Privacy & Security

This page explains our Privacy Policy, Security Practices and privacy and security questions. For the legal agreement and HIPAA Business Associate Agreement, read Terms of Use & BAA.

Last Updated: August 27, 2026

Privacy Policy

This Privacy Policy identifies the data Simcha handles, how it is collected, why it is used, where it is processed, and the choices available to you. Simcha treats account identifiers, summaries of spoken ideas, conversation content, and clinical content as sensitive personal data. This Policy forms part of the Agreement together with the Terms of Use & BAA and, where applicable, the Business Associate Agreement.

Simcha listens for the main ideas and makes a rough summary, like a word cloud. It does not write down every word or identify who is speaking. The app does not record audio. Audio recording is not supported by design, so there is no recording to save or play back.

Simcha is built to help understand the ideas being discussed. It does not keep an audio recording or an exact account of who said each word.

Data We Collect and Why

Account information

Your name, email address, phone number, and account identifier are provided when you create an account or sign in. We use them for authentication, account administration, support, and security.

Conversation and clinical content

You provide typed conversation text, rough summaries of spoken ideas, client information, session notes, attachments, and content you choose to keep. We use this data to provide the conversations, documentation, history, and other features you request.

Listening for the Main Ideas

Simcha listens while you speak and picks out the main ideas and topics. Think of the result as a rough summary or a word cloud of what was discussed. It is not a word-for-word transcript: it does not copy every spoken word, and it should not be used as an exact quote or a complete account of the conversation.

Depending on your settings and device support, this listening may happen on your device or through a speech service. The rough summary of ideas is sent to Simcha servers to help create replies, summaries, or notes. These data-handling rules also cover text you type and notes you choose to save.

Speaker Privacy

To protect privacy, Simcha does not identify who is speaking or attach a person's name to their voice. The rough summary focuses on the ideas discussed, without labeling who said each thing.

No Audio Recording

The app is built for live listening, not for making recordings. The app does not record audio. Audio recording is not supported by design: no audio recording is created or stored, so there is nothing to save, download, or play back. There is also no word-for-word transcript of the spoken session.

Usage and device data

App interactions, app and device details, installation identifiers, IP address, performance information, and diagnostics may be collected automatically when you use Simcha. We use this data to operate, secure, troubleshoot, and improve the service.

AI and Third-Party Processing

Simcha shares only the data needed to provide the requested feature. We do not sell user data and do not use conversation or clinical content for advertising. Our agreements require service providers to protect the data and use it only for their contracted services. Our AI provider terms prohibit model training with Simcha customer data.

Google Cloud and Firebase

Google Cloud and Firebase provide authentication, databases, storage, and primary cloud AI processing for conversations, summaries, and notes.

Microsoft Azure

Microsoft Azure provides secure data centers and high-availability cloud infrastructure. Simcha AI has a HIPAA Business Associate Agreement with Microsoft.

Amazon Web Services and Anthropic

Amazon Web Services and Anthropic may process conversation text through Anthropic models hosted on AWS when the primary AI service is unavailable.

ElevenLabs

ElevenLabs receives agent reply text, not your voice audio, to create spoken agent audio when a cloud voice is used.

Mixpanel and Amplitude

Mixpanel and Amplitude receive account or device identifiers and product-interaction data for product analytics.

AppsFlyer

AppsFlyer receives app, device, installation, and link-attribution data. Simcha disables collection of the advertising identifier (IDFA/AAID) and does not use AppsFlyer for cross-app tracking.

Permissions and Your Choices

Simcha asks for access to protected device features when you use a feature that needs them. You can decline or later withdraw microphone, speech-recognition, camera, photo-library, calendar, music, Bluetooth, and Face ID permissions in your device settings. Some features will be unavailable, but alternatives such as typing may remain available.

Cloud AI processing is required for cloud-powered conversations, summaries, and note generation. You may choose not to start those features. To stop future processing and remove data associated with your account, use Delete my account in the app or request account deletion. Contact support for other privacy choices.

