Privacy policy

Who this policy is from

Sessio is a macOS application for therapists, psychologists and coaches, operated by Igor Tomko, an individual based in Brazil, trading as Sessio. In this document “Sessio”, “we” and “us” mean him; “you” means the practitioner using the application.

Questions about this policy, or any request about your data, go to support@sessio.health. We answer from the same address.

Two kinds of data, two roles

Sessio holds data about two different groups of people, and our role differs for each.

• Your data — your account, your settings, your billing details and how you use the app. Here we decide what is collected and why; we are the controller.
• Your clients' data — the audio you record or upload, the transcript, the notes, the client names and any documents you add. You decide what to record and what to keep; you are the controller and Sessio processes it on your instruction.

Because your clients are not our users, we never contact them, never build profiles of them and never use their words for anything other than producing the transcript and the draft you asked for.

Conversations with your clients are confidential and can contain sensitive personal data, which laws such as Brazil's LGPD and the GDPR protect more strictly. We process this content only to run the features you use, never for marketing or profiling, and only through the providers listed below.

The client portrait in the app is your working record of a client, assembled from your own sessions and edited by you. Sessio does not score, rate or classify your clients, and takes no automated decisions about them.

What we receive

What we do with it — and what we don't

• Produce the transcript, the draft note and the client summary you asked for.
• Keep your workspace available across launches and devices, and let you search and export what is in it.
• Send you transactional email: sign-in links, account notices, and — only if you ask for them — release announcements.
• Investigate errors, keep the service running and prevent abuse.

We do not sell your data, do not share it with advertisers, and do not use recordings, transcripts or notes to train our own models. We choose providers whose terms restrict what they may do with content sent to them; those terms differ per provider and are listed in the table below.

AI output is a draft. Transcripts and generated notes can be wrong, can miss context and can attribute a sentence to the wrong speaker. You decide what to keep, and the final record is yours.

Who else processes it

Sessio is built on third-party infrastructure. The services below may receive data on our behalf. Which ones are involved depends on what you do: speech recognition only runs when you submit a recording, OCR only when you attach a document, meeting providers only when you connect them.

We update this table when the set of providers changes. If a change materially affects how your data is handled, we say so in the release notes as well.

Google user data

Sessio uses Google in two optional ways: signing in with your Google account, and connecting Google Meet to create video links for your sessions. Neither is required to use the app.

• Sign in with Google (scopes openid, email, profile): we receive your email address, name and a Google account identifier, and use them only to create your Sessio account and sign you in.
• Google Meet connection (scope meetings.space.created, requested only when you connect Google Meet in Settings → Integrations): when you ask for a video link for an online appointment, Sessio creates a Google Meet meeting space and shows its link in the appointment and in your Sessio calendar feed. Sessio only creates meeting spaces; it does not read or change your Google Calendar, your other meetings, recordings or transcripts.
• What we store: the email address of the connected Google account, the OAuth tokens needed to act on your behalf, and the link of each meeting space Sessio created. Client names and session content are never sent to Google.

Sessio's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

• Google user data is used only to provide the sign-in and Meet-link features described above, which are visible in the app.
• We do not sell it, do not use it for advertising, and do not transfer it to anyone except as needed to provide those features, to comply with the law, or as part of a merger or acquisition with your notice.
• It is never sent to the language-model, speech-recognition or document-recognition providers listed above, and it is not used to develop, improve or train AI or machine-learning models, ours or anyone else's.
• No person at Sessio reads it, unless you ask us to for support, it is needed for security or to comply with the law, or it has been aggregated and anonymised for internal operations.

To stop access, disconnect Google Meet in Sessio under Settings → Integrations: we revoke the grant at Google and delete the stored tokens. Links already sent to clients keep working. You can also revoke access at any time at https://myaccount.google.com/permissions. Deleting your Sessio account removes all stored Google data.

How long it stays

• Session content — audio, transcript, notes and attachments — stays until you delete it or delete your account. Deleting a session removes its audio and transcript; deleting a client removes their sessions.
• A local copy of a recording lives on your Mac until the session has finished processing, and can be removed from the app.
• Account data stays while the account exists. When you close it, we delete your workspace; backups age out on our provider's schedule.
• Anonymised analytics events are kept without any link back to session content.

If you need everything removed at once, write to support@sessio.health from the address on the account and we will confirm when it is done.

Where it is processed

Sessio is operated from Brazil and runs on cloud infrastructure and AI services that are located outside your country. Submitting a recording therefore means transferring it across borders. We rely on the providers' contractual terms for those transfers, and we keep the list of providers above current so you can see exactly who is involved.

Recording other people

You are responsible for the lawful basis of recording your clients. Ask for their consent before you record or upload a session, and tell them that a third-party service produces the transcript. Where your professional body or local law requires a specific form of consent, that requirement applies to you, not to us — Sessio provides the tool and cannot verify what you agreed with the person in the room.

Your rights

Depending on where you live, data protection law — Brazil's LGPD, the GDPR in Europe and comparable rules elsewhere — gives you the right to ask for a copy of your data, to correct it, to delete it, to restrict or object to processing, and to complain to a supervisory authority.

• Most of this you can do yourself: notes and summaries export to PDF and Markdown, and sessions, clients and files can be deleted in the app.
• For anything else, write to support@sessio.health. We answer within 30 days and do not charge for it.
• If a request concerns one of your clients, it usually reaches us through you, since the record sits in your workspace and you decide what happens to it.

Security

• Traffic between the app and our servers is encrypted in transit, and stored data sits on infrastructure that encrypts it at rest.
• Sign-in tokens are held in the macOS keychain rather than in plain files.
• Access to a workspace is scoped to its account; other practitioners cannot read your sessions.
• No system is immune. If a breach affects your data, we will tell you and the relevant authority as the law requires.

Children

Sessio is for practising professionals and is not offered to children. If you work with minors, you remain responsible for the consent of the child's guardian before any recording is made.

Changes to this policy

When this policy changes we update the date at the top and, for changes that affect how your data is handled, tell you in the app or by email before the new version applies.