Version 1.1 · Effective 2026-10-08
Epia Privacy Policy
The short version
- Your conversations are yours. Your therapist never sees them, and the Epia team does not read them in identifiable form except in the narrow cases in Section 9.
- You decide what your therapist sees. Only the items you review and approve, plus trends and progress if you turn on sharing.
- AI processes your messages to respond to you. Our AI providers are under contract not to keep your data or train on it.
- We improve Epia only with de-identified data, and you can opt out.
- We never sell your information, show no ads, and share nothing with employers, insurers, or schools.
- Everything is encrypted, in transit and at rest, with a separate key for each user.
- You can export or delete your data at any time.
- Epia is for adults (18+) in the United States.
1. Who we are, and our two roles
1.1 Epia. Epia, Inc. ("Epia," "we," "us") is a Delaware corporation with its principal place of business at 2261 Market Street, STE 89375, San Francisco, California 94114. Contact: support@epia.app [or privacy@epia.app].
1.2 Two roles. How the law treats your information depends on how it reaches us.
- Information we handle for your therapist. When a therapist invites you and you link your account to that therapist, Epia stores and processes your information to support the therapist's work with you. For that information, Epia acts as a service provider to your therapist, which HIPAA calls a "business associate" (45 CFR § 160.103). We may use and disclose that information only as our Business Associate Agreement with your therapist allows, and your HIPAA rights over it (such as access and amendment) are exercised through your therapist. We give every linked client this protection whether or not their therapist is a HIPAA covered entity.
- Information Epia handles for itself. Account details, therapist license information, website visits, support emails, and research data collected under a study consent are handled by Epia as the responsible business under state privacy laws.
1.3 California medical information. We treat information about your mental health as "medical information" under the California Confidentiality of Medical Information Act (Civil Code § 56 and following). That law applies to businesses that offer software designed to maintain medical information for the diagnosis, treatment, or management of a condition (Civil Code § 56.06), and we do not disclose medical information without your authorization except as that law permits.
2. Who this policy covers
- Clients: adults who use the Epia app at the invitation of their therapist.
- Therapists: licensed professionals who use the therapist portal and app.
- Website visitors and people who contact us.
- Research participants: covered here and by the separate study consent you sign; the consent controls for study data.
3. Information we collect
3.1 From clients
Category | Examples | Source |
|---|---|---|
Account | Email address, sign-in method (Google Sign-In or email code), phone number if you choose SMS verification, notification preferences | You |
Onboarding and profile | Why you are here, your goals, preferred communication style, session schedule, your state of residence | You |
Conversations | Messages you send to Epia, and Epia's responses | You, and generated by Epia |
Progress entries | Insights, session prep and reflections, practice items, goals, and mood check-ins you log or save | You, and generated by Epia at your request |
Context from your therapist | Guidance your therapist gives Epia about how to support you, and context about the work you do together | Your therapist |
Items you share | The summaries, insights, and prep you approve for your therapist | You |
Feedback | Thumbs-up or thumbs-down ratings and written feedback | You |
Study data | Questionnaires such as PHQ-9, GAD-7, and WAI-SR, if you join a study | You, under a study consent |
Device and usage | Device type, OS version, app version, device identifiers, language, feature use, timestamps, crash and error reports (with content removed) | Your device |
3.2 From therapists
Category | Examples | Source |
|---|---|---|
Account and license | Name, email, license type, number, and state, credentials, practice name and address | You, and state licensing boards for verification |
Client roster | Names and email addresses of clients you invite, and the state they are located in | You |
Context you provide | Compass guidance and client context you write | You |
Your conversations with Epia | Questions you ask Epia's therapist assistant and its responses | You, and generated by Epia |
Items clients share with you | Summaries, insights, and prep your clients approve | Your clients |
Agreements | Acceptance records for the Terms, this policy, the BAA, and any Early Access Agreement | You |
Device and usage | As for clients | Your device |
3.3 From everyone
- Support communications: emails you send us and our replies.
