Your private, intelligent notebook.
Bring your best to every session.
Capy picks out important client details from your sessions. You choose which facts to keep.
Capy turns your session into a clinical note and summary, in your style. Review, edit, and copy.
Client described increased grief as the anniversary of her mother’s death approaches. Explored how withdrawing from support affects her mood and practiced grounding. Client identified her sister Maya as someone she can reach out to this week. Will revisit grief and connection next session.
Grief is resurfacing as the anniversary of her mother’s death approaches.
Goal: Navigate grief with greater steadiness and connection.
Capy prepares follow-ups from your last session. Revisit your prep and edit anything.
None.
Add, resize, and rearrange your cards. Make the titles and prompts your own.
Your clients trust you with a lot. The details of protecting it matter.
Your private notebook. Your choice of video platform and EHR.
Set your Mac nearby and stay present. Capy captures the conversation while you focus on your client.
Keep the video calls you already use. Capy captures your microphone and call audio on your Mac—even with headphones.
Logos identify example platforms; HIPAA use depends on your provider agreement and configuration. All trademarks and logos belong to their respective owners. Their display does not imply endorsement, sponsorship, partnership, or a direct integration with Capy Therapy.
Subscription
One-time purchase. No subscription.
Apple Silicon · macOS 26 or later · Version 2026.0.21
Capy Therapy | AI-assisted session documentation
Therapist: ________________________ Practice: ________________________
Your therapist uses Capy Therapy, provided by Secero Inc., to help prepare session notes, summaries, action items, and relevant details about your care. This helps your therapist spend less time documenting and more time focusing on you. AI can make mistakes. Your therapist reviews its output and remains responsible for your care and clinical record.
Capy Therapy transcribes session audio on your therapist's Mac, including both sides of remote sessions, without saving an audio recording. Relevant text, which may include sensitive health information, is sent securely through AWS to OpenAI for AI processing.
Capy Therapy is designed to support HIPAA-compliant documentation through encryption, access controls, and business associate agreements. Applicable AWS and OpenAI services operate under these agreements with Secero Inc. Your information remains subject to your practice's confidentiality policies and applicable law. No technology can guarantee complete security.
This consent does not authorize advertising, sale of your information, or AI model training.
Transcripts are scheduled for deletion from the app within 30 days after a session ends, or sooner. If the account is closed when a transcript expires, deletion occurs when it next opens. Notes and other clinical records are retained separately under your therapist's recordkeeping policies. Exports, backups, and cloud-provider retention follow separate policies.
Using Capy Therapy is optional. You may decline, ask to pause, or withdraw consent at any time by telling your therapist, without losing access to treatment. Your therapist can document your care without this tool. Withdrawal stops future processing but does not undo completed processing or erase records your therapist must retain.
I have read this form, had the opportunity to ask questions, and consent to the audio processing, transcription, and AI-assisted documentation described above for my sessions until I withdraw consent.
This form supplements your practice's privacy notices and does not replace other legally required permissions.
Client name: ________________________________________ Client or authorized representative signature: ______________________________ Date: ______________________________________________ If signed by a representative, name and authority: ____________________________________________________
Capy Therapy | Version 2026-10-08.1
This agreement is between Secero Inc. (Business Associate) and the therapist or practice identified in the acceptance record (Practice), acting as a HIPAA covered entity or as a business associate of a covered entity. It supplements the Capy Therapy service terms and takes effect when Practice electronically accepts it. Secero Inc. offers and agrees to these terms upon that acceptance. HIPAA means the Health Insurance Portability and Accountability Act, HITECH, and applicable regulations at 45 CFR Parts 160 and 164, as amended. PHI, breach, security incident, and other HIPAA terms have their regulatory meanings. This agreement covers PHI handled by Business Associate for Practice through Capy Therapy.
Business Associate may create, receive, maintain, use, or transmit PHI only to provide Capy Therapy's transcription and AI-assisted clinical documentation services to Practice, to fulfill this agreement, or as required by law. It will limit PHI to the minimum necessary where required by HIPAA. It will not otherwise use or disclose PHI, including for advertising, sale, or training general-purpose AI models. It will not use or disclose PHI in a way that would violate the HIPAA Privacy Rule if done by Practice.
Business Associate will implement appropriate administrative, physical, and technical safeguards and comply with the HIPAA Security Rule for electronic PHI. It will restrict access to authorized personnel and protect clinical data with encryption in transit and at rest where maintained by the service.
Capy Therapy transcribes session audio on the Mac without saving an audio recording. Selected text is processed by cloud AI services. The app schedules local transcript deletion within 30 days after session completion, or sooner under Practice's settings; overdue deletion runs when the account next opens. Other clinical records, exports, and backups have separate retention. These product settings do not reduce Business Associate's obligations under this agreement or establish a blanket guarantee of zero provider retention.
Business Associate uses AWS and OpenAI under business associate agreements for applicable services. Before any subcontractor creates, receives, maintains, or transmits PHI on its behalf, Business Associate will obtain a written agreement imposing the same applicable restrictions, safeguards, and duties, including Security Rule compliance. It will use only appropriately configured services covered by those agreements for PHI processing.
