SLPcentral

For districts and schools

Trust & security for districts

SLPcentral is used by school-based speech-language pathologists to log session data and draft notes and progress reports. This page is for the people who approve tools like it: where student data lives, who processes it, how long it is kept, and how to get your agreement signed.

  • Clinical data: US-only, under signed BAAs

    Clinical records are stored in Google Cloud under a signed HIPAA Business Associate Agreement, US only. AI drafting runs on Anthropic’s Claude under a signed BAA, with US-only processing.

  • Names stay on the device by default

    Our servers hold a random code like CLT_4X2K for each student, not a name. The AI is given the code, never the client name fields.

  • Drafts, not decisions

    Ollie drafts and suggests from the data the SLP logged. Nothing is saved or sent until the SLP reviews it and taps Save.

  • Your agreement, signed

    Send us your district’s student data privacy agreement at privacy@slpcentral.app. We’ll review it and sign it with you.

Where data lives

Clinical records

Clients (as random codes), goals, session data, notes, reports, calendar and hours are stored in Google Cloud under a signed HIPAA Business Associate Agreement, US only (us-east4, Northern Virginia). The database has no public internet address.

AI drafting and the assistant, Ollie

Drafting runs on Anthropic’s Claude, called only from our server, under a signed Business Associate Agreement with US-only processing. Anthropic receives text with student codes, never client name fields, and does not train on our data.

Accounts and billing

Logins, profiles and subscription status are kept with Supabase in the US. No clinical records are kept there.

Names on the device by default

When an SLP adds a student, our server stores a random code (like CLT_4X2K), not a name, initials, birthdate or school. The name is kept on the SLP’s own device: the iPhone’s encrypted Keychain, or that browser’s storage. An SLP can choose to sync names across their own devices; synced names are stored with an extra layer of encryption in the same Google Cloud environment, and are never sent to AI.

Free text is the SLP’s responsibility. A name typed into a goal, a note or a Brain Dump could reach the AI, so the app warns when typed text matches a student’s name, and our server checks each AI request for anything that looks like a name and refuses it. That check is a backstop, not a guarantee.

Safeguards

  • Clinical records (clients, goals, data, notes, reports, calendar, hours) are stored in Google Cloud, in the US only, under a signed HIPAA Business Associate Agreement with Google.
  • The database has no public internet address. Data is encrypted in transit and at rest, and every account can only see its own records.
  • Client names and details stay on your device unless you turn on name sync. If you do, they are stored with an extra layer of encryption.
  • AI never receives your client name fields. Drafting (Anthropic’s Claude, under a signed Business Associate Agreement, US only) sees a random code like CLT_X92J.
  • Brain Dump audio is transcribed and then deleted. The app does not record therapy sessions. (A voiceprint is itself a HIPAA identifier.)
  • Every access to a clinical record is logged (who and when, never the content).

Student information. Many of the people our users serve are K-12 students. We use their information only to provide SLPcentral to the clinician who entered it. We never sell it, use it for targeted advertising, or build profiles of students. We delete it when the clinician asks, or on a verified request from the clinician's school or district, after telling the clinician.

Subprocessors

The outside services SLPcentral relies on, what each one receives, and where. Only Google and Anthropic receive clinical records, and both have signed HIPAA Business Associate Agreements with us.

Clinical plane (holds or processes clinical records, all under a BAA)

Google Cloud (Cloud Run, Cloud SQL for PostgreSQL, Cloud KMS, Secret Manager, Cloud Storage, Cloud Scheduler, Cloud Logging and audit logs, Artifact Registry, IAM, VPC)

Receives: All clinical records; synced client names and details (extra KMS encryption); the access log; move-day transfer file (auto-deleted after 2 days). Where: United States only (us-east4, Northern Virginia; org policy blocks non-US locations). Why: Store and serve clinical records. BAA: Yes, Google Cloud BAA effective 2026-09-22

Google Cloud Speech-to-Text (Chirp 3)

Receives: Brain Dump audio, in short pieces, processed in memory and discarded; returns text. Where: United States (us multi-region). Why: Turn Brain Dump speech into text. BAA: Yes (same BAA). Data logging off (opt-in, never enabled)

Anthropic (Anthropic's Claude models, called only from our server)

Receives: Clinical text with client codes (CLT_…): what you dictated or typed, goal wording, trial counts, percentages, session dates, cue levels, attendance codes and counts, and your messages to Ollie (saved client names replaced with codes). Never client name fields or client details. Where: United States (US-only processing). Why: Draft notes, SOAP notes, progress reports and present levels, and run the assistant Ollie. BAA: Yes, Anthropic BAA (HIPAA-ready organization). No training on our data.