- Website logs: IP address, browser type, pages viewed, referring page. Our website and apps do not use advertising trackers or third-party analytics that profile you. [Confirm: no Meta pixel, Google Analytics, or similar on epia.app or in the apps (drafting note P3).]
3.4 What we do not collect. We do not collect precise location, contacts, photos, biometric identifiers, or payment information (Epia is free during early access). We do not buy information from data brokers.
4. How we use information
Purpose | What we use | Basis |
|---|---|---|
Run the Service | Account, conversations, Progress entries, therapist context, preferences | Providing the service you asked for; for linked clients, the BAA with your therapist |
Shape Epia's responses to you | Your conversations and Progress entries, plus your therapist's guidance and context | Same |
Share with your therapist | Only items you approve, plus trends and a safety flag if you turn on sharing | Your direction (Section 6) |
Safety features | Conversation content, to detect language that may indicate a crisis and show resources | Providing the service; protecting health and safety |
Support you | Support emails, account data, and, only with your permission, the specific conversation you ask us about | Your request |
Keep Epia secure and prevent abuse | Device and usage data, access logs, automated abuse detection | Protecting users and the Service |
Improve Epia | De-identified data only (Section 5.3) | Improving the Service; you can opt out |
Research | Study data, under the study's consent | Your consent |
Communicate with you | Email and app notifications about your account, security, and changes to these documents; check-in reminders you choose | Your request and preferences |
Comply with law | Only what the law requires | Legal obligation |
We do not send marketing emails to clients. Therapists may receive product updates and can unsubscribe at any time. Notifications and emails never include conversation content.
5. How AI processes your information
5.1 Model providers. Epia generates its responses using large language models from third-party providers (currently Anthropic's Claude API) [and any others listed at epia.app/subprocessors]. To respond to you, your message and relevant context are sent to the provider over an encrypted connection. Our contracts with these providers, including a Business Associate Agreement, prohibit them from using your data to train their models and require them to delete it after processing [zero data retention]. Confirm each provider's BAA and retention terms before release (drafting note P1).
5.2 No training on identifiable data. Epia does not use your identifiable conversations or Progress entries to train any AI model.
5.3 De-identified data for improvement. We may create de-identified data using the HIPAA Safe Harbor method (45 CFR § 164.514(b)(2)), which removes 18 categories of identifiers, including names, email addresses, dates other than year, and any location smaller than a state. We use de-identified data to evaluate the quality and safety of Epia's responses (including automated evaluations where AI systems review de-identified conversations), to find patterns, to monitor safety features, and to develop and improve Epia's models and frameworks. We use de-identified data inside Epia. We may also share de-identified data with research collaborators (for example, a university or clinical research partner) for studies of whether Epia helps, under a written agreement that prohibits re-identification and any further sharing. We never sell de-identified data, we never share it for advertising, and we never try to re-identify it. Aggregate study results, which identify no one, may be published.
5.4 Feedback-triggered review. If you rate a response thumbs-down, we may review a de-identified version of that response, the current conversation, and up to five of your most recent prior conversations to understand what went wrong. Identifiers are removed before anyone on our team sees the content. You are told this the first time you use the feedback feature.
5.5 Opt out. You can opt out of product improvement use at any time by emailing support@epia.app. We process opt-outs within 30 days, and opting out does not change what Epia can do for you. Data already de-identified and included in aggregate analyses cannot be pulled back, because it can no longer be linked to you.
5.6 AI makes mistakes. AI-generated content is not reviewed by a person before you see it and may be inaccurate. The Terms of Service explain what Epia is and is not.
6. What your therapist can and cannot see
6.1 The default is nothing. When you link with your therapist, your therapist receives nothing from Epia until you choose to share. Your conversations with Epia are never visible to your therapist in any mode.
6.2 Items you approve. Session prep, reflections, and insights you choose to share are shown to you first. You can edit or remove anything before you send it. If you do not approve an item, it is not sent.
