Security, Privacy & Support

How Your Data Is Stored

On the US service, account authentication runs on Amazon Cognito. Database storage uses AWS RDS and files use AWS S3, under our HIPAA Business Associate Agreement with AWS. Access is account-based and scoped in application code so users only reach their own workspace.

Connections to the service use HTTPS encryption. Audio files and other saved materials are stored in AWS S3 rather than on your local device only, so a lost laptop or crashed browser does not remove your workspace data.

Designated sensitive client fields — including clinical, intake, consent, and session-note content — are additionally encrypted at the application layer using AES-256. Stored third-party access tokens and integration secrets use the same encryption control.

Access Logging

Covered client-record actions are recorded in a tamper-evident audit log, including views, creation, edits, deletion, and export workflows. The system records the actor, action, and time without copying clinical field values into the log. Entries cannot be edited or deleted through the app, and database controls block updates and deletion.

Payments And Card Details

Subscription payments for Hypno Admin Pro are processed by Stripe. Hypno Admin Pro stores subscription status and related Stripe identifiers so your account can be managed, but it does not store your card details.

Optional client session payments use Stripe Connect: when you connect Stripe in booking settings, clients can pay for paid bookings by card. Those payments are processed by Stripe and paid out to your connected Stripe account — Hypno Admin Pro does not hold client session fees.

AI Processing

AI features use OpenAI to process prompts and generate draft content. Hypno Admin Pro is designed so the practitioner stays in control: you review, edit, and approve any AI output before using it with clients.

Do not include identifiable client information in AI prompts unless you have a proper professional basis for doing so. In normal use, client names and private session notes do not need to be included in prompts.

Account Protection

Users can enable two-step verification with an authenticator app from the dashboard security settings. The dashboard also signs users out after a period of inactivity to reduce the risk of an unattended session staying open.

Data Breach Preparedness

Security is handled as an ongoing responsibility, not a one-time claim. Serious security or privacy incidents are handled under a written response plan, including containment, evidence preservation, breach assessment, and required notifications. Cyber-insurance scope and response contacts are being confirmed before broad US availability.

Security and privacy enquiries for the US service, including suspected incidents, go to info@hypnoadminpro.com (Security & Privacy Officer). US practitioners with a signed BAA will receive breach notifications per that agreement.

HIPAA-Aligned Security Practices

Hypno Admin Pro follows HIPAA-aligned security practices: encryption of sensitive data at rest, encrypted connections, account-based access controls, a tamper-evident access log, and Business Associate Agreements for approved services that handle data on our behalf (including AWS and OpenAI). Optional customer-connected services require separate account and agreement review.

To be clear about the boundary: this means the platform is built with HIPAA-aligned safeguards — it is not independently certified as “HIPAA compliant,” and it is not marketed as a HIPAA medical-records system. HIPAA compliance is a shared responsibility, so practitioners remain responsible for using the platform in a way that fits their own professional, legal, and regional obligations.

Support Policy

During the MVP stage, support is handled directly by email at info@hypnoadminpro.com. We aim to respond within 1-2 working days, with urgent access or billing issues prioritized where possible.

This is an actively maintained product. Bugs, support requests, and practitioner feedback are reviewed directly and used to guide improvements.

Responsible Disclosure

We welcome responsible disclosure of genuine security issues. If you believe you have found a vulnerability, please email the details and clear reproduction steps to info@hypnoadminpro.com and allow reasonable time for it to be reviewed and resolved before any public disclosure.

Hypno Admin Pro does not operate a paid bug bounty program and does not offer monetary rewards for reports. Please do not access, modify, or delete data that is not your own, and do not run automated scanning that could disrupt the service for other users.

More Detail

For the full legal privacy wording, including data types, retention, third-party services, read the Privacy Policy.