Terms of Use

1. Introduction

Welcome to CocoPsych. These Terms of Use ("Terms") govern your use of CocoPsych (the "Service"), an AI-powered psychology practice management platform operated by CocoPsych Ltd ("we," "us," or "our"). Our platform provides session transcription, AI-generated clinical notes, client management, scheduling, billing, and professional development tools (including the Sandbox workspace for reflective practice, supervision recording, task management, and CPD logging) for mental health practitioners.

By accessing or using the Service, you agree to be bound by these Terms. If you disagree with any part of the Terms, you may not access the Service.

2. System Classification

CocoPsych is a Practice Management System (PMS). It is not an Electronic Health Record (EHR) system. CocoPsych does not provide clinical decision support, e-prescribing, lab order management, or multi-provider shared records. CocoPsych does not hold ONC Health IT Certification or NHS Spine integration.

CocoPsych is designed as a supplementary tool for mental health practitioners. You may use CocoPsych as your primary record system or alongside other systems at your discretion.

3. Data Ownership and Roles

3.1 You as Data Controller / Covered Entity

You (the practitioner or practice) are the Data Controller (under GDPR/UK GDPR) or Covered Entity (under HIPAA). You determine the purpose and means of processing patient data, hold patient consent, and are responsible for meeting your jurisdiction's legal requirements including record retention.

3.2 CocoPsych as Data Processor / Business Associate

CocoPsych acts exclusively as a Data Processor (under GDPR/UK GDPR) or Business Associate (under HIPAA). We process data solely on your behalf and under your documented instructions. We do not use your clinical data for our own purposes, AI model training, marketing, or any purpose beyond providing the Service to you.

3.3 Patient Rights

Patient rights (access requests, erasure requests, data portability) are exercised through you as the data controller. Patients should direct such requests to their practitioner, not directly to CocoPsych.

4. Use of the Service

4.1 Eligibility

The Service is intended for qualified mental health professionals, including psychologists, therapists, counsellors, and psychiatrists. By using the Service, you represent that you are a qualified practitioner or are authorised to act on behalf of a practice.

4.2 Account Registration

You must register for an account to use the Service. You agree to provide accurate information and maintain the confidentiality of your credentials. You are responsible for all activities under your account. You must notify us immediately of any unauthorised access.

4.3 Acceptable Use

You agree not to:

• Use the Service in violation of any applicable law or regulation
• Process patient data without appropriate lawful basis or consent
• Attempt to access other users' data or reverse-engineer the Service
• Interfere with or disrupt the Service infrastructure
• Use the Service for purposes other than clinical practice management
• Share account credentials with unauthorised persons

5. AI-Generated Content and Clinical Notes

CocoPsych uses artificial intelligence to transcribe sessions and generate clinical notes. By using these features, you acknowledge:

• AI-generated notes are drafts that require your professional review before use
• You are solely responsible for the accuracy and clinical appropriateness of any notes you finalise
• AI transcription and note generation are not a substitute for professional clinical judgement
• You must review, edit, and approve all AI-generated content before it becomes part of a patient record
• CocoPsych does not provide clinical decision support or treatment recommendations

IMPORTANT: AI-generated notes may contain errors. You bear full professional responsibility for all clinical documentation you create, approve, or retain using the Service.

6. Audio Recording and Transcription

CocoPsych provides session recording and transcription capabilities for both clinical sessions and supervision sessions. By using these features:

• You represent that you have obtained all necessary consent from all parties before recording
• You acknowledge that recording consent requirements vary by jurisdiction (all-party consent is required in many states and countries)
• Audio recordings are never stored. Audio exists only during the transcription process and is automatically deleted immediately upon completion of transcription
• We do not retain, archive, or back up audio recordings under any circumstances
• Once deleted, audio cannot be recovered
• This applies equally to clinical session recordings and supervision session recordings

You are solely responsible for ensuring compliance with recording consent laws in your jurisdiction. CocoPsych is not liable for recordings made without proper consent.

6A. Sandbox (Professional Development Workspace)

The Sandbox is a personal workspace for your professional development. It includes:

• Thinking Space: AI-assisted reflective practice and personal note-taking
• Tasks: Pre-session and post-session task management
• Supervisions: Recording, transcription, and AI-generated notes for supervision sessions
• CPD (Continuing Professional Development): Activity logging with evidence uploads

Sandbox data is your personal professional data — it is not clinical patient data. However, supervision transcripts and notes may reference patient information and are therefore treated with equivalent security protections. You are responsible for ensuring that any patient-identifiable information within Sandbox data is handled in accordance with your professional obligations.

