Trust, data and governance
What happens to your clients' data
Your client data sits on UK infrastructure. Flutura staff do not access session audio, and your client data is never used to train any AI model.
For security and data protection questions, contact us at support@flutura.appWhere your data is held
In the UK. All Flutura infrastructure runs in Amazon Web Services' London region.
That covers the application you sign into, the database holding your records, your account data, session recordings, transcripts and the notes made from them.
All of it encrypted in transit and at rest.
Session audio and transcripts are processed outside the UK only during transcription and while a note is drafted. The next section says by whom and under what terms.
Who else touches it
Under UK GDPR, any company that handles your client data on Flutura's behalf is a processor, and you are entitled to know what each one does with it. Four do.
Cloud infrastructure, UK. Runs the application, session recordings, transcripts and the processing queue in its London region. Kept for as long as your account is open. Infrastructure only, with no access to content.
Database hosting, UK. Holds your client records, notes and account data, also in London. Kept for as long as your account is open. Database hosting only, with no access to content.
Transcription, United States. Receives session audio and turns it into a transcript. Keeps the audio for up to 72 hours, then deletes it automatically. SOC 2 certified and contractually barred from training on your data.
Note drafting, United States. Receives the transcript and drafts your note from it. Keeps the transcript for up to 30 days, then deletes it. Works under a data processing agreement and does not use your data for training.
During transcription your session audio is processed in the United States. During note synthesis the transcript is. Both sit under data processing agreements and the UK GDPR rules governing international transfers. Account holders and institutions can have the named list of processors on request, at support@flutura.app.
Who can see what
Your session recordings are accessible only to you, through your authenticated account. Flutura staff do not access session audio.
You see your own clients and nothing else: their records, their sessions, and the notes you have reviewed and signed. No other therapist using Flutura can see any of it.
Your clients see only what belongs to them. The exercises you have assigned, their own diary, their own mood entries. They cannot see your notes.
There is an administrator role for running the platform. It has no access to session audio.
Every action taken in an account is logged, and the log is kept for as long as your account is open.
What we never do with it
Your client data is never used to train any AI model, ours or anyone else's. That holds for the companies who process it, by contract.
It is never sold. It is never shared for advertising. It is never used for anything other than providing the service.
Flutura measures how the product is used, not what is said in a session.
Who is responsible for what
You are the data controller for your clients' data. Where an institution holds the licence, that responsibility is theirs. Flutura is the processor in both cases, acting on the controller's instructions.
Your clients can make a subject access request, or ask for their data to be corrected or erased, at any time. Flutura handles those requests as standard, including the right to erasure under Article 17 of UK GDPR.
Flutura is registered with the ICO, reference ZB870821. You can check it on the public register.
If you leave, or if we stop
You can export your data whenever you want, from Settings. Flutura packages your client records and your account data into a single download, and emails you the link. The link stays live for 7 days. Session recordings are not included in the export; they remain available in your account for as long as it is open.
If you close your account, you have 30 days. During that time you can still sign in to export your data, or to change your mind. After that, write to support@flutura.app and everything is permanently deleted: recordings, transcripts, notes, client records and account data.
If Flutura ever stops operating, every account holder gets 90 days' notice by email. Export works throughout that period, and for 30 days after the service ends.
For security and data protection questions, contact us at support@flutura.app