Privacy is the architecture.

You are the data controller for your clients’ information. psylab, operated by Build AS, acts only as your data processor — handling data on your instructions and nothing more.

You choose what to record, what to transcribe, and what to keep. Nothing reaches a supervisor or anyone else unless you choose to send it, and you can delete any session or client at any time. Every AI output is a draft for you to review — psylab never makes automated decisions about a client’s care.

All personal and health data is processed and stored within the EU/EEA and governed by the GDPR. Processing of clinical data rests on the health-professional basis under Article 9(2)(h) GDPR, with you acting in your professional capacity. The few providers we rely on operate within the EU/EEA (or a jurisdiction with an EU adequacy decision) and are bound by data-processing agreements.

Data is encrypted in transit with TLS 1.2+ and at rest with AES-256, across databases, file storage, and backups. Plaintext connections are not accepted.

Your clients’ data is never used to train AI models. The AI providers behind psylab perform inference only — they receive pseudonymised material or your questions about a case, and return a result. Nothing is retained by them to improve their models.

psylab is a professional workbench and quality-assurance tool — not an electronic patient record (EPJ/EHR). Your official record stays in your own journal system. psylab holds professional work product: recordings you choose to process, pseudonymised transcripts, and draft documentation you transfer into your own system.

The reason almost nobody kept a recording is a good one, so it was the first thing we had to design for. psylab never asks who your client is. It doesn’t ask for a name, a date of birth or a personal number, because nothing in it needs them. A case has a title you choose, and we ask you to make it one that means something to you and nothing to anyone else.

What was said in the room is pseudonymised on its way in. Names, places, dates and the details that would point to a person are replaced, and the clinical meaning stays. It isn’t a setting, and there’s no version of psylab without it. The note, the feedback and anything you ask about a session are written from that text, so nothing after that step sees the original. We say pseudonymised rather than anonymised on purpose: it makes a client much harder to recognise, and we’d rather not claim more than that.

The recording itself isn’t kept. Audio is transcribed and then let go, and only the pseudonymised transcript stays. If you keep the audio so a supervisor can hear a session, the voice is changed first, and the original is deleted. That is what makes it safe to study your own work here, and to let AI help you with it: what’s on the page is the session, without the details that would identify a person.

We deliberately keep our supply chain small: a handful of EU-based cloud-infrastructure and AI-inference providers, each under a data-processing agreement. We don’t sell data, and we don’t share it for advertising. A current list of sub-processors is available to customers on request.

You and your clients have the full set of GDPR rights — to access, correct, erase, restrict, port, and object to the processing of personal data. Within psylab you can delete your data directly at any time; to exercise any of your other rights, our team and Data Protection Officer will help.

psylab is operated by Build AS, Ensjøveien 21L, 0655 Oslo, Norway (org. no. 930 335 584). We’ve appointed an external Data Protection Officer.

psylab is built by a small company in Oslo that hasn’t taken venture money. Raising tends to mean owing someone a rate of growth, and what a company owes shows up in the product: the price creeps up, and your data starts to look like an asset. We want to owe the people who use this.

So far psylab has been paid for out of our own pockets. From early access on, we want it paid for by the clinicians who use it, at one price for every therapist, held for the people already paying it. A few of them may come to own a small piece of the company. Nothing here depends on hitting a number by the end of a quarter.

We’re doing this because we think the quality of mental health care can go up, and that it starts with therapists being able to look at their own work. We also think AI can be used well here, on the clinician’s side, if the people building it are careful about what it’s for. psylab is our attempt to be careful.