Storage and Security

Your data is stored on secure, encrypted cloud infrastructure — encrypted in transit and at rest. Providers using Simcha for client work are covered by our HIPAA Business Associate Agreement. Service providers that receive Simcha data are required to apply protections at least as protective as those described in this Policy.

Retention and Deletion

Simcha does not create audio recordings or word-for-word transcripts of spoken sessions, so there are none to keep. The retention rules below cover rough summaries of ideas, typed conversation text, notes and other data described in this Policy.

Your data is retained while your account is active so your sessions and notes remain available to you. Selecting Delete my account in the app submits a request to delete the account and associated data Simcha controls. We may verify your identity and, for provider-controlled clinical records, coordinate with the account's Privacy Officer. Deletion requests are processed within thirty (30) days. Records that we are legally or contractually required to keep may be retained only for the required period. You may also request account deletion, or ask about the status of a request at support@simcha.ai.

Not Medical Advice

For personal users, Simcha is a nonclinical thinking space. For providers, Simcha supports documentation and related workflows. Simcha is not a medical device, does not provide medical advice, diagnosis, or treatment, and does not replace clinical judgment. For medical concerns, consult a qualified professional. In crisis? Call or text 988 (Suicide & Crisis Lifeline), or text HOME to 741741.

Age Requirement

The Platform is available only to individuals aged 18 years or older.

Privacy Contact

Questions about this Privacy Policy: support@simcha.ai, or contact support.

Security Practices

Clinician and patient trust is of the highest priority at Simcha AI. We hold ourselves accountable to a HIPAA-compliant data storage and processing protocol for all data captured and shared through our platform.

Internal Personnel Security

Background Checks

All Simcha AI employees are required to undergo background checks before being hired.

Annual Security Training

All Simcha AI employees are required to complete annual security awareness training on HIPAA, privacy, and information classification.

Compliance

Simcha AI conducts regular risk assessments to ensure policies remain up-to-date and relevant.

Secure Development Lifecycle

Software Reviews

All software changes are reviewed for compliance.

Infrastructure Reviews

Simcha AI practices infrastructure-as-code. All infrastructure changes are reviewed before deployment.

Secure Development Training

All engineers complete secure development practices training.

Cloud Hosting and Availability

The service providers and their processing roles are described in AI and Third-Party Processing.

Simcha AI uses Google, Amazon Web Services (AWS) and Microsoft Azure secure data centers and their high-availability infrastructure. Simcha AI has Business Associate Agreements (BAAs) with Google, AWS and Microsoft.

Confidentiality and Data Encryption

All data is encrypted at rest and in transit using standard encryption schemes.

Vendor Management

Vendor BAAs

All vendors who may process patient information are required to be HIPAA compliant and sign BAAs with Simcha AI.

Vendor Security Reviews

Simcha AI regularly reviews vendor security practices to ensure continued high standards.

Artificial Intelligence

AI Models and Data Retention

All AI models are HIPAA compliant and do not retain data.

Training and Protected Health Information

Protected health information is never used for AI training purposes.

Patient Information

Client Data Encryption

Client information is encrypted at rest and in transit.

Client Note Deletion

Client notes can be manually deleted at any time. Account deletion and retention rules are described in Retention and Deletion.

Privacy and Security Questions

Does Simcha record audio?

No. The app does not record audio. Audio recording is not supported by design. No recordings are created or stored, so there is nothing to play back. Simcha listens for the main ideas as you speak. See Listening for the Main Ideas for how this works.

Is this a word-for-word transcript?

No. Simcha makes a rough summary of the main ideas, like a word cloud. It does not copy every word you say. The summary should not be treated as an exact quote or a complete account of the conversation.

Does Simcha identify who is speaking?

No. To protect privacy, Simcha does not identify who is speaking or label ideas with a person's voice. The rough summary is about the ideas discussed, without identifying who said them.

Read the Terms of Use & BAA for the legal agreement, or contact support with a privacy question.