Account plane and operations (no clinical records by design)

Supabase

Receives: Email, hashed password, sign-in records (time, IP, device), profile (first name, stage, terms version, referral answer), subscription status, usage counts, grad-school application tracker, support messages, marketing waitlist emails. (The pre-move copy of clinical records it held was deleted on October 15, 2026.) Where: United States (AWS us-east-1). Why: Login, account, billing status, limits, support inbox. BAA: No

Apple

Receives: Purchases and subscriptions; App Store distribution; TestFlight. Where: Apple's systems. Why: Sell and renew iPhone subscriptions. BAA: No

RevenueCat

Receives: Random account ID, purchase and subscription events, receipts. Where: United States. Why: Keep subscription status in sync between Apple, the web and our database. BAA: No

Stripe (via RevenueCat Web Billing)

Receives: Name, email, card details (entered on Stripe's page; we never see card numbers). Where: United States. Why: Web subscriptions. BAA: No

Resend (sending through Amazon SES)

Receives: Email address, first name, email content (account emails, including trial reminders: confirm email, password reset, "Welcome to Pro"). Where: United States. Why: Send account emails from send.slpcentral.app. BAA: No

Vercel

Receives: Website hosting logs (IP, browser, pages requested). Analytics: page views and referrers on public marketing pages only, no cookies; signed-in pages are dropped before sending. Where: Global edge network; US. Why: Host www.slpcentral.app; count marketing-page visits. BAA: No

Sentry (web app only; not in the iPhone app)

Receives: Error details, page path, network request addresses and status, random account ID. Session Replay, click/typing and console capture are off. Where: Sentry's cloud service. Why: Find and fix web crashes. BAA: No

Expo (EAS Update)

Receives: Device platform, app version, an update-client identifier. Where: United States. Why: Deliver over-the-air app updates to iPhones. BAA: No

Cloudflare

Receives: DNS lookups; email sent to @slpcentral.app addresses, including privacy@ and support@ (forwarded to the owner's inbox). Where: Global. Why: Domain name service and email forwarding. BAA: No

Google (Gmail), the owner's inbox that privacy@ and support@ forward to

Receives: Emails you send us. Where: Google's systems. Why: Answer email. BAA: No (a consumer Gmail account is not covered by the Cloud BAA). Never email client details. Kept 24 months, then deleted

Telegram

Receives: A content-free notice ("new message on form X, reply address left: yes/no"); a daily count summary (signups, subscriptions, message count, web crash titles). Where: Global. Why: Tell the owner something needs attention. BAA: No

Google Fonts (public marketing pages only)

Receives: Visitor IP address and browser when the font file loads. Where: Global. Why: Display a handwriting font on the landing page. BAA: No

Not used

  • Deepgram: used before the move for Brain Dump transcription. No longer used for any user data after move day; its key was deleted on October 15, 2026.
  • Google's Gemini models: not used for any user content. (Tested on made-up data only; switched off for client data.)
  • Anthropic under our old, non-HIPAA account: the pre-move Edge Functions (anthropic-*) used a general Anthropic account without a BAA. They were deleted on October 15, 2026, and that key was revoked. All AI text now goes only to the separate HIPAA-mode organization above, through our Google server.
  • No advertising networks, data brokers or cross-site tracking of any kind.

Changes

We will update this page and tell you in the app at least 30 days before a new provider starts receiving clinical records, except when we must change a provider urgently to keep the service secure or available; then we tell you as soon as we can.

Deletion and retention

SLPs can delete a student, a note or their whole account from inside the app. This is the schedule from our Privacy Policy:

Clinical records

Until you delete them. We never delete records because an account is inactive.

A client you delete

Moves to Recently Deleted for 30 days, where you can restore it. After 30 days it is permanently erased, with everything attached to it (goals, data, notes, reports, screener results, synced name and details). You can also choose Delete now to erase it right away.

A note you delete

Notes you delete go to Recently Deleted for 30 days. You can restore them there; after 30 days they're erased for good.

Your account, when you delete it

Your clinical records, synced client names and assistant data are erased immediately. Your login, profile, subscription record and usage counts are erased at the same time.

Backups of the clinical database

Google keeps automatic backups for about 30 days (plus 7 days of point-in-time recovery). Deleted records can remain in these backups until they age out, then they are gone. We only use backups to recover from an outage or error.

Access log (who opened which record, and when; no content)

At least 6 years, as health-privacy recordkeeping. It is kept even after the records it refers to are deleted, and identifies you only by a random account ID.

Google's own security logs of admin and data access (no content)

About 30 days today.

Text sent to Anthropic (drafting and Ollie)

Not kept after the answer by default, apart from a short-lived cache of up to an hour; flagged requests up to 2 years (section 3).

Ollie conversations

The last 30 days; older ones are erased automatically. You can delete a conversation yourself at any time, and conversations that mention a client are erased when that client is permanently deleted (section 6).

Support messages and email to us

Deleted within 24 months. They are not deleted automatically with your account, because they are not linked to it; ask us and we will delete them sooner.

Account-data backups

Our account database's current plan keeps no automatic backups. Any manual backup we make is kept encrypted on our own computer, never in cloud storage, and deleted within 30 days. None is kept today.

Records from before the move

After the move to Google, the copy of clinical records left in our previous database and the encrypted offline backups made before the move were deleted on October 15, 2026.

Billing records

Kept by Apple, RevenueCat and (for web purchases) Stripe as long as they require for tax and accounting.

Your district’s student data privacy agreement

Send your district’s student data privacy agreement (or your state’s or consortium’s standard DPA) to privacy@slpcentral.app and we’ll review it and sign it with you. A private practice that is a HIPAA covered entity can ask for our Business Associate Agreement the same way. Please never put student information in an email.

What stays with the SLP and the district: HIPAA, FERPA, state law and district policy apply to how SLPcentral is used. SLPcentral is a working tool; your district’s system is usually the legal record. Read the HIPAA, Privacy & Consent page and the Terms of Service for the details.

Session data in, a draft note out. You review and save.

Start free
Download on the App Store