. Who is responsible

psylab is operated by Build AS, Ensjøveien 21L, 0655 Oslo, Norway, organisation number 930 335 584 ("psylab", "we", "us").

This policy explains what personal data we handle, why, on what legal basis, for how long, and what rights you have. It applies to everyone whose data reaches us, and there are three quite different groups, so it is organised by who you are:

• Visitors to psylab.ai, including people who join the waitlist (section 3).
• Account holders: therapists, supervisors, and clinic or programme administrators who use psylab (section 4).
• Clients: the people a therapist sees in a session. Clients are not our users. Their data is controlled by their therapist, and we handle it only as the therapist's processor (section 5).

Privacy contact: privacy@psylab.ai. For any question about this policy or your data, or to exercise a right, write there.

2. The short version

• We never ask who a client is. No name, date of birth, personal identity number or contact detail for a client is ever requested or needed.
• What is said in a session is pseudonymised before it is stored. The recording is deleted after transcription. A session is deleted the day after it is ready unless the therapist keeps it. A kept session lives in a case folder for 14, 30 or 90 days, as the therapist chooses. Backups age out within 30 days after that, and the therapist's feedback and calibration records outlive the session.
• Nothing about a session reaches anyone unless the therapist chooses to share it.
• We never use anyone's data to train AI models, and neither do the providers we use.
• All personal and health data is processed and stored in the EU/EEA, encrypted in transit and at rest.
• We do not sell data, and we do not share it for advertising.
• If any of this changes, we tell you before it does.

3. Visitors to psylab.ai

3.1 Server logs and security

When you visit psylab.ai, our hosting provider receives your IP address, browser type, the page requested and the time, as any web server does. This is used only to deliver the page, to keep the site secure and to detect abuse. The site is served through Cloudflare; its edge logs are retained for no more than 24 hours. Legal basis: our legitimate interest in running a secure website (Article 6(1)(f) GDPR).

3.2 Analytics, only if you accept

We use PostHog, a privacy-friendly analytics service, to understand how the site is used: which pages are read, which sections are reached, and whether a form was completed. Nothing is collected until you accept the banner on your first visit. If you decline, or never answer, no analytics runs and no analytics identifier is set. Your choice is stored in your browser's local storage under a single key so we do not ask again; it is not a tracking cookie, and it never leaves your device. You can change your mind by clearing that storage. Legal basis: your consent (Article 6(1)(a) GDPR, and the Norwegian Electronic Communications Act § 3-15 for storage on your device).

Analytics data is hosted in PostHog's EU region and retained for 12 months. We do not use it for advertising, and we do not combine it with waitlist or account data.

3.3 The waitlist and contact forms

If you ask for early access, request a conversation, or start a pilot enquiry, we store what you give us: your email address, and optionally your name, which group you belong to (therapist, supervisor, investor, clinic, other), the treatment model you trained in, your country, your organisation or programme, a free-text note, and the language you used the site in. We also record the time of signup, your place in the queue, and, if you arrived through a referral link, the code that referred you.

We use this to reply to you about a place, to arrange the conversation you asked for, to prioritise early access, and to understand who is asking. Where transactional email is enabled, you receive one confirmation email through our email provider, Resend, and we record whether it was delivered or bounced. Legal basis: the steps you asked us to take before entering a contract (Article 6(1)(b) GDPR), and our legitimate interest in replying to people who wrote to us (Article 6(1)(f)).

We keep waitlist entries until early access closes for your group or you ask us to delete them, and in any case no longer than 24 months after your last contact with us. We do not add you to a newsletter, and we do not send marketing beyond replying to what you asked for, unless you separately agree to it.

3.4 Email to us

If you email privacy@psylab.ai or another address of ours, we keep the correspondence for as long as is needed to deal with it and to show that we did, and in any case no longer than 24 months.

4. Account holders

This section covers therapists, supervisors, and clinic or programme administrators with a psylab account. For this data, we are the controller.

4.1 What we hold about you

• Identity and login: your name, email address, password hash or sign-in provider identity, and the second factor you enrolled, if any. Sign-in is provided through Google Cloud Identity Platform, located in the EU.
• Professional profile: your role, the treatment model you trained in, the language you want the product in, and any clinic or programme you belong to.
• Organisation membership: for a clinic or programme, the list of its members and their roles, and the templates it has published, every version of them, with a name and a date on each.
• Billing: from general availability, the details needed to charge you, held by our payment provider, Polar. We see the status of your subscription, not your card.
• Service and security logs: sign-ins, the actions you take in psylab (a session was created, a share was made, a session was deleted), and technical events, so we can run the service, help you when you ask, and investigate a security incident. Every access to session content by our own staff is logged.
• Support: what you write to us, and what we did about it.
• Product usage: anonymised, aggregated measurements of how features are used. This never includes session content.

