For providers
The questions clinicians actually ask.
Including the ones with answers you may not want.
Will I be notified when a patient logs something?
No, and there is no setting that changes it. Nobody is watching — not us, not you, not an on-call service. You see what was logged when you open the app, usually when preparing for a session.
This is deliberate. An app that implied someone was watching, and then wasn’t, would be worse than one that never implied it. When you introduce Bronwin to a patient, say this part out loud.
What am I attesting to when I connect someone?
Two things: that the person is your current patient, and that they are 18 or older. The gate is on you because you’re the one who knows. We have no way to verify either, and no way to check afterward.
It’s also what makes a misdirected invite link harmless — a stranger’s name in front of a clinician who knows their own caseload goes nowhere.
Is this my clinical record?
No, and don’t let it become one. Transcribe what’s clinically relevant into your own system. Export a date range to PDF, legend included, if you want the raw log in the chart.
What if my patient loses their phone?
Reconnect them the same way as the first time. Their history restores from your copy, and a new verification number appears for the two of you to check.
What if I lose mine?
You restore from a recovery phrase you wrote down at signup, or from a second enrolled device. Set one of those up before you connect your first patient.
If you lose your only device with no recovery phrase, every patient history goes with it and we cannot help you. That is the same property that makes the rest of this page true — we hold no key, so there is nothing for us to restore from.
Can I see patterns across my whole caseload?
No. Every connection is its own encrypted world with its own keys, and there is no aggregate view. This is a structural property, not a feature we haven’t built yet — building it would require a key we deliberately don’t have.
Is this HIPAA compliant?
We are a Business Associate and we sign a BAA with every provider on every plan, including free. Encryption doesn’t remove that obligation — HHS addressed this exact fact pattern in its 2016 cloud computing guidance, and a service that stores encrypted PHI without the key is still a Business Associate. Anyone claiming otherwise is selling you something.
What encryption changes is what a breach means. Content encrypted under keys we have never possessed is a much weaker thing to lose, and that is the honest version of the security argument.
Can a patient stop?
Any time, without asking you. Disconnecting stops new data from being shared. You keep what you already have, the same as any notes you’ve taken — the app says this plainly rather than implying that disconnecting erases your copy.
Is the app open source?
The client is, with reproducible builds, and that’s a requirement rather than a gesture. Every promise on this page is a claim about what the app does on a phone. If the client were a closed binary, your only option would be to trust us — which is exactly the trust this architecture claims to make unnecessary.
Reproducible builds close the rest of the gap: they let anyone confirm that the binary in the App Store was built from the published source.