Privacy and security
What the software is for
Report Copilot is documentation and administration software for licensed clinicians in private practice in the United States: licensed clinical social workers (LCSW), licensed professional counselors and licensed mental health counselors (LPC, LMHC), licensed marriage and family therapists (LMFT) and psychologists.
Drafted from your own notes: treatment plans, plan reviews, continued-care letters and record-request packs. It prepares text drafts from the notes, scores and entries you record. Every sentence is sourced to your documentation, and you review, edit, approve and sign every document before export.
It does not identify or name conditions, recommend treatment, decide medical necessity, assess risk or predict what a health plan will do. It gives no alerts. It is not for emergencies. ICD-10-CM and CPT codes appear only as fields the clinician types. You review, edit, approve and sign every document.
We do not claim HIPAA compliance. The pilot takes no protected health information, so no Business Associate Agreement is needed. Before we accept real client data we will offer one.
Where data is processed
During the free pilot, content is stored and processed in Germany, on servers of Hetzner Online GmbH. The pilot takes no protected health information. Model drafting runs within the European Union, and we do not use your notes to train or evaluate models. Dictation is switched off for US accounts during the pilot.
Paid use with real client data will come later, in a US region, under a Business Associate Agreement. Prices are not published yet and billing is off.
The provider is a natural person established in Türkiye. For that reason the pilot accepts de-identified or fictional cases only. We follow the HIPAA Safe Harbor list: all 18 identifiers are removed.
How data is protected
- Case content is encrypted in the application with a key per practice.
- Client identity is masked on your device before text leaves it. The server refuses recognizable identifiers: names by title or label, Social Security numbers, phone numbers, e-mail addresses, and dates other than the year in free text. In cases based on real clients, date fields hold invented dates and no ZIP code is entered.
- Access is limited by role and written to an access log.
- License numbers are visible to the treating clinician only.
- No session audio is recorded, transmitted or stored.
- Every sentence of a draft links to its source. A sentence without a source cannot be exported.
- The completeness check lists what is missing or does not match in your notes: dates, times, code and duration match, signature, plan in force, goal reference. It never says what to write.
- Documents are signed off by the clinician before export.
- We hold no security certification of our own at present. Our hosting provider holds its own certificates.
Sub-processors
We use service providers in these categories.
- Hosting and backup: Hetzner Online GmbH, Germany, during the pilot.
- Language-model drafting: a provider in the European Union, under terms that exclude training on our requests. Only masked text is sent.
- Transactional e-mail: Resend, Inc., USA, for confirmation and account e-mail only. No case content is e-mailed.
- Error monitoring: Sentry, EU data region, with content removed before sending.