Sandbox data retention follows your subscription tier (not jurisdiction-mandated clinical retention minimums). See Section 7 for details.

7. Data Retention

7.1 Clinical Data

Clinical notes, transcripts, and client records are retained for the duration of your active subscription. You may delete clinical data at any time, subject to jurisdiction-appropriate warnings. CocoPsych does not block deletion of clinical data — you as the data controller bear responsibility for meeting your jurisdiction's retention requirements.

7.1A Sandbox Data

Sandbox data (Thinking Space notes, tasks, supervision records, CPD logs, and evidence uploads) is retained for the duration of your active subscription. Sandbox data is not subject to clinical record retention mandates, but supervision transcripts referencing patients should be treated with appropriate care. You may delete Sandbox data at any time without restriction.

7.2 Mandatory Retention

The following data is subject to mandatory retention regardless of user request:

• Audit logs: 7 years (immutable, tamper-evident)
• Billing records: 7 years
• Consent records: 7 years

7.3 Post-Cancellation

Upon subscription cancellation, your data is retained for a grace period during which you may export or reactivate:

• Starter: 30 days
• Professional: 90 days
• Organisation: 1 year

After the grace period, clinical data is permanently deleted. Mandatory retention records (audit logs, billing, consent) are retained per legal requirements.

7.4 Data Export

You may export your data in structured, machine-readable format (JSON/CSV) at any time during your active subscription or within the post-cancellation grace period.

8. Subscription and Payments

8.1 Plans

CocoPsych offers tiered subscription plans (Starter, Professional, Organisation) with varying features and capabilities. Plan details and pricing are available on our website.

8.2 Payment Processing

We use third-party payment processors. Payment processing is subject to the terms and privacy policies of those processors. All fees are exclusive of taxes unless otherwise stated.

8.3 Cancellation

You may cancel your subscription at any time. Upon cancellation, you retain access until the end of your current billing period, after which post-cancellation grace periods apply as described in Section 7.3.

9. HIPAA Business Associate Agreement

For US-based practitioners, CocoPsych will enter into a Business Associate Agreement (BAA) as required under HIPAA. The BAA defines permitted uses and disclosures of Protected Health Information (PHI), breach notification procedures, and termination provisions. The BAA is available upon request and must be executed before processing PHI.

10. Security

CocoPsych implements appropriate technical and organisational measures to protect your data, including:

• AES-256 encryption at rest for all stored data
• TLS 1.3 encryption in transit
• Multi-factor authentication
• Role-based access controls
• Immutable audit logging
• Regular security assessments

No system is completely secure. You acknowledge that you are responsible for maintaining the security of your own credentials and devices.

11. Intellectual Property

The Service (excluding your clinical data) is the exclusive property of CocoPsych Ltd. You retain all rights to your clinical data, client records, and notes. We claim no ownership of your data.

You grant us a limited licence to process your data solely for the purpose of providing the Service. This licence terminates upon deletion of your data or termination of your account.

12. Limitation of Liability

To the maximum extent permitted by law, CocoPsych shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from:

• Your use of or inability to use the Service
• Errors in AI-generated transcriptions or clinical notes
• Clinical decisions made based on AI-generated content
• Unauthorised access resulting from your failure to secure credentials
• Service interruptions or data loss beyond our reasonable control

You are solely responsible for your clinical decisions, professional conduct, and compliance with applicable laws and professional body requirements.

13. Disclaimer

The Service is provided "AS IS" and "AS AVAILABLE." CocoPsych does not provide medical, legal, or compliance advice. The Service does not replace professional clinical judgement, legal counsel, or compliance review. You are responsible for ensuring your use of the Service meets your regulatory and professional obligations.

14. Termination

We may suspend or terminate your account for breach of these Terms, non-payment, or if required by law. Upon termination:

• Post-cancellation grace periods apply as described in Section 7.3
• You may export your data during the grace period
• Mandatory retention records are retained per legal requirements
• You remain liable for any fees incurred prior to termination

15. Governing Law

These Terms are governed by and construed in accordance with the laws of England and Wales. Any disputes arising from these Terms shall be subject to the exclusive jurisdiction of the courts of England and Wales.

For users in the United States, the HIPAA Business Associate Agreement may include additional dispute resolution provisions as required by federal law.

16. Changes to Terms

We may update these Terms from time to time. Material changes will be notified at least 30 days in advance via email or in-app notification. Continued use of the Service after changes take effect constitutes acceptance of the revised Terms.

17. Contact Us

If you have questions about these Terms, please contact us at:

Email: legal@cocopsych.com

Data Protection enquiries: privacy@cocopsych.com