6.3 Trends and progress, if you turn on sharing. In Settings you can turn on therapist sharing. When it is on:
Your therapist sees | Your therapist does not see |
|---|---|
Mood trends over 1, 2, or 4 weeks (for example, "mood dipped mid-week") | Individual mood entries or the notes beside them |
Practice and goal progress (for example, "completed 3 of 5 practice items") | The text of your goals, notes, or reflections, unless you share them |
A general activity summary (for example, "active 5 days this week") | Timestamps, session length, or which features you used |
A notice that a safety concern was flagged | The conversation that triggered it |
Your name, email address, and the state you entered | Your account settings, feedback, or ratings |
6.4 What your therapist gives Epia. Your therapist can give Epia guidance about how to support you (for example, "we are practicing thought records") and can share context about your work together when inviting you. Epia uses this to shape its responses. You can always read the context your therapist shared about you, word for word, in the app. If you choose "start fresh," Epia will not bring that context up on its own, though it still informs safety features silently.
6.5 Turning sharing off or unlinking. You can turn sharing off, or unlink from your therapist, at any time in Settings. This stops all future sharing immediately. Items you already shared remain in your therapist's Epia workspace as part of their records, and we cannot remove information from records your therapist keeps outside Epia.
6.6 Epia's AI and your therapist. Epia's AI reads your conversations to draft the summaries you review. [It does not answer your therapist's questions from your conversations. If we add a feature that lets Epia draw on your conversations to help your therapist, we will update this policy and ask for your permission first.] Drafting note P4.
7. What clients can see about their therapist
Clients can see their therapist's name, credentials, and practice name, the context the therapist shared about their work together, and the items the client has shared with the therapist. Clients cannot see the therapist's conversations with Epia's therapist assistant or any other client's information.
8. Who else we share information with, and who we never share it with
8.1 Service providers. We share information with providers who help us run Epia. Each is bound by a contract that limits them to our instructions and, where client health information is involved, by a Business Associate Agreement.
Category | What they receive | Current provider |
|---|---|---|
AI model provider | Messages and context needed to generate responses; no training; deleted after processing | Anthropic [confirm] |
Cloud hosting and database | Encrypted data at rest | [Provider] |
Web hosting | Web app and portal traffic | Vercel |
Authentication | Email address and sign-in tokens | |
Email and push delivery | Your email address or device token and the notification text (never conversation content) | [Provider] |
SMS verification | Your phone number and the code | [Provider] |
Error and performance monitoring | Technical diagnostics with content removed | [Provider] |
We keep the current list at epia.app/subprocessors and update it when a provider changes.
8.2 Your therapist. As Section 6 describes, at your direction.
8.3 Legal requirements. We may disclose information when required by law, subpoena, court order, or a government request. Where the law allows, we will tell you and limit the disclosure to what is required. For client health information, we follow the process in the Business Associate Agreement.
8.4 Safety. [We may disclose information when we believe in good faith that it is necessary to prevent serious and imminent harm to you or someone else, to the extent the law permits. This is rare, and we will tell you unless the law prevents it.] Decision: whether Epia ever contacts emergency services or anyone other than the therapist (drafting note P5).
8.5 Business transfers. If Epia is acquired or merges, or its assets are sold, your information may transfer to the new owner, who must honor this policy. We will notify you before your information becomes subject to a different policy.
8.6 Who we never share with. We do not sell your information. We do not share it for advertising or cross-context behavioral advertising. We do not share it with data brokers, advertisers, employers, insurers, schools, or other users, and we never sell de-identified data; we share it only with research collaborators under the conditions in Section 5.3. We have not sold or shared personal information in the past 12 months.
9. Security
- Encryption at rest: AES-256-GCM, with a separate encryption key for each user derived using PBKDF2, covering conversations, Progress entries, therapist context, and other sensitive fields.
- Encryption in transit: TLS for every connection, including to AI providers.
- Access controls: least-privilege access, multi-factor authentication for administrative access, and logged, auditable access to user data. Epia team members do not read conversations in identifiable form in the normal course of operations. [Identifiable access happens only when you ask us for help with a specific conversation, when it is required to investigate a safety or security incident, or when the law requires it, and every such access is logged.] Drafting note P2.
