Client records are the most sensitive information your practice holds. Here is exactly how PsychDesk stores, protects, and gives you control over it, stated specifically, not in vague reassurance language.
Startup IndiaDPIIT recognised
ISO 9001:2015Quality certified
HIPAA compliantHealthcare safeguards
GDPREU data protection
AES-256 encryptionIn transit & at restA specific answer to each of these builds more trust with a therapist evaluating this page than a single sentence claiming bank-level security ever will.
Every client record in PsychDesk is encrypted at rest in the database and in transit between your browser and our servers, in both directions, using AES-256 encryption. That means a record is unreadable whether someone is trying to read the stored database file or intercept the data as it moves across the network. We confirm this against our actual infrastructure rather than stating an encryption standard in the abstract.
Internal access to client records is tightly restricted. No PsychDesk team member reads a client's clinical record unless you explicitly ask us to, usually as part of a support request you have raised. When access is required to resolve an issue, it is scoped to that specific request, logged, and removed once the issue is closed. Client records are never accessed for analytics, marketing, or any purpose beyond providing and supporting the service.
Your data is backed up continuously, with encrypted snapshots taken at regular intervals and stored in a separate, redundant location. In the event of a hardware failure or data incident, we can restore your practice's records from the most recent snapshot, minimizing any disruption. Backups are encrypted with the same standard as live data, so a backup is no easier to read than the original record.
If you close your PsychDesk account, you can export your full client record set before closure. After closure, your data is deleted from our active systems within 30 days, and removed from encrypted backups within 90 days. We do not retain client records indefinitely after an account is closed, and we do not use your data for any purpose once the account is gone.
India's Digital Personal Data Protection Act, 2023, the DPDP Act, governs how any company processing personal data in India must handle it, including therapy client records stored in PsychDesk. Under the Act, PsychDesk is a data fiduciary, meaning the entity responsible for deciding how and why personal data is processed. This creates specific obligations: clear consent before processing, limiting use of data to the purpose it was collected for, reasonable security safeguards, and a defined process for handling a complaint about how data is used.
Under the DPDP Act, PsychDesk maintains a designated Grievance Officer as a specific, named point of contact a client or your practice can reach with a data-related complaint. You can contact the Grievance Officer at grievance@psychdesk.in for any issue concerning how personal data is handled on the platform.
The client data your practice enters is processed on the basis of the client's informed consent, captured through your practice's own intake process. PsychDesk provides the platform and the safeguards, but the consent itself belongs to the relationship between you and your client.
Therapy records are among the most sensitive categories of personal data. The DPDP Act requires safeguards appropriate to that sensitivity, which is why PsychDesk applies a higher security standard to client records than would apply to less sensitive personal information.
You remain responsible for obtaining your own clients' informed consent to store their data digitally. PsychDesk provides the platform and the safeguards, but your intake process is where that consent is actually captured. If a client raises a concern about how their data is handled, PsychDesk's Grievance Officer is the point of contact for issues related to the platform itself, while clinical and consent-related questions are between you and your client directly.
HIPAA, the Health Insurance Portability and Accountability Act, is a United States federal law governing protected health information within the US healthcare system. If your practice operates only in India, HIPAA does not directly apply to you, the DPDP Act is the relevant framework. If you see clients in the United States, or work with US-based referral partners or insurance processes, HIPAA may be directly relevant to your practice, independent of what platform you use.
PsychDesk maintains administrative, physical, and technical safeguards consistent with the HIPAA Security Rule, and offers a Business Associate Agreement (BAA) to practices that need one. A BAA covers the obligations a platform takes on when handling protected health information on a covered entity's behalf, including breach notification and safeguards. If your practice sees US-based clients, contact us and we will provide the BAA specific to your arrangement.
GDPR, the General Data Protection Regulation, is the European Union's data protection law. It applies if PsychDesk, or a practice using PsychDesk, processes personal data belonging to individuals located in the EU, regardless of where the practice itself is based. For most PsychDesk practices operating within India, GDPR is not directly applicable, though the DPDP Act shares some similar underlying principles: clear consent, purpose limitation, and reasonable security.
If you have clients located in the EU, or GDPR applies for another specific reason, PsychDesk provides a Data Processing Agreement, a defined process for data subject access requests, and an EU representative where required. We state these measures precisely rather than implying a certification that may not apply to your situation.
Independent of which software you use, our HIPAA compliance tool walks through the specific safeguards a mental health practice should have in place. It is a self-assessment checklist: you answer a series of questions about how your practice handles consent, storage, access, and breach response, and receive a clear summary of where your practice stands and what to strengthen next. It is not an automated scan of your systems, it is a guided checklist grounded in the safeguards a therapy practice actually needs.
Evaluate your practicePsychDesk does not sell client data.
PsychDesk does not use client records to train external AI models.
PsychDesk does not share client records with third parties for advertising.
PsychDesk does not access client records for any purpose beyond providing the service and required support.
Contact our Grievance Officer at grievance@psychdesk.in , as required under the DPDP Act.
Start your free trial today. No credit card required, set up your workspace in 10 minutes and see how PsychDesk simplifies your practice.
Want the detail first?
Read the product documentation