TheraBee Privacy Policy

Effective Date: 10/23/2026
Last Updated: 10/23/2026

Introduction

Welcome to TheraBee, a service provided by TheraBee, LLC (“TheraBee,” “we,” “us,” or “our”).

TheraBee provides AI-powered clinical documentation and support tools designed to help mental health professionals reduce administrative work, improve clinical workflows, and focus more of their time on client care.

We recognize the uniquely sensitive nature of mental health information and are committed to protecting the privacy and security of our users and their clients.

This Privacy Policy explains how we collect, use, process, disclose, retain, and protect information when you access our website at www.therabee.ai, use our applications, or interact with our related products and services (collectively, the “Services”).

Our approach is guided by four principles:

  • Privacy by design: We incorporate privacy and security safeguards into how our Services operate.
  • Data minimization: Session audio is temporarily processed and deleted following successful processing, while retained transcripts undergo a multi-stage process designed to remove identifying information.
  • User control: Users determine how long their clinical content remains available in TheraBee, subject to applicable legal and operational requirements.
  • Responsible AI: Clinical information is processed to support the therapist's work—not to train AI models or build datasets for unrelated purposes.

By using our Services, you acknowledge the data practices described in this Privacy Policy.

1. Intended Users

TheraBee is intended for mental health professionals and other authorized users who are at least 18 years old.

Our Services are not intended for direct use by minors, and we do not knowingly permit individuals under 18 to register for accounts.

Authorized healthcare professionals may, however, use TheraBee to process clinical information relating to clients of any age, including minors, subject to applicable privacy, consent, and professional requirements.

2. Information We Collect and Process

The information we collect depends on how you interact with TheraBee.

2.1 Account and Profile Information

When you create or maintain an account, we may collect:

  • Name and email address
  • Telephone number
  • State of residence or practice
  • Professional and account-related information
  • Account preferences and settings
  • Login credentials and authentication information

This information is used to establish and maintain your account, provide customer support, communicate important updates, manage billing, and administer our Services.

2.2 Payment and Billing Information

TheraBee uses Stripe, a third-party payment processor, to securely manage payment information and transactions.

Payment credentials, including full credit card numbers and card verification codes (CVV), are collected and managed through Stripe's payment infrastructure. TheraBee does not store full payment card numbers or CVV information within its application databases.

We may retain limited billing-related information, including Stripe customer identifiers, transaction references, subscription status, and usage or billing records necessary to operate our Services.

Stripe's handling of payment information is governed by its privacy practices, available at stripe.com/privacy.

2.3 Clinical and Session Information

When using TheraBee's clinical documentation and AI-assisted features, users may submit or generate information including:

  • Audio recordings of therapy sessions
  • Transcripts generated from session audio
  • Clinical notes, summaries, and documentation
  • Client history, treatment context, and related clinical information
  • Information supplied before or after sessions to clarify or supplement documentation
  • Questions, prompts, and other information submitted through Ask Bea or related AI-assisted features

This information may contain protected health information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”) or other sensitive personal information.

TheraBee processes clinical information to provide requested Services, including transcription, clinical documentation, contextual analysis, treatment planning assistance, and other AI-supported functions.

2.4 Technical and Usage Information

We may automatically collect limited technical information necessary to operate, secure, and maintain our Services, including:

  • IP address
  • Browser and device information
  • Operating system and application version
  • Authentication and session identifiers
  • Service usage and performance information
  • Error reports and operational logs

Our operational logs are designed to minimize the inclusion of PHI and personally identifiable information and generally rely on internal identifiers where possible.

2.5 Website Cookies and Similar Technologies

Our website may use cookies and similar technologies to maintain functionality, remember preferences, analyze website performance, and improve the user experience.

Additional information is provided in Section 9.

3. How TheraBee Processes Session Audio and Clinical Information

TheraBee uses a privacy-focused processing workflow designed to minimize the persistent storage of identifiable clinical information.

3.1 Audio Recording and Transcription

When a user records a session through TheraBee, session audio is securely transmitted to our processing infrastructure using encryption.

Audio is temporarily processed by TheraBee and authorized service providers to generate a transcript and requested clinical documentation.

Because original session audio may contain PHI, identifiable information may be processed during this stage before redaction occurs.

TheraBee does not maintain a permanent library of session audio recordings.

Following successful transcription and processing, original audio files and associated temporary audio copies are deleted from TheraBee's application upload storage.

If processing is interrupted or unsuccessful, temporary files may remain available for retry or recovery until processing succeeds or the files are otherwise deleted under applicable system procedures.

3.2 Multi-Stage Identification and Redaction

After transcription, TheraBee uses a multi-stage process designed to identify and remove PHI and other personally identifiable information before clinical content is stored.