- No content in logs or notifications: application logs, error reports, analytics events, emails, and push notifications do not include conversation content or Progress entries.
- Vendor agreements: every provider that touches client information has a Business Associate Agreement with us.
- Risk analysis and training: we run a HIPAA security risk analysis at least once a year and act on what it finds, and everyone with access to user data completes privacy and security training.
No system is perfectly secure. Protect your sign-in credentials and your devices, and tell us at support@epia.app if you suspect a problem.
10. If something goes wrong
If a security incident affects your information, we will investigate, contain it, and notify as the law requires:
- For information we hold for your therapist, we notify your therapist without unreasonable delay and within [10 business] days of discovering a breach, so your therapist can notify you within the 60 days HIPAA allows (45 CFR §§ 164.404 and 164.410). We may notify you directly as well.
- For information Epia holds for itself, we notify you directly as state breach laws require (including California Civil Code § 1798.82) and, where it applies, as the FTC Health Breach Notification Rule requires (16 CFR Part 318).
- We notify regulators where required.
11. Retention and deletion
Information | How long we keep it |
|---|---|
Active account data (conversations, Progress entries, therapist context) | While your account is active |
After you delete your account | Removed from active systems within 30 days and from backups within 90 days, except the categories below |
Items you shared with your therapist | Until your therapist deletes them or the therapist's account closes; your therapist is responsible for their own records |
Therapist account data after closure | Returned or destroyed as the BAA requires, within [60] days, after an export window |
Agreement acceptance records | Life of the account plus 6 years |
Security and access logs (no content) | Up to 6 years (45 CFR § 164.316(b)(2)) |
Support emails | 3 years |
De-identified data | Indefinitely; it can no longer be linked to you |
Study data | As the study consent states |
We may keep information longer when the law requires it, to resolve a dispute, or to enforce our agreements, and we limit access to those purposes.
12. Your rights and choices
12.1 In the app, at any time
- See and export your data. Your conversations, Progress entries, and settings are visible in the app. Export a copy from Settings.
- Correct your information. Edit your profile and entries in the app, or email us.
- Delete your account. In Settings, or by emailing support@epia.app. Section 11 has the timelines.
- Control therapist sharing. In Settings. Section 6 explains what each setting does.
- Control notifications. In Settings.
- Opt out of product improvement use. Email support@epia.app (Section 5.5).
12.2 Rights under state privacy laws. Depending on where you live, state law may give you the right to know what personal information we hold about you, to access, correct, or delete it, to receive it in a portable format, to opt out of sale, sharing, or targeted advertising (we do none of these), to limit use of sensitive personal information, and to appeal our decision. We honor these rights for everyone, whether or not a particular law applies to Epia, and we will not discriminate against you for exercising them.
12.3 Rights under HIPAA. For information we hold for your therapist, HIPAA gives you rights to access it, to request amendments, to request an accounting of certain disclosures, and to request restrictions (45 CFR §§ 164.522 through 164.528). Your therapist handles these requests, and we support them under the Business Associate Agreement. You can also see and export your own content directly in the app at any time.
12.4 How to exercise a right. Email support@epia.app [or privacy@epia.app] from the email address on your account, or write to us at the address in Section 18. We verify requests by confirming control of the account email, and we may ask for more information where the law requires. You may use an authorized agent if you give them written permission and we can verify your identity. We respond within 30 days [or within 45 days where state law allows and the request is complex, with notice to you]. To appeal a decision, reply to our response with "Appeal" in the subject line; we respond to appeals within 30 days and tell you how to contact your state attorney general if you are not satisfied.
