Klarify is built for therapists who handle some of the most sensitive information in healthcare. We take that responsibility seriously. This page explains how we protect your data and your clients' data.

All of your data is stored in Canada on Amazon Web Services (AWS) servers in Montreal. AWS is the same cloud provider used by Canadian banks and government agencies. Your notes, transcripts, session information, mindmaps, and client data are all stored on Canadian soil.

Klarify is compliant with the following privacy and security frameworks:

PIPEDA (Personal Information Protection and Electronic Documents Act), the federal Canadian privacy law governing personal information.

PHIPA (Personal Health Information Protection Act), Ontario's health privacy law.

Quebec Law 25 (Act Respecting the Protection of Personal Information in the Private Sector), Quebec's updated privacy legislation.

Alberta HIA (Health Information Act), Alberta's health information privacy law.

BC PIPA (Personal Information Protection Act), British Columbia's private sector privacy law.

Saskatchewan HIPA (Health Information Protection Act), Saskatchewan's health information privacy law.

Manitoba PHIA (Personal Health Information Act), Manitoba's health information privacy law.

Klarify also complies with applicable provincial health privacy legislation across all other Canadian provinces and territories.

HIPAA (Health Insurance Portability and Accountability Act), the US health information privacy standard. We operate under Business Associate Agreements (BAAs) with our sub-processors. If you would like a BAA with us, please email privacy@klarify.ca.

UK GDPR (United Kingdom General Data Protection Regulation), the UK's data protection law governing the processing of personal data. Klarify processes health data in accordance with UK GDPR requirements, including lawful basis for processing, data subject rights, and cross-border transfer safeguards.

For users who select European processing, AI and transcription requests are handled in Europe (the EU or UK), reducing cross-border data transfers.

We use a compliance platform for continuous security monitoring and evidence collection, and we conduct regular security audits and penetration testing by independent teams.

Here is how long different types of data are kept:

Audio recordings: Automatically deleted 14 days after the recording date, or sooner if your auto-delete settings remove them first. While the audio is still available, you can turn on audio playback under Settings → Sessions to listen to it, download it, or delete it from the session's Transcript view. See Listen to, download, or delete a session recording. Audio is not included in database backups.

Notes, transcripts, session data, mindmaps, and reflection questions: Kept until you delete them, close your account, or your clinic's auto-delete setting removes them.

Automatic deletion: You can set a timer that deletes audio, audio and transcripts, or entire session records for you, from right after processing up to 6 months after the session. Go to Settings → Clinic → Automatically delete session data. See Automatically delete session data.

Database backups: We maintain 7-day encrypted backups for disaster recovery. These are stored in Canada and follow the same security protocols as our main storage. Deleted data may persist in backups for up to 7 days before being permanently purged.

System logs: Retained for a short period for security and troubleshooting. These do not contain health information.

When you delete data through the app, it is removed from our database immediately. If you delete your entire account, all associated data is deleted following the above timelines.

By default, your data is processed in North America. You can change your processing region to Europe in your account settings.

Audio transcription: When you record a session, the audio is temporarily sent to our transcription provider for processing. By default, this happens in the United States. If you choose European processing in your settings, it happens in the EU instead. Live dictation (the microphone button) is always processed in the United States. The audio is deleted from the provider's servers once transcription is complete. Our transcription providers do not store or retain any of your data, and this is enforced through our Business Associate Agreements.

AI processing: Klarify uses AI to generate clinical notes, mindmaps, reflection questions, session summaries, and to power the AI assistant. These features use Anthropic's AI models, run through AWS Bedrock. By default, processing may happen in Canada or the United States. If you choose European processing in your settings, it happens in the EU or UK instead. This is temporary processing only, meaning no data is stored or kept outside of Canada. AWS has no right to access, retain, or use your data for any purpose beyond running the AI request.

We do not use your data to train any AI models. This applies to Klarify and to every service provider we work with. Our providers are contractually prohibited from using your data to train or improve their models, or for any purpose other than providing their service to Klarify.

Improving Klarify: Starting November 1, 2026, Klarify may use de-identified, aggregated information to improve the product, such as which features get used most or common themes across many practices. This information cannot identify you or your clients. It is never sold, and never used to train AI.

Which AI models we use: Klarify's AI features run on models made by Anthropic. We access them through AWS Bedrock, so your requests are handled by AWS, not sent to Anthropic's own servers.

When you use Klarify's AI features, your data is sent to the AI model, a response is generated, and then the data is not retained by the model provider. The AI does not learn from or remember your sessions.

We work with a small number of trusted service providers. Each one has a specific role and is bound by strict data protection agreements. You can see the current list at klarify.ca/legal/subprocessors.

We use multiple layers of security to keep your information safe:

Encryption in transit: All data moving between your device and our servers is encrypted using TLS 1.2 or higher, with TLS 1.3 where supported.

Encryption at rest: All stored data is encrypted using AES-256, the same standard used by banks and government agencies.

Access controls: We use multi-factor authentication, role-based access, and least-privilege principles. On a solo account, only you can access your session data. On a clinic account, access follows the role each member is given, and session audio can only be played by the therapist who owns the session.

Key management: Encryption keys are managed through AWS Key Management Service (KMS).

Security monitoring: We use real-time monitoring and alerting to detect and respond to any unusual activity.

Employee controls: All employees with access to systems undergo background checks, sign confidentiality agreements, and complete regular security and privacy training.

As the therapist, you have full control over your data:

What goes into notes: You can create fully anonymous notes or include basic identifying information where it is clinically needed.

What clients see: You choose whether to share notes, summaries, or mindmaps with clients through the client portal.

When data is deleted: You can delete individual sessions, individual clients, or your entire account at any time. Deletions from the app are processed immediately. You can also set a timer to delete session data automatically under Settings → Clinic.

Data export: You can download your data for one client, one group, or your whole clinic at any time as a ZIP of text files. Individual notes and transcripts also download as PDF, Word (.docx), or plain text files.

Cookies: Optional cookies power analytics and the support chat. Change your choice at any time under Settings → General → Cookie consent. The support chat on the Get Help page opens only when cookies are accepted. Email support does not need cookies.

Data correction: You can edit your notes and session information directly in the platform at any time.

Withdraw consent: You or your clients can withdraw consent for Klarify's use at any time without affecting the therapeutic relationship.

To record a virtual session, Klarify asks you to share a tab or screen. That is how we hear your client's voice.

We only take the audio. No video, screenshot, or image of your screen is sent to Klarify or stored anywhere. If another client's file is open behind your video call, none of it is captured.

We provide a customizable consent form template that you can use with your clients. The template is available in English and French and covers:

The template is designed to be comprehensive so you can pick the parts that work for your practice. Many therapists use a shorter version, and that is completely fine.

You can see the template here.

If you have questions about our security or privacy practices, reach us at privacy@klarify.ca.

For our full privacy policy, visit klarify.ca/legal/privacy-policy.