This process includes:

  1. Identification: AI-assisted analysis identifies potential personal identifiers, including names, dates, and other identifying information.
  2. Redaction: Identified information is removed or modified through an additional processing step.
  3. Clinical Documentation: The resulting redacted content is used to generate clinical notes and summaries.

TheraBee retains the redacted transcript, rather than the original unredacted transcript, to support clinical documentation and contextual AI features such as Ask Bea.

Original, unredacted transcripts are not intentionally maintained as permanent clinical records within TheraBee's application.

Because automated identification and redaction are not infallible, we cannot guarantee that every possible identifier will be detected or removed. Retained clinical content may therefore still contain PHI or other sensitive information.

3.3 Clinical Context and Ask Bea

TheraBee allows users to provide additional clinical context before or after a session, retain generated clinical documentation, and use AI-assisted features such as Ask Bea.

Ask Bea can use retained redacted transcripts, clinical notes, session history, user-provided prompts, and other relevant information available within the user's account to generate requested outputs.

These outputs may include:

  • Preparation for upcoming sessions
  • Identification of themes or patterns across previous sessions
  • Treatment planning assistance
  • Clinical documentation and correspondence
  • Feedback on therapeutic interactions and professional practice
  • Other AI-assisted clinical support requested by the user

Clinical context is retained to support the user's own clinical work—not to train AI models or develop independent clinical datasets.

Users may delete stored clinical information at any time. Removing this information may limit Ask Bea's ability to reference previous sessions, identify longitudinal patterns, or provide contextually informed assistance.

3.4 AI-Assisted Clinical Support and Professional Responsibility

TheraBee's AI-powered features, including Ask Bea, are intended to assist qualified healthcare professionals with documentation, clinical organization, professional reflection, and decision support.

TheraBee is not a healthcare provider, does not practice medicine or psychotherapy, and does not independently provide diagnosis, treatment, or clinical care.

AI-generated notes, summaries, suggestions, feedback, and other outputs are informational and supportive in nature. They may contain errors, omissions, inaccuracies, or interpretations that are incomplete or inappropriate for a particular clinical situation.

TheraBee does not independently determine diagnoses, prescribe treatment, establish patient eligibility for care, or make autonomous clinical decisions on behalf of healthcare professionals.

Users remain responsible for exercising independent professional judgment, evaluating AI-generated outputs, verifying documentation accuracy, obtaining appropriate consent, and making all clinical decisions regarding their clients.

TheraBee is designed to support professional judgment—not replace it.

4. How We Use Information

TheraBee uses information for the following purposes:

  • Providing clinical transcription, documentation, and AI-assisted features requested by users.
  • Maintaining accounts, preferences, and application functionality.
  • Processing payments and administering subscriptions or usage-based billing.
  • Responding to support requests and communicating service-related information.
  • Monitoring system performance, troubleshooting technical issues, and maintaining security.
  • Improving application functionality through non-clinical operational information, technical performance data, and appropriate user feedback.
  • Detecting misuse, preventing fraud, and protecting the integrity of our Services.
  • Complying with applicable laws, contractual requirements, and regulatory obligations.
  • Communicating product updates, educational resources, and relevant promotional information, subject to applicable law and user preferences.

4.1 No AI Training or Secondary Use of Clinical Content

TheraBee does not use therapy session recordings, transcripts, clinical notes, client information, or other user-submitted clinical content to train or fine-tune AI models.

We also do not repurpose retained clinical content to develop independent datasets for research, advertising, or internal product improvement.

Clinical information is processed and retained solely to provide the documentation, contextual AI assistance, and related functionality requested by users, or as otherwise required by applicable law.

We may use non-clinical operational information, aggregated usage statistics that do not disclose clinical content, technical performance data, and voluntarily provided product feedback to maintain and improve our Services.

TheraBee does not authorize its AI service providers to use clinical content for AI model training, advertising, or unrelated product improvement. We require our providers to comply with applicable contractual restrictions governing the confidentiality, security, and permitted use of information processed on our behalf.

5. HIPAA and Protected Health Information

TheraBee is designed to support healthcare professionals in handling sensitive clinical information.

Where TheraBee creates, receives, maintains, or transmits PHI on behalf of a HIPAA-covered healthcare provider or other covered entity, TheraBee acts in the capacity of a business associate as applicable under HIPAA.

In those circumstances, TheraBee's handling of PHI is governed by applicable law and the relevant Business Associate Agreement (“BAA”).

5.1 Healthcare Provider Responsibilities

Healthcare providers and organizations using TheraBee remain responsible for determining the purposes of clinical information processing and for complying with their own legal, regulatory, and professional obligations.

