SimplePractice AI and Your Data: What Therapists Should Know

Introduction: The Terms You Never Read

Most therapists never read what their EHR's terms say about their notes — or about their clients' actual words. That was a reasonable gap to have when an EHR was a filing cabinet with a login. It is a harder gap to defend now that AI scribes are mainstream and the question "what happens to the transcript of my session?" is a clinical-ethics question, not just an IT detail.

This is a neutral, sourced walkthrough of SimplePractice AI data practices: how the AI Note Taker handles your sessions, what the published transcript-retention policy actually says (including a change taking effect June 16, 2026), who owns the data and what the Terms of Service grant, and how private-equity ownership reframes data as an asset. Every factual claim is tied to a SimplePractice-owned page or to named journalism, with a date. Where a claim is interpretation rather than documented fact, it is labeled Commentary.

One disclaimer up front: this is general information, not legal advice, and it is not a feature comparison. Terms change. Open the live SimplePractice pages and your own account settings to confirm the current language before you rely on any of it.

How SimplePractice's AI Note Taker Handles Your Sessions

Start with the documented data lifecycle, neutrally, from SimplePractice's own support pages (accessed 2026-06-14). On its face, it is fairly conservative.

• It transcribes; it does not record. According to SimplePractice Support ("Understanding Note Taker" and "Note Taker FAQs"), Note Taker creates a real-time transcript of the appointment. It does not create or store a session recording — only the transcript is generated.
• Audio is deleted immediately. Per the "Transcript retention FAQs," the audio is deleted immediately after the transcript is generated. There is no stored recording to leak, subpoena, or breach.
• The draft requires your review. Per "Understanding Note Taker," a draft progress note is generated from the transcript plus the client's previous progress note, and the clinician is required to carefully review and edit it before it becomes the note of record.
• Where it works. Per SimplePractice's support articles, Note Taker's live telehealth capture works only with SimplePractice's own Telehealth (web and mobile) — not Zoom, Doxy, or other third-party video platforms (see "Using Note Taker with telehealth"). For in-person sessions it is accessed via the SimplePractice for Clinicians app on Apple devices ("Using Note Taker during in-person sessions"), and clinicians can also upload an audio or text file afterward to generate a draft.
• Compliance posture. SimplePractice states on its own pages that PHI will never be sold and is safeguarded in alignment with HIPAA, that it is HITRUST-certified, and — per its blog "What therapists must know about HIPAA-compliant AI note-taking" (published 2025-07-11) — that when you use Note Taker you are already covered under SimplePractice's existing Business Associate Agreement.

Commentary: Read in isolation, this lifecycle is reasonable and, on the audio side, genuinely protective — immediate audio deletion is better than many ambient-scribe tools. The clinician-reviews-the-draft posture is also the right one. The nuance — and the reason this piece exists — is in what changes on June 16, 2026.

The June 16, 2026 Change: De-Identified Transcript Retention

This is the pivot, and it is the one part of the SimplePractice AI data story most clinicians have not seen. The source is SimplePractice's "Transcript retention FAQs" support article (accessed 2026-06-14).

First, the default lifecycle for the transcript itself: the transcript is available for up to 7 days, or until the note is signed and locked, whichever comes first. If the note is not signed within 7 days, the transcript and the draft note are deleted, and you write the note manually. So far, so conservative.

What changes: starting June 16, 2026, after the review period ends, SimplePractice may retain a de-identified and de-coupled version of the transcript to help continue improving Note Taker and other AI-powered features (the FAQ names Care Aide as an example). In plain terms, the text of what your client said in session can become improvement data for the vendor's AI — but only in a de-identified, de-coupled form, and only if retention is enabled.

