Trust & Compliance

Psychotherapy notes are some of the most sensitive personal data anyone produces. Under the GDPR, they are special category data(Art. 9). Under German law they are protected by criminal-code professional secrecy (§ 203 StGB). Under Polish law they are protected by professional-secrecy chains in the Psychologist's Profession Act (art. 14 ustawy o zawodzie psychologa) and the Penal Code (art. 266 KK).

psychotherapy.talari.ai is being built so that German and Polish psychotherapists can use AI documentation without weakening any of those protections. This page tells you, in concrete terms, where your patient-adjacent data lives, who can touch it, what we will do if something goes wrong, and which commitments are already in place versus on the roadmap.

If anything on this page is unclear, or if you need a copy of our DPA / AVV before signing, contact us at trust@talari.ai or via the DPO contact in §6.

Audit trail. Once region-pinning is live, each request that touches patient-adjacent data will be logged with the region of every component that handled it. Logs are retained per the retention schedule in our DPA / AVV.

KMS region-locality statement. No customer-content key is ever materialised, wrapped, or used by a service running outside the EU. This is enforced at the IAM and network layers as part of the region-pinning architecture.

We will not display badges for certifications we have not yet earned. When SOC 2 Type II is issued, the audit-firm name, attestation-period, and report-availability path will appear here.

We follow the GDPR Art. 33 / Art. 34 framework.

The canonical sub-processor registry will live at psychotherapy.talari.ai/trust/sub-processors once published. Entries marked live are in use. Entries marked pending are in use, but the Art. 28 data processing agreement (DPA; in German: AVV) with the provider is not yet concluded. Entries marked planned or proposed are not yet in use.

Registry state: 5 live · 3 pending · 1 planned · 4 proposed.

Self-hosted GPU.Deferred until > €500k ARR. Until then, AI inference is performed by the EU providers listed above.

Notification SLA on changes. We will notify customers (the controllers) at least 30 days before any new sub-processor begins processing patient-adjacent data, and at least 60 days before any change that affects the data-residency region. Customers may object, in which case we provide either an alternative sub-processor or a migration path; if no alternative is available, the customer may terminate the affected service for cause.

We will not assert “we have a DPO” until the contract is executed. This page is updated within 5 business days of execution.

We do not treat the DPIA as a paperwork exercise filed once and forgotten. psychotherapy.talari.ai is built DPIA-first: every architectural decision that touches patient-adjacent data is evaluated against a residual-risk register before merge.

The full DPIA (Art. 35 GDPR / art. 35 RODO) is maintained internally and made available on request under NDA.

Headline findings from the v1 DPIA:

• No high-risk residuals requiring Art. 36 prior consultation with a supervisory authority.
• The single residual above Low is the clinical-quality risk that an AI-generated draft might be inaccurate — mitigated by the architectural commitment that the therapist is always the author of record: no draft is filed to a patient record without the therapist's explicit review and approval.
• Lawful basis (Art. 6 / Art. 9):controller-side basis is the therapist's professional treatment relationship and the patient's explicit consent (Art. 9(2)(a) / Art. 9(2)(h)). Our processor-side activity is governed solely by the DPA / AVV — we do not process patient content for our own purposes.
• No secondary use.Patient content is never used to train, fine-tune, or evaluate any model — neither ours nor a sub-processor's. This is a contractual term with each LLM sub-processor and a hard architectural rule.

Zero US sub-processors handle raw patient content.

This is a categorical commitment, not a best-effort statement.

• All AI inference (language models and speech-to-text) is performed by EU-headquartered providers in EU data centres (see §5). The terms of our main provider exclude training on customer data and exclude retention of requests after processing, except temporarily to investigate abuse or faults.
• All primary and secondary infrastructure is operated by EU-headquartered providers in EU data centres under EU jurisdiction.
• The US-headquartered services we use — payments (Stripe), transactional email (Namecheap) and bot protection on forms (Google reCAPTCHA) — do not receive session content and are covered by the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
• Where a US-headquartered tool offers an EU-data-residency tier, we use that tier in preference to a non-EU one, even at higher cost.
• We monitor adequacy decisions and Schrems-style litigation; if the EU–US Data Privacy Framework is invalidated again, the architectural commitment above means our patient-content data flow is unaffected.

• DPA (PL) — Umowa Powierzenia under art. 28 RODO. On request via trust@talari.ai.
• AVV (DE) — Auftragsverarbeitungsvertrag under Art. 28 GDPR + § 203(3) StGB conformity. On request via trust@talari.ai.
• TOM Schedule (Annex 1 to both DPAs). On request, ships with the DPA/AVV.
• Privacy Notice — /legal/en/privacy-policy
• Imprint / Impressum — /legal/en/legal-notice

• General trust questions: trust@talari.ai
• Subject-rights requests (Art. 15–22): trust@talari.ai (will route to dpo@talari.ai once the DPO firm is contracted)
• Security disclosure: security@talari.ai (PGP key published once the security mailbox is provisioned)
• Postal address: ul. Ignacego Paderewskiego 144A lok. 2, 04-443 Warszawa, Poland