These responsibilities may include:

  • Obtaining any required patient consent or authorization.
  • Maintaining appropriate clinical records.
  • Reviewing and verifying AI-generated documentation.
  • Making all diagnoses, treatment decisions, and other clinical judgments.
  • Responding to patient requests involving medical records and applicable privacy rights.
  • Complying with applicable federal and state healthcare privacy laws.

TheraBee processes clinical information on behalf of its healthcare provider customers to deliver the Services they request.

5.2 TheraBee's Safeguards

TheraBee employs administrative, technical, and organizational safeguards intended to protect PHI, including encryption, access controls, secure processing practices, and measures designed to minimize unnecessary retention of identifiable information.

Our multi-stage redaction process provides an additional privacy safeguard but does not eliminate the possibility that PHI may be processed or retained.

Where an applicable BAA governs PHI, its terms control to the extent of any conflict with this Privacy Policy.

6. How We Share Information

TheraBee does not sell personal information or clinical content.

We disclose information only as reasonably necessary for the purposes described below, subject to applicable law and contractual restrictions.

6.1 Authorized Service Providers and AI Subprocessors

TheraBee works with third-party service providers to support the operation of our Services, including AI processing, cloud infrastructure, payment processing, authentication, security, and technical support.

Enhanced AI, through its FluxPrompt platform, supports TheraBee's AI processing infrastructure, including transcription, clinical documentation, and other AI-assisted functionality.

Enhanced AI operates as an AI orchestration platform, transmitting information necessary to fulfill user requests to authorized underlying AI providers. Depending on the requested functionality, this information may include session audio, transcripts, clinical context, and other user-submitted content.

These providers may process identifiable clinical information during initial transcription or other processing before TheraBee's redaction workflow is completed.

Enhanced AI maintains SOC 2 certification and has entered into a Business Associate Agreement with TheraBee governing its handling of protected health information.

TheraBee requires its service providers to maintain appropriate privacy, security, and confidentiality safeguards, including applicable subcontractor agreements where required by HIPAA.

TheraBee does not authorize service providers to use clinical content for AI model training, advertising, or unrelated product improvement.

We seek to limit the information shared with service providers to what is reasonably necessary to deliver the requested functionality.

TheraBee may update its service providers as technology and operational needs evolve while maintaining applicable privacy and security obligations.

We may disclose information when reasonably necessary to comply with applicable law, valid legal process, regulatory requirements, or enforceable governmental requests.

Where permitted, we seek to limit disclosures to information reasonably necessary to satisfy the applicable obligation.

6.3 Business Transactions

If TheraBee is involved in a merger, acquisition, restructuring, financing, or sale of assets, information may be disclosed or transferred as reasonably necessary in connection with that transaction, subject to applicable confidentiality, privacy, and legal requirements.

6.4 Protection of Rights and Security

We may disclose limited information when reasonably necessary to investigate fraud, address security incidents, enforce applicable agreements, or protect the rights, property, and safety of TheraBee, our users, or others.

Any disclosure of PHI remains subject to applicable HIPAA requirements and contractual restrictions.

7. Data Security

TheraBee employs technical and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, or destruction.

These safeguards include:

Encryption in Transit: Communications between TheraBee applications and our servers use secure transmission protocols, including HTTPS and Transport Layer Security (TLS).

Encryption at Rest: Stored application data is protected through encryption practices implemented by our hosting and database infrastructure.

Secure Audio Uploads: Where applicable, our desktop application uses additional encryption mechanisms to protect audio files during upload and processing.

Access Controls: Access to application systems and sensitive information is restricted according to operational responsibilities and authorized access requirements.

Operational Monitoring: We maintain technical logs and monitoring practices to support service reliability, security, and incident investigation while seeking to minimize the collection of sensitive clinical information.

Vendor Security and Compliance: We work with service providers that maintain appropriate security and privacy safeguards. Our AI infrastructure provider, Enhanced AI, maintains SOC 2 certification and operates under a Business Associate Agreement with TheraBee. These safeguards complement TheraBee's encryption, access controls, data minimization, and clinical-information redaction processes.

Security Response: We maintain procedures intended to identify, investigate, and respond to suspected security incidents.

No internet-based service or electronic storage system can guarantee absolute security. We continually evaluate our safeguards in light of evolving technologies, operational requirements, and applicable legal obligations.

8. Data Retention and Deletion

TheraBee is designed around a simple principle: your clinical information should remain under your control.

We minimize the retention of sensitive clinical information while allowing users to preserve the context needed for meaningful AI-assisted clinical support.

8.1 Session Audio — Deleted After Processing

Session audio is temporarily and securely processed to generate a transcript.

TheraBee does not maintain a library of session audio recordings. Following successful transcription and processing, original audio files and temporary audio copies are deleted from TheraBee's application upload storage.

