HIPAA & Privacy Notice
This notice explains how KeepAir handles health-related information and what therapists and couples should know about it.
Purpose of this notice
This page describes the safeguards KeepAir provides for sensitive relationship and health information, and the limits of what the platform itself can promise.
Who is responsible
KeepAir is a software platform. Treating therapists decide whether their use of KeepAir fits their obligations under HIPAA and applicable law; the practice remains responsible for its own compliance programme and notices.
Client-side encryption
Relationship, mood and health entries are encrypted on the user's device. The server stores only encrypted envelopes plus limited metadata such as timestamps and recipient identifiers, and has no key material to decrypt them.
What the server can and cannot see
KeepAir's server stores only encrypted envelopes plus limited metadata such as timestamps, entry types and recipient identifiers; it holds no key material to decrypt them. Sharing is per item and revocable, and nobody at KeepAir — support or administrators — can read an entry. Two limits belong to this promise: metadata stays visible to the server, and a recipient who has already opened a shared entry may keep a copy on their own device.
Consent per data item
Access is granted per data item. Each partner controls what is shared with the other partner or with a therapist, and can revoke access again.
Data minimisation
KeepAir does not ask for diagnosis codes, insurance identifiers or claims data. Only what a guided exercise needs is collected, and nothing is stored in plaintext on the server.
Business associate agreements
Where a therapist or practice needs a business associate agreement, the practice and the operator of this deployment must put one in place before using KeepAir with protected health information.
Access and deletion
Users can access, export and delete their data from within the app, and can ask their therapist about information kept in a shared space.
Security incidents
Suspected security incidents should be reported to the operator of this deployment or the therapist's practice without delay so that any notification duties can be assessed.
Contact
For privacy questions, contact the operator of this deployment or the practice that invited you.
Last updated: September 2026