The controls SimplePractice describes, quoted accurately:

• Retention is optional and granular. You can control it at the clinician, client, or session level.
• The default depends on when you started. Per the FAQ: clinicians who used Note Taker before June 16, 2026 are opted out of retention by default — no action required, and no transcripts are retained unless they choose to opt in. Clinicians who enable Note Taker on or after June 16, 2026 are opted in by default and can opt out at any time. That asymmetry is the single most important thing to check in your own settings: if you are a new user after that date, retention is on unless you turn it off.
• Stated safeguards. Per the same FAQ: once de-identified and de-coupled, the transcript joins a general pool of clinical language data with no link to any individual client, clinician, or practice; SimplePractice states retained transcripts cannot be re-identified; only a small number of authorized, trained team members may access retained data; it is never sold; never shared externally outside SimplePractice's controlled environment; and never used to generate outputs that include portions of past sessions.

Commentary: De-identification is a real, meaningful safeguard, and "cannot be re-identified / never sold / never shared externally" is a strong stated posture. But notice the structure: this is governed by terms the vendor sets, not by a switch you ultimately control. For new accounts after June 16, 2026, your clients' clinical language becomes vendor improvement data unless you actively opt out. That is not an allegation of wrongdoing — it is a description of who holds the lever, and which way it points by default. The honest takeaway is to set those preferences deliberately rather than by default.

Who Owns the Data — and What the Terms of Service Grant

"Who owns my data on SimplePractice?" has two true answers that sound contradictory but aren't.

On the practical side, ownership is real. Per SimplePractice's support article "Exporting client information through data exports," the Account Owner — or a practice manager with data-export permissions — can export data for one client, for all clients, or for all clients of one clinician (group practices). You can get your data out.

On the contractual side, the license is broad. As quoted by Paubox in "Addressing concerns around SimplePractice's terms and conditions" (published 2023-08-30, quoting SimplePractice's Terms of Service §9.2 from the version dated August 2, 2023, and corroborated by the practice-consulting firm Zynnyme), Section 9.2 grants SimplePractice and its affiliates:

"a non-exclusive, worldwide, royalty-free, fully paid-up, perpetual, irrevocable, sublicensable (through multiple tiers), and transferable license to use, reproduce, distribute, prepare derivative works of, perform and display such User Data."

Per the same reporting, the Service Data License survives expiration or termination of the account. For context on how it landed: in roughly August 2023, SimplePractice notified customers they had about two weeks to accept the new terms or be locked out; after customer backlash, SimplePractice extended the acceptance deadline to September 1, 2023 (reported by Zynnyme, quoting SimplePractice's own August 14, 2023 email).

Commentary: "I can export my data" and "they hold a broad, derivative-works license to it" are not in conflict — you keep a copy, they keep a license. And the PHI carve-out ("never sold," HIPAA-safeguarded) genuinely sits alongside, not inside, that broad "User Data" license. Two cautions: do not generalize the "PHI is never sold" statement into "all User Data is never used," and do not assume the 2023 §9.2 wording is still live. We could not confirm whether the August 2, 2023 §9.2 language persists unchanged, was revised, or was removed in the current (2026) terms. The verbatim quote is solidly sourced to the 2023 terms via named journalism — read §9.2 of the live terms yourself before drawing conclusions.

Why Private-Equity Ownership Reframes Data as an Asset

Here is the ownership chain, which most clinicians never see. SimplePractice is a solution of EngageSmart. Per the Vista Equity Partners press release and Business Wire coverage (both dated 2023-10-23), EngageSmart agreed on October 23, 2023 to be acquired by Vista Equity Partners for $4.0 billion ($23.00 per share in cash). On completion, Vista held approximately 65% and General Atlantic approximately 35% of the equity; the deal closed in January 2024 (Business Wire, 2024-01-26). The Vista press release names SimplePractice among EngageSmart's solutions.

Commentary (documented chronology): The broadened §9.2 User Data license (terms dated August 2, 2023) preceded the acquisition announcement (October 23, 2023) by about two months. Some therapist commentators — for example, Robin Levick, LMFT (robinlevick.com, published 2026-04-02) — have connected the two events. Present this as exactly what it is: a documented sequence plus attributed opinion. It is not proven causation, and nothing here alleges that SimplePractice did anything illegal.