If processing is interrupted or unsuccessful, temporary files may remain available for retry until processing is completed or the files are otherwise deleted under applicable system procedures.

8.2 Transcripts — Identifying Information Removed Before Storage

Following transcription, TheraBee uses a multi-stage process designed to identify and remove PHI and other personally identifiable information.

The resulting redacted transcript, rather than the original unredacted transcript, is retained within TheraBee to support clinical documentation and contextual AI features.

Because automated identification and redaction are not infallible, we cannot guarantee that every potential identifier will be removed.

8.3 Clinical Notes and Ask Bea — Retained for Your Benefit

TheraBee retains generated clinical notes and redacted transcript content so that users can access their documentation and benefit from the clinical context available through Ask Bea.

This retained context allows Bea to assist with tasks such as preparing for future sessions, identifying themes across prior encounters, supporting treatment planning, and providing feedback on clinical interactions.

This information is retained to support your clinical work—not to train AI models or create datasets for unrelated purposes.

Clinical content remains available in your account until you choose to delete it, close your account, or removal is otherwise required.

8.4 Deleting Notes and Clinical History

Users may delete individual clinical notes and sessions at any time.

When a session or note is deleted, TheraBee also removes the associated stored transcript record from its active application database. This means the deleted content is no longer available to Ask Bea as part of the client's clinical history.

Deleting clinical content also deletes the context Bea relies on. As a result, removing notes and transcripts may reduce Bea's ability to identify longitudinal patterns, reference previous sessions, provide personalized clinical feedback, or offer contextually informed assistance.

Users can therefore choose how much clinical history they wish to retain based on their individual privacy preferences and desired use of TheraBee's AI-assisted features.

8.5 Account Deletion and Residual Records

Users may initiate account deletion through available account settings or by contacting TheraBee support.

Account deletion initiates removal of associated application data, including stored sessions, clinical notes, and redacted transcripts.

Certain limited information, such as billing records, account information, operational logs, or temporary backup copies, may be retained where necessary to satisfy applicable legal, security, financial, or contractual obligations.

Any residual copies remain subject to applicable privacy and security protections and are not intended for routine clinical use.

9. Cookies and Website Analytics

TheraBee may use cookies and similar technologies on its public website and within its Services.

These technologies may help us:

  • Maintain essential website and application functionality.
  • Remember user preferences.
  • Understand general website usage and performance.
  • Identify technical issues and improve user experience.

We may use essential, functional, or analytics-related cookies depending on the technologies deployed.

Users can manage certain cookie preferences through their browser settings. Disabling essential cookies may affect website or application functionality.

We do not intentionally use clinical session content or PHI for third-party behavioral advertising.

10. Your Privacy Rights and Choices

Depending on your location and applicable law, you may have certain rights concerning your personal information.

These may include:

Access: Request information about personal data TheraBee maintains about you.

Correction: Request correction of inaccurate or incomplete personal information.

Deletion: Request deletion of personal information, subject to applicable legal and contractual exceptions.

Data Portability: Request a copy of eligible personal information in an available format, where required by applicable law.

Communication Preferences: Opt out of nonessential promotional communications.

Self-Service Controls

TheraBee provides users with tools to view, manage, and delete individual clinical sessions and associated content.

Users may also initiate account deletion through available account settings.

Privacy Requests

To submit a privacy-related request, contact:

support@therabee.ai

We may need to verify your identity before processing certain requests and will respond within the timeframes required by applicable law.

Where TheraBee processes PHI on behalf of a healthcare provider, requests involving patient records or HIPAA individual rights may need to be directed to the applicable healthcare provider or covered entity.

11. International Users

TheraBee is operated primarily for users in the United States.

Information processed through our Services may be transferred to, stored in, or processed in the United States or other locations where our authorized service providers operate.

Privacy and data protection laws may differ between jurisdictions.

Where applicable, TheraBee will handle international transfers in accordance with relevant legal requirements and contractual obligations.

Users outside the United States are responsible for determining whether use of the Services is appropriate under the laws and professional obligations applicable to them.

12. Third-Party Websites and Services

Our website or applications may contain links to third-party websites, payment processors, or other external services.

These third parties may maintain their own privacy policies and data-handling practices.

TheraBee is not responsible for the privacy practices of third-party services operating independently of TheraBee.

We encourage users to review applicable third-party privacy policies before submitting information to those services.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our Services, technology, business practices, or legal requirements.

When material changes occur, we may notify users through email, application notices, or an updated notice on our website.

The revised Policy will identify its effective date.

We encourage users to review this Policy periodically.

14. Contact Us

If you have questions, concerns, or requests relating to this Privacy Policy or TheraBee's data-handling practices, please contact:

TheraBee, LLC

Website: www.therabee.ai
Email: support@therabee.ai