13. State-specific notices
13.1 California. This section applies to California residents and supplements the rest of this policy.
- Categories collected in the past 12 months, in the terms of the California Consumer Privacy Act (Civil Code § 1798.140): identifiers (name, email, phone, device identifiers, IP address); customer records (Civil Code § 1798.80); internet or network activity (app usage, website logs); professional information (therapists' license and practice details); sensitive personal information (mental health information in your conversations and Progress entries, and account sign-in credentials); and inferences Epia generates for you (summaries and insights), which we use only to provide the Service to you.
- Sources, purposes, and disclosures: Sections 3, 4, and 8. We disclose personal information only to service providers (Section 8.1), to your therapist at your direction, and as the law requires. We do not sell or share personal information, including sensitive personal information. We use sensitive personal information only for the purposes the CCPA regulations permit without a right to limit (11 CCR § 7027), so there is no "Limit the Use of My Sensitive Personal Information" choice to offer.
- Exemptions: medical information governed by the Confidentiality of Medical Information Act and protected health information handled under HIPAA are exempt from the CCPA (Civil Code § 1798.145(c)). We protect that information under those laws, as Section 1 describes.
- Your rights and how to exercise them: Section 12. We treat Global Privacy Control signals as a request to opt out of sale or sharing (we do neither). We do not respond to Do Not Track browser signals, because there is no agreed standard for them.
- Shine the Light (Civil Code § 1798.83): we do not share personal information with third parties for their direct marketing.
- Minors: Epia is for adults 18 and over.
13.2 Washington (My Health My Data Act, RCW 19.373). [This section applies if you are a Washington resident or your consumer health data is collected in Washington, and it covers consumer health data not already protected under HIPAA.] We collect the consumer health data described in Section 3 (your conversations, mood check-ins, Progress entries, and study data) from you and from your therapist, for the purposes in Section 4. We share it only with the service providers in Section 8.1 and with your therapist at your direction, and we do not sell it. You have the right to confirm whether we are collecting your consumer health data, to access it, to withdraw consent, to have it deleted, and to appeal; exercise these rights as Section 12.4 describes. [Publish this section as a separate "Consumer Health Data Privacy Policy" page linked from the epia.app homepage if Epia has Washington users (drafting note P6).]
13.3 Nevada and other states. Nevada residents: we do not sell covered information, and we do not sell consumer health data (SB 370). Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Utah, Montana, and other states with comprehensive privacy laws: Section 12 describes your rights and how to exercise and appeal them. We treat your mental health information as sensitive data and process it only with your consent or as the law allows.
13.4 Illinois. We do not collect biometric identifiers or biometric information.
14. Children
Epia is for adults 18 and over. We do not knowingly collect information from anyone under 18. If we learn that we have, we delete it and close the account. Tell us at support@epia.app if you believe a minor has an account.
15. Research and studies
Epia runs studies, such as the Alpha Study, to learn whether Epia helps. Participation is voluntary and governed by a separate study consent that explains what is collected (for example, PHQ-9, GAD-7, and WAI-SR questionnaires and interview notes), how it is used, and how results are reported. Published results use de-identified or aggregate data only. Declining or withdrawing does not affect your use of Epia.
16. Where data lives
Epia is offered in the United States, and we store and process data in the United States. If you use Epia from outside the United States, your information will be processed there.
17. Changes to this policy
When we make a material change, we post the new version at epia.app/privacy and notify you by email and in the app at least 30 days before it takes effect. If a change would let us use your identifiable information in a new way, it applies to information collected after the effective date, and we ask for your opt-in consent before applying it to information collected earlier. Minor changes (clarifications, contact details, provider changes) are recorded in the version history at epia.app/privacy/history.
18. Contact
Epia, Inc., 2261 Market Street, STE 89375, San Francisco, California 94114. Email: support@epia.app [or privacy@epia.app]. We respond to privacy inquiries within 30 days. If you have an unresolved concern about how information we hold for your therapist is handled under HIPAA, you may also complain to the U.S. Department of Health and Human Services, Office for Civil Rights.
Electronic acceptance
I have read the Epia Privacy Policy.
SHA-256: 902cf669ca1524ece24fb8fe36de337226c24f7c28f54ad80a0f5c6194036581