4.2 Why, and on what basis

We do not profile account holders, and we make no automated decision about you that has a legal or similarly significant effect.

4.3 How long

Your account data is kept while your account is open. When you close it, or we close it, we delete your profile and content as described in section 5.4, and your account record within 30 days. Security logs are kept for up to 24 months. Accounting records are kept for the five years the Bookkeeping Act requires. Where a legal claim is pending, we keep what is needed for it until it is resolved.

5. Clients, and everything inside a session

This section covers recordings, transcripts, notes, readings, annotations, questions and anything else that comes from or is about a therapy session. For all of this, the therapist is the controller and Build AS is the processor. We process it only on the therapist's documented instructions, under our Data Processing Agreement, and for no purpose of our own.

If you are a client and you have a question about your data, please ask your therapist. They are the person responsible for it, and the only person who can identify which sessions are yours. We will help them answer you, and if you write to us directly we will refer your request to them.

5.1 The lawful basis

The therapist, as controller, determines and secures the legal basis for processing clinical material, including the Article 9(2) GDPR condition: typically the client's explicit consent (Art. 9(2)(a)) where sessions are used for supervision or training, or Art. 9(2)(h) where they document care. This includes the applicable Art. 6 basis and any authorisation the therapist's duty of confidentiality requires. Whatever consent, notice or authorisation the therapist's law and ethics require for recording a session is the therapist's to obtain, and they confirm to us that they have it.

5.2 What we never ask for

psylab does not ask for a client's name, date of birth, personal identity number, address or contact details, because nothing in it needs them. A case has a title the therapist chooses, and we ask them to choose one that means something to them and nothing to anyone else.

5.3 What happens to a session, step by step

1. Recording. The therapist records a session, or uploads one, from their own device. Audio travels to us encrypted, and is stored encrypted in the EU/EEA while it is transcribed.
2. Transcription. The audio is transcribed by Soniox, a speech-to-text provider, in its EU region, under a data-processing agreement, with no retention on their side.
3. Pseudonymisation. The transcript is pseudonymised before it is stored. Names, places, dates and details that would point to a person are replaced, and the clinical meaning stays. This is not a setting, and there is no version of psylab without it. It is done by an AI model in the EU under a data-processing agreement, on an inference-only basis: the model sees the text, returns the replacement, and keeps nothing.
4. Deleting the recording. Once the transcript is ready, the raw recording is deleted, by default within 24 hours. If the therapist chooses to keep audio so that a supervisor can hear a session, the client's voice is converted to a synthetic one first and the original is deleted.
5. Drafting and reading. The note, the reading against the treatment model, and any answer to a question the therapist asks are produced from the pseudonymised transcript, by AI providers in the EU/EEA on the same inference-only basis. Nothing after step 3 sees the original.
6. Expiry. A session is deleted the day after it is ready unless the therapist keeps it. A case folder lasts 14, 30 or 90 days, as the therapist chooses, and every share made from it ends with it. Backups age out within 30 days after that, and the therapist's feedback and calibration records outlive the session. The therapist can delete any session, case or share at any time, and the deletion is not reversible.

We call step 3 pseudonymisation, not anonymisation, because that is what it is. It substantially reduces the risk that a person could be identified from what psylab holds; it does not make the material anonymous in the legal sense, and the therapist's duty of confidentiality continues to apply.

5.4 Who can see a session

• The therapist, and nobody else, by default.
• A supervisor, only for a session the therapist chose to share, only for as long as the folder lasts, and only pseudonymised. A supervisor cannot keep, download, export or share it on.
• A clinic or programme never sees sessions, transcripts or notes. It holds its templates and its member list, and nothing else.
• Our staff, only where strictly necessary to provide support the therapist asked for, to investigate a security incident, or where the law requires it. Each such access is logged. We do not read sessions to see how psylab is used.
• Nobody else. We do not sell session data, share it for advertising, or disclose it to any third party except the processors in section 6 and the cases in section 7.

5.5 Never used to train models

Session content, notes, readings and questions are never used to train AI models, ours or anyone else's. The AI providers behind psylab perform inference only: they receive pseudonymised material or a question about a case, return a result, and retain nothing to improve their models. This is contractual with each provider, and it is not a setting a therapist can turn off, because there is nothing to turn on.

