HIPAA-compliant AI therapy notes: Your clients' privacy is protected at every step.

HIPAA, PHIPA, PIPEDA and SOC 2 Type II, with a BAA for every account. Audio is deleted once the note is ready.

Try for free
Therapist avatars testimonial section
Rated 4.7 out of 5
4.7/5 · 1,376 ratings
G2G2 4.8
Capterra4.5
Session 4 noteSOAP · 50 min Saved
  • Audio recordingDeleted
  • Names in the transcriptRemoved
Every accountSolo or group
  • HIPAA, PHIPA & SOC 2 Type II compliant
  • BAA created at signup, in your profile
  • AES-256 encryption, at rest and in transit
Sample session, fictional

What stays, and what's gone.

Stays
  • Your notes, until you delete them
  • An anonymized transcript, until you delete it
  • Your signed BAA
Gone
  • The audio recording, once your note is ready
  • Names and identifying details, removed from the transcript
  • Your sessions never train AI

Start free: your BAA is created at signup. 14 days, 15 notes, no credit card.

Private by design. Compliant by requirement.

Notes that are accurate, ethical, and compliant, and data that stays private.

Mentalyc is HIPAA, PHIPA and SOC 2 compliant

HIPAA, PHIPA & SOC 2 Type II compliant

Mentalyc meets HIPAA, PHIPA and SOC 2 Type II requirements, so your clinical data is handled under healthcare privacy law.

Mentalyc is fully encrypted and secure

Encrypted in transit and at rest

AES-256 encryption at rest and in transit, hosted on AWS with enterprise-grade security controls.

Illustration: session audio deleted and identifying details removed

Audio deleted. Details removed.

Transcripts are anonymized and audio is deleted once your note is ready. Delete any session data any time, and it never trains AI models.

Mentalyc notes are ready for clients requesting access to their records

Ready for client records requests

Notes keep to what is clinically relevant, in clear and respectful language, so they are safe to share if a client asks for their records.

AI Therapy notes ready for insurance audits with Mentalyc

Ready for insurance audit

Medical necessity, clinically relevant detail and CPT code alignment in every note, built to hold up if a payer asks for documentation.

Download Client Consent or Business Associate Agreement with Mentalyc

BAA & consent template included

Every account is covered by our BAA, created at signup and in your profile. A client AI consent template is ready to share before the first session.

Read our BAA →Get the consent template →
Try for freeSee pricing →

From session to note: what happens to your data

There are no secrets to how we handle data.

Mentalyc secure HIPAA-compliant platform with encryption and data protection
In your session
  1. 1

    Encrypted recording

    Record the session or add a text or audio summary.

  2. 2

    Note setup

    Choose your note type and submit the session.

Inside Mentalyc
  1. 3

    Anonymized transcription

    Audio is converted to text, and identifying client details are removed.

  2. 4

    Context analysis

    The transcript is analyzed with past notes and client data for context.

  3. 5

    Note generation

    Once the note is created, the audio is deleted.

Back with you
  1. 6

    Therapist review

    You review, edit, and save the final note.

  2. 7

    Progress & insights

    Session data connects to track progress, client alliance, and matched worksheets.

Secure by design · HIPAA, PHIPA & SOC 2 Type II · Full therapist control

Kevin Ramotar, clinical leader in digital health and compliance
Rated 5 out of 5
"Radical data transparency is what healthcare needs at this point to build trust and reduce misinformation. With the development of new technologies, such as AI, it is even more important to keep everyone informed. I appreciate that Mentalyc is trying to elevate industry standards with high visibility for all."
Clinical leader in Digital Health, Quality, Compliance, and Patient Safety
Reviews

Trusted by 30,000+ mental health professionals

Therapist avatars testimonial section
4.7/5 · 1,376 in-app ratings
G2 4.8 out of 5 star rating badge - Mentalyc
4.8/5
Capterra reviews Mentalyc therapy documentation software
4.5/5
Rated 5 out of 5

“I’m able to move in and out of doing my notes within that small five-minute gap between sessions … I’m able to keep compliance and rest assured everything is covered.”

Amber McKinney, licensed therapist
Amber McKinney
LCSW, CA
Rated 5 out of 5

“If I were recommending this software to a colleague, I would tell them that it is the best thing that they could do for their practice.”

Dominique Walker, licensed therapist
Dominique Walker
LPC, TN
Rated 5 out of 5

“By the end of the day, usually by the end of the session, I have my documentation done. I have a thorough, comprehensive note… It’s just saving me hours every week.”

Jack Marchant, licensed therapist
Jack Marchant
CDCII, AK

Benefits for your clients

Using AI in therapy benefits your clients too

Therapist and client seated in a session, the therapist fully focused on the client

Undivided therapist attention

Therapists do not need to worry about memorizing all of the important session details. Instead, they can devote their full attention to the client and let Mentalyc focus on the notes.

Illustration showing outcomes improvement with Mentalyc

Better outcomes

Mentalyc captures interesting quotes and insight which help the therapists to better conceptualize the case and come up with better solutions.

Mentalyc notes improve compliance with insurance requirements

Fewer coverage denials

Mentalyc takes care that the notes are written in a way that complies with payer requirements. This lowers the chances of further treatment being denied by payers.

FAQs

Is Mentalyc a trusted HIPAA-compliant platform for behavioral health?

Yes. Mentalyc is a trusted HIPAA-compliant AI platform for behavioral health and mental health therapists, used by over 30,000 therapists. As one of the most trusted HIPAA-compliant medical transcription and note-taking tools for therapy, trust is backed by SOC 2 Type II, PHIPA and PIPEDA compliance, a signed BAA, recording auto-delete once your note is ready, and anonymized transcripts.

