How we protect your information

Each of these is a concrete practice, not a promise of intent. You are welcome to ask us to confirm any of them before your first session.

• ✓Your records are kept in a secure clinical portal built to HIPAA-ready and GDPR-aligned standards — not in email, spreadsheets, or messaging apps
• ✓Records are encrypted both in transit and at rest
• ✓Our clinic's records sit in their own separate database, not in shared tables alongside other practices
• ✓Sessions are never recorded and never transcribed — the portal has no recording capability at all
• ✓No identifying information about you is ever sent to any AI system
• ✓Every time your record is opened, it is written to an audit trail
• ✓Access is by named clinician account with role-based limits — there is no shared clinic login
• ✓Intake information goes into the clinical portal, not a public form tool
• ✓Video sessions run on an encrypted platform used only for clinical sessions
• ✓Your information is never sold, shared with advertisers, or used for marketing

Sensitive clinical information tends to leak not through dramatic breaches but through ordinary convenience — a note left in an inbox, an intake answer sitting in a general form tool, a file that everyone at a practice can open because there is only one login. The protection is not a single product; it is the habit of keeping clinical information inside clinical systems.

For clients in a small community, or in a diaspora network where people know each other, this is often the difference between speaking honestly and holding something back. That is why we treat it as part of the care rather than as paperwork.

Whether or not you choose us, these are reasonable questions to ask before you share your history with anyone. A practice that handles information carefully will be able to answer them specifically.

• ✓Where are my records stored, and who else can open them?
• ✓Is my intake form going into a clinical system, or into a general form tool?
• ✓Is the video platform used for clinical sessions specifically?
• ✓Are sessions recorded or transcribed? If so, where is that kept, and for how long?
• ✓Is any part of my information sent to an AI tool for note-writing?
• ✓Is there a record of who opened my file and when?
• ✓What exactly would make you break confidentiality?
• ✓If I stop therapy, what happens to my file?

Being clear about the edges matters as much as the claims themselves:

• The Sunila chat on this website is an educational guide, not a therapy session — please do not enter sensitive personal details there
• WhatsApp and phone are used for scheduling and brief coordination, not for clinical content
• Email is not a confidential channel — we use it for administration only
• Third-party booking and review platforms are governed by their own privacy policies

No authority certifies a clinic or a piece of software as “HIPAA compliant” — compliance is a property of how a whole practice operates, not a badge anyone hands out. So rather than display logos, we describe the safeguards themselves, in each framework’s terms, for you to hold us to.

Our clinical portal is built to HIPAA-ready and GDPR-aligned standards: encryption in transit and at rest, a separate database per practice, an audit trail on every access to a record, and role-based limits on who can open what. We are a Nepal-based practice working under Nepali professional standards and APA-aligned ethics — HIPAA and GDPR are laws of other jurisdictions, and we do not claim to be certified under them.

For clients abroad weighing us against a locally regulated provider, see therapy for international clients for the cross-border limits.

How are my therapy records stored?

In a secure clinical portal built to HIPAA-ready and GDPR-aligned standards, encrypted in transit and at rest. Your file is not kept in email, in a spreadsheet, or in a messaging app. Our practice's records sit in their own separate database rather than shared tables, access is by named clinician account, and every time a record is opened it is written to an audit trail.

Is online therapy actually private?

It depends entirely on what the practice uses. Our video sessions run on an encrypted platform used only for clinical sessions, sessions are never recorded or transcribed, and notes go into an encrypted clinical portal with an audit trail. If you are comparing practices, ask each one where records are stored, whether sessions are recorded, and whether there is a log of who opened your file.

Are therapy sessions recorded or transcribed?

No. Sessions are never recorded and never transcribed — audio or video. This is not only a policy: the clinical portal we use has no recording capability built into it at all. Your clinician writes notes, which are stored in the encrypted portal.

Does my information go into any AI system?

No identifying information about you is ever sent to any AI system. Session notes are written by your clinician. The Sunila chat on this website is a separate educational guide — it is not connected to clinical records, and it should not be used to share sensitive personal details.

Are you HIPAA compliant?

No authority certifies a clinic or software as HIPAA compliant — compliance is a property of how a practice operates, not a badge. Our clinical portal is built to HIPAA-ready and GDPR-aligned standards, and we are a Nepal-based practice under Nepali professional standards and APA-aligned ethics, so we do not claim certification under foreign law. What we can tell you is the specifics: encryption in transit and at rest, a separate database, an audit trail on every access, no recordings, and no identifying information sent to AI.

Who can see my file inside the clinic?

Your treating clinician. Access is controlled by named accounts with role-based limits rather than a shared inbox or a common login, so your history is not visible to everyone who works at the practice. Every access is logged.

When would you break confidentiality?

Where there is serious risk of harm to you or another person, where disclosure is required by Nepali law or a valid legal order, or for care coordination you have specifically consented to. Your clinician explains these limits before ongoing work begins, not after.

What happens to my records if I stop therapy?

Your file remains in the encrypted clinical portal under the same access controls — it is not deleted automatically, because clinical records may need to be retained, and it is not repurposed for marketing. You can ask us what is held about you and raise questions at any time.

You may ask what we hold about you, request correction where appropriate, or ask how any part of this works. Contact bhattapsychotherapy@gmail.com or use the contact page. For the formal policy covering the website, cookies, and third-party services, see the privacy policy.