6. Who we share data with

We deliberately keep our supply chain small. Everything below is a processor acting on our instructions, under a data-processing agreement, in the EU/EEA or in a country with an EU adequacy decision. A current, complete list of sub-processors with their locations is available to customers on request, and customers are told before a sub-processor is added or replaced.

Voice conversion runs on our own Google Cloud workloads and involves no additional provider. The same list, with legal bases, is Appendix C of the Data Processing Agreement, and customers are told 30 days before a sub-processor is added or replaced.

Where a provider offers a choice of region, we choose the EU. Where a provider is outside the EU/EEA and not covered by an adequacy decision, we do not use it for personal data.

7. When the law makes us disclose

We will disclose personal data to a public authority only where a valid legal obligation under Norwegian or EU law requires it. Where the law allows, we tell the affected customer first, and we disclose only what the obligation covers. Because session content is pseudonymised and short-lived, in most cases there is little to disclose, and we will say so.

8. Security

Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256, across databases, file storage and backups; plaintext connections are not accepted. Recordings and transcripts live in storage separate from the rest of the product, under stricter access control and customer-managed encryption keys. Access by our own staff is by named account, least privilege, and logged. Second-factor authentication is required for accounts. Backups are encrypted and follow the same retention as the data they hold, so a deleted session is gone from backups within 30 days.

If a personal-data breach occurs, we notify the affected customers without undue delay so they can meet their own obligations, and we notify the Norwegian Data Protection Authority (Datatilsynet) within 72 hours where the GDPR requires it.

9. International transfers, and users outside the EU/EEA

All personal and health data is processed and stored within the EU/EEA, whoever the customer is and wherever they practise. We do not transfer session content outside the EU/EEA. Where a support tool or a website provider is established outside the EU/EEA, we rely on an EU adequacy decision or on the EU Standard Contractual Clauses with supplementary measures, and never for session content.

If you are outside the EU/EEA, you get the same protections as an EU customer: the GDPR governs how we process your data, the rights in section 10 are yours regardless of where you live, and we notify breaches on the GDPR's terms. Your own law may give you further rights, and where it does, you have them too. You may complain to Datatilsynet or to the authority where you live.

All personal and health data is processed and stored within the EU/EEA. We do not transfer session content outside the EU/EEA. Where a support tool or a website provider is established outside the EU/EEA, we rely on an EU adequacy decision or on the EU Standard Contractual Clauses with supplementary measures, and never for session content.

10. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you, and get a copy;
• correct it if it is wrong;
• erase it, where there is no overriding reason to keep it;
• restrict how it is used while a question about it is resolved;
• port the data you gave us, in a machine-readable form;
• object to processing based on our legitimate interests, and to any direct marketing;
• withdraw consent at any time where consent is the basis, without affecting what was done before;
• complain to a supervisory authority. In Norway that is Datatilsynet, Postboks 458 Sentrum, 0105 Oslo, datatilsynet.no. You can also complain to the authority where you live.

Account holders can delete any session, case, share or their whole account directly in psylab, at any time, without asking us. For anything else, write to privacy@psylab.ai. We answer within one month, and we may ask you to confirm who you are first.

Clients exercise their rights with their therapist, who is the controller. We assist the therapist as our Data Processing Agreement requires.

Waitlist members and visitors can write to privacy@psylab.ai to have their entry deleted, and can withdraw analytics consent by clearing the site's local storage in their browser.

11. Children

psylab is a professional tool and accounts are for adults who are qualified or training in a mental-health profession. We do not knowingly hold account or waitlist data about anyone under 18. Whether a session with a minor may be recorded, and on whose authority, is governed by the therapist's law and professional rules, and is the therapist's responsibility.

12. Changes to this policy

We will update this policy when the product or the law changes. Where a change is material, and always where it touches anything in section 2, we tell account holders by email and in the product at least 30 days before it takes effect, and we do not apply it to sessions already recorded. The current version is always published at psylab.ai/privacy, with the date of the last change. The plain-language summary at psylab.ai/security is kept in step with it; if the two ever differ, this policy governs.

13. Contact

Build AS Ensjøveien 21L, 0655 Oslo, Norway Org. no. 930 335 584 privacy@psylab.ai

Privacy contact: privacy@psylab.ai. Legal notices: legal@psylab.ai.

---

If any part of this stops being true, we change the policy and tell you, not the other way round.