Privacy Policy
Last updated: 16 August 2026
This explains what PsychPracticum collects, where it goes, and how long we keep it. PsychPracticum is operated by Philip David Wood Jr.
Start here. Every patient in this product is invented, so every interview is a practice conversation with a fictional character and nobody's medical information is involved. What we hold is your account, your own work, and technical usage data. That is why this policy is short.
Two things worth knowing up front. We record your screen while you use the product, and we send what you write to AI providers so the patient can reply and the feedback can be generated. We sell none of it.
1. What we collect
Your account. Your email address and name are required. Your display name, professional title, credentials, background, year you began practising, and institutional affiliation are optional and can be left blank. We store an identifier from our authentication provider so we can recognise you. We do not store your password. We record when you last signed in.
What you write. Every message you send to the simulated patient, along with the patient's replies. Your notes on the transcript. Your diagnostic formulation, differentials, case conceptualization, follow-up notes, and any treatment plan you enter. Any feedback you write on an evaluation, including your reasoning and comments. Any note you attach when flagging a patient response, and the alternative response you suggest. If you use voice input, a transcription of what you said word by word, kept as first dictated even if you edit it afterwards.
What we derive from what you write. An automated safety classification of each message you send, with the model's verdict and confidence. A model-written summary of your interview. A copy of your transcript and formulation inside each evaluation record, so a score stays reproducible after the fact. These are additional stores of your content and we keep them on the same terms.
Technical and usage data. Which pages you visited and when, how long a session ran, how many messages it contained, which buttons you pressed, and errors your browser hit. How many tokens each AI call consumed and what it cost. Your IP address and browser, collected by our hosting and analytics providers in the ordinary course.
Other people's email addresses. If you invite someone to your organization, we store the address you entered so the invitation can be sent and tracked.
What we do not ask for. Health information about you or about anyone else. The patients are invented, our terms forbid entering a real one, and if it arrives anyway we remove it on request (Terms §4). We collect no payment details, because the product does not currently charge.
2. Screen recording
We record your screen while you use PsychPracticum, using PostHog session replay.
The recording captures what you type in the interview itself: your messages to the patient, your diagnostic formulation, and your working hypotheses, as you type them, including text you delete before submitting.
Some fields are deliberately excluded from the recording, and stay excluded even though we hold their contents in the database. Your private notes on a session. Anything you write reviewing an evaluation. The notes and suggested responses you attach when flagging a patient reply. Passwords are excluded everywhere, always.
We do this because PsychPracticum is run by one person, and watching where people get stuck is the only practical way to find usability problems. We leave the typing visible because the interviews are with invented patients, so what you write is your own clinical reasoning about a fictional case. The recordings are stored by PostHog in the United States and are visible to us.
Recording starts when a page loads, before you sign in, and it runs on our public pages too. If someone sends you a link to a shared session and you open it without an account, that visit is recorded as well.
3. Who we send it to
We use the following providers. Each receives only what it needs.
| Provider | What it receives | Where |
|---|---|---|
| Clerk | Your email, name, and sign-in activity | US |
| OpenAI | Your interview messages and transcript, to generate patient replies and evaluation feedback | US |
| Anthropic | Each message you send, for a safety check, and your full transcript, to summarise a case | US |
| Deepgram | Your audio, if you use voice input | US |
| Amazon Web Services | Everything stored in our database, in the us-east-1 region | US |
| Vercel | Runs the web front end, which reads and renders your transcripts, notes, and formulations | US |
| PostHog | Your account details, usage events, and screen recordings | US |
OpenAI and Anthropic both state that data sent through their APIs is not used to train their models, and both delete API logs after a short retention window. Their current terms govern; we link them here so you can check for yourself: OpenAI · Anthropic.
Inside the product, your sessions can be read by supervisors and colleagues assigned to the same lab as you, by supervisors of your organization, by anyone holding a share link (which works without an account, and which a supervisor can create as well as you), and by us. "Us" includes the operator and the calibration accounts we use to keep the scoring honest; both can reach any session on the platform. We may disclose data if the law requires it, and we would transfer it if the product were ever sold.
We do not sell your personal information and we do not use it for advertising.
4. How long we keep it
We retain what you write, indefinitely. Sessions, transcripts, notes, formulations, and feedback stay in the system for as long as PsychPracticum exists. They are the record of your training, the material supervisors review, and the reference material we use to test and calibrate the judges. We would rather tell you that plainly than imply a clean-up that does not happen.
Deleting a session hides it and keeps the record. The product marks it deleted, the transcript stays in the database, and the session still counts against your session limit.
We do not delete accounts. If you stop using PsychPracticum, your account and its sessions stay as they are. There is one exception, and it runs the other way: if real patient information is entered by mistake, tell us and we remove it from the database and delete any recordings that captured it (Terms §4).
Screen recordings are the exception, and they are not kept indefinitely. They sit with PostHog on their own schedule, separate from our database: a recording is deleted 30 days after it is captured. Deletion runs on a rolling basis, so a recording may linger briefly past that point. Usage events are configured to be retained for 12 months.
That means the recording of a session outlives neither the session nor its transcript. After 30 days what remains is what you wrote, in our database, described above.
5. Your choices
Email support@psychpracticum.com and we will, within 30 days:
- tell you what we hold about you;
- give you a copy of your sessions;
- correct anything that is wrong.
You can also ask us to delete the screen recordings of your sessions, and we will.
Deletion is the one thing we do not offer, with the single exception in section 4 above: real patient information entered by mistake. Section 4 also says why, and it applies to everyone equally.
If your account was set up for you by an organization, ask them first, since they may need to act on their side as well.
We honour these requests regardless of where you live, and regardless of whether a privacy law requires us to.
6. Research studies
We use your sessions to run and improve the product, including as reference material for testing and calibrating the judges. Our Terms of Service describe that in full.
Research studies are separate. If you take part in one, that study's consent form governs what happens to your data for research, and the researcher running it is responsible for it. Accepting this policy does not enrol you in a study.
7. Security
Traffic between your browser and our servers is encrypted, and the database is encrypted at rest. Access to the production database is limited to the operator. Authentication is handled by Clerk rather than by us, so we never hold your password.
PsychPracticum is run by one person, without a security team, formal certification, or a SOC 2 report.
If your data is ever exposed in a way that puts you at risk, we will email you at the address on your account. We will do it as soon as we reasonably can after confirming what happened, and in any case within 30 days. Some state laws set a shorter deadline, and where one applies we follow it instead. We will tell you what happened, what was involved, and what we are doing about it, and we will notify whichever authority the law requires. If your account was set up by an organization, we will tell them too.
8. Children
PsychPracticum is for practising and training clinicians. It is not for anyone under 18, and we do not knowingly collect data from children.
9. Changes
We will post any change here with a new date. If a change materially affects what we do with your data, we will ask you to accept the new version when you next sign in.