Some do, some don't. As of June 2026, SimplePractice retains de-identified session transcripts by default to improve its AI features, and Mentalyc anonymizes sessions to train its models. Others — including Nabla and Eclio — don't train on your data at all. Always read the terms before you record.
Which AI scribes train on your session data?
The practice is more common than most therapists realize. The key question isn't whether a tool is "HIPAA compliant" — it's whether your sessions are used to improve the vendor's AI, and whether that happens by default or only with your explicit opt-in.
| Platform | Trains AI on your data? | Default setting | Notes |
|---|
|---|---|---|---|
| SimplePractice (Note Taker) | Yes — retains de-identified transcripts | **On by default** (opt-out) | Announced June 2026, effective June 16, 2026 |
|---|---|---|---|
| Nabla Copilot | No training on patient data | N/A | ~14-day retention, then deleted |
| Eclio | **Never** | N/A | You keep full ownership; no model training, ever |
What SimplePractice actually announced
In a June 2026 email to users, SimplePractice wrote that starting June 16, 2026 it would "begin retaining session transcripts that are de-identified… and de-coupled from any connection between the clinician and the client." The stated goal: "to continuously improve existing and upcoming AI features." For Note Taker users, retention is enabled by default, with opt-out options.
Why "de-identified" doesn't fully solve it
De-identification strips the 18 HIPAA Safe Harbor identifiers (name, email, dates…). But the clinical content of a session — what was said, the emotional arc, the themes — is still being fed into a model. For many therapists, that's the part that feels like a breach of the therapeutic frame, identifiers or not. (More on this in Is de-identified therapy data really anonymous?.)
How to check if a tool trains on your data
- Search the Terms of Service for "license," "derivative works," and "improve our services."
- Search the Privacy Policy for "train," "model," and "machine learning."
- Check whether data use is opt-in or opt-out — opt-out by default is a red flag.
- Confirm what happens to your data after you cancel. (See GDPR for therapists storing notes abroad.)
A 2023 FTC settlement fined BetterHelp $7.8 million for mishandling sensitive mental-health data (FTC, 2023) — proof that "we're compliant" claims don't always hold up.
Where Eclio stands
Eclio never trains any AI model on your sessions, notes, or client data — not anonymized, not "de-coupled," not ever. You retain full ownership of every note, and you can delete everything permanently at any time. We're also building the first commercial local AI scribe, where transcription and note generation run entirely on your computer so data never reaches a server in the first place.