Trust & Compliance

Psychotherapy notes are some of the most sensitive personal data anyone produces. Under the GDPR, they are special category data(Art. 9). Under German law they are protected by criminal-code professional secrecy (§ 203 StGB). Under Polish law they are protected by professional-secrecy chains in the Psychologist's Profession Act (art. 14 ustawy o zawodzie psychologa) and the Penal Code (art. 266 KK).

psychotherapy.talari.ai is being built so that German and Polish psychotherapists can use AI documentation without weakening any of those protections. This page tells you, in concrete terms, where your patient-adjacent data lives, who can touch it, what we will do if something goes wrong, and which commitments are already in place versus on the roadmap.

If anything on this page is unclear, or if you need a copy of our DPA / AVV before signing, contact us at trust@talari.ai or via the DPO contact in §6.

Audit trail. Once region-pinning is live, each request that touches patient-adjacent data will be logged with the region of every component that handled it. Logs are retained per the retention schedule in our DPA / AVV.

KMS region-locality statement. No customer-content key is ever materialised, wrapped, or used by a service running outside the EU. This is enforced at the IAM and network layers as part of the region-pinning architecture.

We will not display badges for certifications we have not yet earned. When SOC 2 Type II is issued, the audit-firm name, attestation-period, and report-availability path will appear here.

We follow the GDPR Art. 33 / Art. 34 framework.

The canonical sub-processor registry will live at psychotherapy.talari.ai/trust/sub-processors once published. Entries marked pending have Art. 28 AVV/DPA drafted and are awaiting signature; entries marked proposed are not yet finalised (gated on vendor freeze). No sub-processor is engaged until all onboarding steps in the registry process are complete.

Registry state: 0 engaged · 2 pending · 5 proposed · 0 terminated.

Self-hosted GPU.Deferred until > €500k ARR. Until then, all LLM inference for raw transcripts is performed by an EU-region commercial API with a “no training on your data” contract term and zero retention of user-content beyond what is required to return the response.

Notification SLA on changes. We will notify customers (the controllers) at least 30 days before any new sub-processor begins processing patient-adjacent data, and at least 60 days before any change that affects the data-residency region. Customers may object, in which case we provide either an alternative sub-processor or a migration path; if no alternative is available, the customer may terminate the affected service for cause.

We will not assert “we have a DPO” until the contract is executed. This page is updated within 5 business days of execution.

We do not treat the DPIA as a paperwork exercise filed once and forgotten. psychotherapy.talari.ai is built DPIA-first: every architectural decision that touches patient-adjacent data is evaluated against a residual-risk register before merge.

The full DPIA (Art. 35 GDPR / art. 35 RODO) is maintained internally and made available on request under NDA.

Headline findings from the v1 DPIA:

• No high-risk residuals requiring Art. 36 prior consultation with a supervisory authority.
• The single residual above Low is the clinical-quality risk that an AI-generated draft might be inaccurate — mitigated by the architectural commitment that the therapist is always the author of record: no draft is filed to a patient record without the therapist's explicit review and approval.
• Lawful basis (Art. 6 / Art. 9):controller-side basis is the therapist's professional treatment relationship and the patient's explicit consent (Art. 9(2)(a) / Art. 9(2)(h)). Our processor-side activity is governed solely by the DPA / AVV — we do not process patient content for our own purposes.
• No secondary use.Patient content is never used to train, fine-tune, or evaluate any model — neither ours nor a sub-processor's. This is a contractual term with each LLM sub-processor and a hard architectural rule.

Zero US sub-processors handle raw patient content.

This is a categorical commitment, not a best-effort statement.

• All LLM inference on raw therapy-session transcripts is performed by an EU-region commercial API under a contract that prohibits training on customer data and prohibits retention beyond the request lifecycle.
• All primary and secondary infrastructure is operated by EU-headquartered providers in EU data centres under EU jurisdiction.
• The few US-headquartered SaaS tools we may use (e.g. internal collaboration / observability) do not receive raw patient content and are scoped under appropriate Standard Contractual Clauses with supplementary measures per the EDPB Recommendations 01/2020.
• Where a US-headquartered tool offers an EU-data-residency tier, we use that tier in preference to a non-EU one, even at higher cost.
• We monitor adequacy decisions and Schrems-style litigation; if the EU–US Data Privacy Framework is invalidated again, the architectural commitment above means our patient-content data flow is unaffected.

• DPA (PL) — Umowa Powierzenia under art. 28 RODO. On request via trust@talari.ai.
• AVV (DE) — Auftragsverarbeitungsvertrag under Art. 28 GDPR + § 203(3) StGB conformity. On request via trust@talari.ai.
• TOM Schedule (Annex 1 to both DPAs). On request, ships with the DPA/AVV.
• Privacy Notice — /legal/en/privacy-policy
• Imprint / Impressum — /legal/en/legal-notice

• General trust questions: trust@talari.ai
• Subject-rights requests (Art. 15–22): trust@talari.ai (will route to dpo@talari.ai once the DPO firm is contracted)
• Security disclosure: security@talari.ai (PGP key published once the security mailbox is provisioned)
• Postal address: pending entity registration in Poland