Built for sensitive data.

Grovvve holds clinical records. Everything on this page is in place today, not on a roadmap.

Grovvve is not a HIPAA business associate and does not sign Business Associate Agreements. Our compliance framework is the UK and EU GDPR.

In place today

Encryption in transit and at rest

All traffic runs over TLS 1.2+. Data at rest is encrypted with AES-256 by our database and storage providers.

Tenant isolation

Every database read and write is scoped to the signed-in practitioner and enforced with Postgres Row Level Security. One therapist cannot reach another therapist’s data.

Deleted. Immediately.

Your recordings don’t sit on our servers. Once your note is generated, the recording is permanently deleted.

Your data is never used to train AI models

Note text is sent to our AI sub-processors solely to produce your draft, under contracts that prohibit training on it.

A Data Processing Agreement, accepted in-app

You are the data controller; Grovvve is the processor. The DPA is presented at signup, so there is no separate request process.

Export and deletion on request

Your records belong to you. You can export your data and ask us to delete your account and its contents.

Sub-processors

These are the third parties that may process personal data on your behalf when you use Grovvve. The same list appears in the DPA and the Privacy Policy. It is generated from one source, so the three cannot drift apart. Where a cell is blank, we are still confirming that detail contractually rather than guessing at it.

  • Supabase Inc.
    What it processes
    Database, authentication and file storage: client records, session notes, session-note images, account data
    Region
    EU (Frankfurt)
    Transfer mechanism
    No transfer: data remains in the EEA
  • Vercel Inc.
    What it processes
    Application hosting and delivery
    Region
    Not yet confirmed
    Transfer mechanism
    Not yet confirmed
  • Anthropic PBC
    What it processes
    AI session-note generation: processed under terms prohibiting retention and model training
    Region
    Not yet confirmed
    Transfer mechanism
    Not yet confirmed
  • Groq, Inc.
    What it processes
    AI inference for note generation: same retention and training prohibitions
    Region
    Not yet confirmed
    Transfer mechanism
    Not yet confirmed
  • Daily.co (Pluot, Inc.)
    What it processes
    Telehealth video sessions: media is relayed, not recorded by Grovvve
    Region
    Not yet confirmed
    Transfer mechanism
    Not yet confirmed
  • Resend, Inc.
    What it processes
    Transactional email: appointment reminders, invoices, secure-message notifications
    Region
    US (N. Virginia)
    Transfer mechanism
    Standard Contractual Clauses
  • Stripe, Inc.
    What it processes
    Card payments and payouts. No clinical data is transmitted to Stripe
    Region
    Not yet confirmed
    Transfer mechanism
    Not yet confirmed
  • Paddle.com Market Ltd.
    What it processes
    Subscription billing and merchant of record. No clinical data
    Region
    Not yet confirmed
    Transfer mechanism
    Not yet confirmed
  • Rapyd Financial Network Ltd.
    What it processes
    Practitioner payouts in supported regions. No clinical data
    Region
    Not yet confirmed
    Transfer mechanism
    Not yet confirmed
  • Google LLC
    What it processes
    Calendar synchronisation, for practitioners who connect a Google account
    Region
    Not yet confirmed
    Transfer mechanism
    Not yet confirmed

We will give notice before adding a new sub-processor. To be told when this list changes, email privacy@grovvve.com.

Documents and contact

Data Processing AgreementPrivacy PolicyTerms of ServiceGDPRPlatform Disclaimer

Security questions, or reporting a vulnerability: security@grovvve.com. Data protection and subject access requests: privacy@grovvve.com.