How do I verify if an AI scribe is actually HIPAA compliant?

Verify four things. (1) The vendor will sign a Business Associate Agreement (BAA). (2) The vendor is independently SOC 2 Type II audited. (3) There is a written data-retention policy that states how long recordings and transcripts are kept. (4) The vendor confirms in writing that your session data is not used to train AI models. Mentalyc meets all four.

What security and compliance reviews does Mentalyc pass for enterprise and group practices?

Mentalyc passes HIPAA, SOC 2 Type II, PHIPA, PIPEDA, and Australian Privacy Principles reviews. Every account is covered by our BAA, created when you sign up. Download your personalized copy any time from your profile settings, whether you're solo or part of a group. Session recordings are deleted once the note is ready, transcripts are anonymized, and your session data is never used to train AI. These are the controls enterprise and group-practice buyers review during AI notetaker security and compliance reviews, vendor security assessments, and compliance auditing documentation.

What’s the difference between HIPAA compliance and SOC 2 Type II for an AI scribe?

HIPAA is a U.S. law that governs how Protected Health Information must be handled by clinicians and their vendors. SOC 2 Type II is an independent audit that verifies a vendor’s security controls operate effectively over time. Mentalyc meets both. HIPAA defines the rules, SOC 2 Type II proves they are enforced, and together they are what buyers of AI platforms for behavioral health expect.

How does Mentalyc secure data as an AI scribe?

Mentalyc secures AI scribe data through four layers. First, HIPAA and SOC 2 Type II compliance. Second, encrypted connections. Third, session recordings are deleted once your note is ready. Fourth, your session data is never used to train AI models. A signed BAA defines how protected health information is handled.

Is an AI scribe a Business Associate under HIPAA, and does Mentalyc sign a BAA?

Yes. Any AI scribe or AI meeting notetaker that processes Protected Health Information (PHI) on behalf of a therapist is a Business Associate under HIPAA and must sign a Business Associate Agreement (BAA). Every Mentalyc account is covered by our BAA, created when you sign up. Download your personalized copy any time from your profile settings, whether you're solo or part of a group.

Will my boss be aware that I am using Mentalyc?

If you purchased the plan yourself, your account is private to you. If you want your supervisor to review your notes, you can share them.

However, if your practice manages your seat, the practice owner can see your saved notes and the clients linked to your account. If you're working with clients who aren't part of the group practice, we recommend using a separate personal account to ensure client confidentiality.

Do you use my data for AI training purposes?

No. We do not use your session data to train AI models.

Our platform is HIPAA, PHIPA, PHIA, PIPEDA, and SOC 2 Type II compliant and built to the highest security standards, so your data is always protected, private, and only accessible to you, or to your practice owner if your practice manages your seat (saved notes only).

We also do not sell or share your session data with others. You have full control over what you store in Mentalyc, and you can delete it at any time.

What does Mentalyc do with my session recordings?

Mentalyc temporarily uses your session recording to create a transcript. The audio is deleted once your note is ready.

The transcript we create is fully anonymized: it never includes names or personal details. Anonymizing means removing identifying details from transcripts to keep sessions private. We don’t require identifiable client data to generate notes, and we store only the minimum necessary information to provide value to clinicians, nothing more.

For those who prefer a balance, we also offer partial anonymization: we keep limited details like first names while removing sensitive identifiers. This is especially helpful for therapists who need clearer context, like in family sessions, without compromising security.

Everything is handled with care and stays fully HIPAA- and SOC 2 Type II-compliant.

Are session transcripts created in Mentalyc considered medical records?

In Mentalyc, session transcripts are fully anonymized, they don’t include names or any information that could identify a specific client or therapist. Because of this, they are not considered medical records. However, if you choose to keep transcripts linked to a client's name in your own records, those could be treated as part of their medical file, depending on your local regulations.

Is Mentalyc PHIPA-compliant and compliant with Canada's other privacy laws (PIPEDA, PIPA, PHIA)?

Yes. Mentalyc is a PHIPA-compliant platform for therapists documenting therapy sessions in Ontario and across Canada, and it is fully compliant with Canada's other data protection regulations: PIPEDA, PIPA, and PHIA. It adheres to the highest standards of confidentiality and privacy to keep your data and your clients' data safe.

Canadian therapists can generate PHIPA-aligned consent forms (an informed consent template) and their BAA inside their account.

Is Mentalyc compliant with New Zealand's Privacy Act?

Yes, Mentalyc complies with New Zealand’s Privacy Act. You have the right to access, correct, and control your personal information, including opting out of marketing. For full details, check out our Privacy Policy

Can my clients access the notes on Mentalyc?

No, your clients do not have direct access to your notes in Mentalyc. If you choose to share notes, you can do so by downloading them and sending them via email or printing them out. Your notes are private, secure, and accessible only by you or someone you’ve specifically authorized. If your practice manages your seat, the practice owner can also see your saved notes.

Could Mentalyc notes be requested in court?

Whether Mentalyc notes may be requested in court depends on how you use the app. If you create progress notes with client info, they can become part of the medical record and might be disclosed. But if you use the app just for reference or education without including client details, it’s unlikely these notes will be requested.

Keep in mind, courts can request information if needed, though this is extremely rare. To reduce the chance of your notes being requested, you can delete transcripts after recording, carefully review and finalize your notes, and sign them, so no extra data stays in the app.
View all FAQs →