Business Associate will report to Practice any unauthorized use or disclosure of PHI, any security incident, and any breach of unsecured PHI of which it becomes aware, without unreasonable delay. Breach notice will in no event exceed 60 calendar days after discovery, or any shorter period required by law. Notice will include affected individuals when known, the nature and dates of the event, the information involved, mitigation and corrective steps, and a contact for follow-up. Missing details will be supplied promptly as learned. Business Associate will mitigate known harmful effects to the extent practicable and cooperate with Practice's response and notification duties.
Business Associate will provide Practice timely access to PHI in its possession, including information in a designated record set, to support Practice's obligations under 45 CFR 164.524. It will make PHI available for amendment and incorporate amendments as directed under 164.526. It will document disclosures and provide information needed for an accounting under 164.528. Assistance will be provided in time for Practice to meet applicable deadlines; individual requests received directly will be promptly referred to Practice. Business Associate will not independently deny an individual's request.
When performing any Privacy Rule obligation for Practice, Business Associate will comply with the requirements that apply to Practice in performing it. It will make relevant internal practices, books, and records available to the Secretary of the U.S. Department of Health and Human Services for HIPAA compliance review.
Practice will obtain any legally required consent or authorization for audio processing and PHI use, give required privacy notices, and tell Business Associate about relevant restrictions, changes in permission, or revocations. Practice will not request an unlawful use or disclosure. Practice controls its devices, authorized users, exports, and medical-record retention, and reviews AI output before relying on it. This agreement does not itself establish either party's overall HIPAA compliance or authorize disclosures requiring a separate legal permission.
This agreement continues while Business Associate handles PHI for Practice. Practice may terminate the affected services and this agreement for a material violation by Business Associate; Practice may allow a reasonable opportunity to cure but need not do so when cure is not possible. Either party may end the services under the service terms.
On termination, Business Associate will return or, at Practice's direction, destroy PHI it and its subcontractors still maintain for Practice and retain no copies where feasible. If return or destruction is infeasible or prohibited by law, it will inform Practice of the reason, continue these protections, and limit further use and disclosure to the purpose that prevents return or destruction. It will return or destroy that information when the reason ends. These duties survive termination. Practice remains responsible for records on its own devices and in its exports.
This agreement controls over conflicting service terms concerning PHI. The parties will amend it as needed to comply with applicable law, and interpret ambiguity consistently with HIPAA. It does not grant rights to third-party beneficiaries. Notices to Business Associate may be sent to info@secero.io; notices to Practice may be sent to the account contact. Do not include patient information in an ordinary email notice.
The accepting person confirms that the Practice named in the acceptance record is the legal contracting party, that they are authorized to bind it, and that selecting Accept Agreement constitutes their electronic signature. The version, exact agreement text, Practice name, signer's name, account identifier, and server-recorded acceptance time form the acceptance record. A copy is available for download in Settings. Acceptance records contain no patient content and are retained for legal compliance after account closure.
Practice: ________________________ Authorized signer: ________________________ Status: Not yet accepted
Audio is transcribed on your Mac. Relevant text is sent securely through AWS to OpenAI to generate your clinical notes and other session content.
Business Associate Agreements (BAAs) set out how providers may handle protected health information. HIPAA eligibility also depends on the specific service and its configuration; a BAA alone does not establish compliance.
Capy’s generation service deletes input after normal completion or recovery. Temporary results and abandoned input have a one-day cleanup policy. Access to a generation job ends after 24 hours; physical deletion is asynchronous.
AI-provider retention is governed separately by the applicable agreement and account configuration. This is not a promise of immediate deletion from every provider.
This temporary processing is distinct from your encrypted notebook and its encrypted backup. The key protecting your saved notebook remains under your control.
Secero Inc. | Verified November 7, 2026
Capy Therapy is designed to support HIPAA-regulated clinical workflows through protected clinical records, authenticated access and business associate agreements.
Secero maintains an active AWS Business Associate Addendum, effective October 3, 2026, and an executed OpenAI Business Associate and Healthcare Addendum dated October 12, 2026. OpenAI confirms active HIPAA compliance support for the covered organization. Capy Therapy provides a business associate agreement for participating practices.
Clinical notebooks use AES-256 authenticated encryption. Local notebook keys are protected by the macOS Keychain and native user authentication. Cloud clinical storage is encrypted and private, and information is transmitted over encrypted HTTPS connections. Clinical API access requires authenticated sessions with account-scoped authorization.
Session audio is transcribed on the Mac. Selected clinical text is processed through the cloud AI workflow under the applicable agreements. OpenAI data sharing for model improvement is disabled. AI-generated content is provided for clinician review.
Security logging records administrative activity, clinical storage access and clinical API request metadata. Delivery and integrity checks passed for the reviewed audit records. Recovery tests verified encrypted-record restoration after loss of the original local key and rejection of corrupted backup data.
Practices execute the Capy Therapy BAA, manage authorized users and devices, safeguard recovery material and exported records, and apply their required clinical-record retention policies. The signed BAA governs each party's responsibilities.
Security inquiries and confidential supporting evidence: info@secero.io
