Enterprise-Grade Security & Compliance
Your patient data deserves the highest level of protection. We've built PsychReport.ai with security and compliance at its core, meeting the strictest healthcare industry standards.
HIPAA Compliance
Full HIPAA compliance with a self-service Business Associate Agreement (BAA) available to all healthcare providers.
- Comprehensive HIPAA risk assessment
- Self-service BAA execution during onboarding
- Administrative, physical, and technical safeguards
- Regular compliance audits and monitoring
- Staff training and documentation
End-to-End Encryption
All data is encrypted both in transit and at rest using industry-standard AES-256 encryption.
- TLS 1.3 for data in transit
- AES-256 encryption for data at rest
- Encrypted database storage
- Secure key management system
Audit Logs
Comprehensive audit trails track all user actions and system events for complete transparency.
- User activity logging
- Data access tracking
- System event monitoring
- Compliance reporting tools
Access Controls
Secure access controls ensure only authorized personnel can access sensitive information.
- Multi-factor authentication (MFA)
- Secure session management
- User activity monitoring
- Access timeout controls
User Management
Secure user management features designed for individual practitioners (team features coming soon).
- Individual user accounts
- Secure authentication
- Assessment history tracking
- Data ownership controls
Data Backup & Recovery
Automated backups and disaster recovery ensure your data is always protected and available.
- Automated daily backups
- Fully redundant backups
- Point-in-time recovery
- Disaster recovery testing
Zero Data Retention AI Processing
Client data sent for AI processing is used only to generate your report. It is never retained by the AI provider and never used for model training; our AI providers operate under zero data retention agreements. Your data at rest stays encrypted (AES-256) in hosting facilities that maintain SOC 2 Type II certification, and the self-service BAA included on every plan keeps the entire workflow under BAA coverage.
Certifications & Compliance
SOC 2 Type II
Our platform is hosted in SOC 2 Type II certified facilities maintained by our cloud infrastructure providers
HIPAA Compliant
Full compliance with Health Insurance Portability and Accountability Act requirements
Google Cloud Security
Built on Google Cloud Platform with enterprise-grade security infrastructure
ISO 27001
Our hosting partners maintain ISO 27001 certification for information security
Our Privacy Commitment
We never sell, share, or monetize your patient data. Your information is used solely to provide our services and remains under your complete control at all times.
Security Questions
Your data protection concerns answered
Is PsychReport.ai HIPAA compliant?
Is my patient data safe with PsychReport.ai?
Is PsychReport.ai FERPA compliant for school use?
FERPA Compliance for School Districts
For school districts, student data privacy isn't just a rule. It's a fundamental trust. PsychReport.ai was built with a privacy-first design, ensuring full compliance with FERPA from the ground up.
We Act as Your "School Official"
FERPA's School Official exception allows us to handle student data on your behalf. We are contractually bound to:
- Perform only the institutional service we were hired for
- Operate under the direct control of your school for all data
- Use data only for the specific purpose agreed upon
- Never re-disclose or use data for any other purpose
Our Data Commitments
No Secondary Use
Student data is never used for AI model training, marketing, or any purpose beyond generating your reports.
Parent Rights Supported
Your staff retains full access to download and amend student records at any time to fulfill FERPA parental access requests.
Secure Data Destruction
All student data is permanently deleted from live systems 30 days after contract end and purged from backups on a fixed schedule.
School pricing available: PsychReport.ai serves both private practice and school settings. Contact us for school and district pricing.
Privacy Compliance for Canadian Practitioners
Canadian psychologists are the custodians of their clients' information under PIPEDA and provincial health-privacy law. PsychReport.ai is built to support those obligations while keeping your clinical judgment where it belongs: with you.
You Stay the Custodian. We're Your Service Provider.
- Under PIPEDA and provincial health-privacy law (including Ontario's PHIPA, Alberta's HIA, and British Columbia's PIPA), you remain the custodian of your clients' information.
- We act only as your service provider and information manager, processing data on your instructions to generate your reports.
- We sign a Canadian Data Processing Agreement during onboarding, the same way US practices sign a BAA.
- We support your obligations to respond to client access and correction requests and to handle breach notification.
Our Data Commitments
Transparent Cross-Border Processing
Your data is stored and processed in the United States on Google Cloud. We tell you plainly, so you can inform your clients and obtain the consent your obligations require.
A Signed Canadian Agreement
Every Canadian practice signs a Canadian Data Processing and Service Provider Agreement that sets out our role under PIPEDA and provincial health-privacy law, our security commitments, and how we support you.
De-identified Before AI
Client information is de-identified before any AI processing, and our agreements with AI providers prohibit using it to train their models.
Read our Canadian Privacy Supplement and Canadian Terms Supplement for the full detail.