Commentary (industry pattern, not a specific accusation): Private-equity software investment theses generally prize two things — recurring subscription revenue and durable, licensable, transferable data assets. A perpetual, irrevocable, transferable, survives-termination data license is precisely the kind of asset that can travel in a change-of-control. That is a general pattern across enterprise software, not a claim about any particular SimplePractice plan to monetize transcripts.

Which is the real point: ownership can change, and management can change. What actually protects you over a five- or ten-year practice is not this quarter's policy page — it is whether the data commitments are contractual and built to survive change-of-control.

The Care-First Alternative: Commitments That Survive Change-of-Control

This is where CoralEHR's posture differs, stated conservatively and only to what is verified.

CoralEHR's AI drafts suggestions that the clinician reviews and signs. The AI does not make diagnosis or treatment decisions. It is built on Anthropic's first-party API, and patient data is not used to train models. CoralEHR is HIPAA-compliant and signs Business Associate Agreements. (For the record, CoralEHR does not claim SOC 2 — the relevant commitments here are HIPAA and a signed BAA.)

The differentiator is structural, not rhetorical: CoralEHR's data commitments are designed to be contractual and to survive change-of-control — the opposite of a policy a future owner can quietly revise. A note on vendor naming, for accuracy: CoralEHR's own use of Anthropic's first-party API is verified. SimplePractice describes Note Taker only as "powered by artificial intelligence" on its own pages; it does not name a specific AI vendor there, so we do not attribute one to SimplePractice as fact.

That is the whole pitch, and it ends here — because this is an explainer, not an ad. If you want the side-by-side, see SimplePractice vs CoralEHR and the SimplePractice alternatives hub.

What to Actually Do

Concrete, vendor-neutral steps any therapist can take today — these apply whether you stay on SimplePractice, move to CoralEHR, or use something else entirely:

1. Read two documents before you consent to any AI scribe: your EHR's AI/Note Taker data-retention FAQ, and the "User Data" license section of its Terms of Service. On SimplePractice that is the "Transcript retention FAQs" and ToS §9.2.
2. Set transcript-retention preferences deliberately. SimplePractice lets you control retention at the clinician, client, or session level. Remember the asymmetry: clinicians who used Note Taker before June 16, 2026 are opted out by default, but anyone who enables Note Taker on or after that date is opted in by default. If you opened your account recently, assume retention is on until you confirm otherwise.
3. Get informed client consent for AI scribing. This is a clinical and, in some states, a recording-consent obligation. For how to disclose it without losing trust, see How to Tell Clients You Use AI for Notes.
4. Know your export path — and test it. Run a real export now, while you are happy, so you can actually leave if terms change. On SimplePractice, that is the Account Owner / permissioned-practice-manager export. See also how to switch EHRs without losing patient data.
5. Re-check the terms after any ownership change. A change-of-control is the moment a "revisable policy" can quietly become something else — and the moment "is this a contractual commitment that survives change-of-control?" stops being abstract.

Conclusion: Policy You Can Read, or Commitment That Survives

The honest summary: SimplePractice's documented AI data lifecycle is, for the most part, conservative — audio deleted immediately, transcript not stored as a recording, drafts that require clinician review, PHI stated never to be sold, and HITRUST certification. The two real watch-items are (1) the June 16, 2026 de-identified transcript retention change and its split default (existing users opted out, new users opted in), and (2) the broad, survives-termination "User Data" license in the Terms of Service. And private-equity ownership is exactly why the framing question matters: is this a contractual commitment that survives change-of-control, or a policy the vendor can revise?

For a deeper, practice-model lens on choosing or switching, read our guide to SimplePractice alternatives for private-pay therapy, and if you are building an intake-and-outcomes workflow, start with a validated screener like the PHQ-9 depression assessment.

This article is general information for therapists and practice owners, not legal or financial advice. Verify all SimplePractice policy and terms language directly on SimplePractice's own current pages before relying on it.