Security
How we protect client information
Labsky is built for HIPAA. People reaching out for therapy are sharing something personal, so we keep what we collect small and protect all of it carefully. Here is how, in plain language.
Business Associate Agreements before going live
Every practice signs a Business Associate Agreement with us before going live. We sign BAAs with every vendor that handles client information before any practice goes live.
Encryption in transit and at rest
Client information is encrypted while it moves between the client, Labsky and your practice, and while it is stored.
Each practice's data kept separate
Every practice's information is kept separate from every other practice's. One practice can never see another's clients.
Role-based access
Access is based on role, so each person sees only what their work needs, and you decide who on your team can see client details.
Audit logging
Access to client information and changes to it are logged, so there is a record of who did what, and when.
Only what intake needs
We collect only the information needed for intake and booking. Labsky does not ask for diagnoses or clinical history.
No ad tracking, ever
Nothing from a client's conversation is shared with advertising platforms, and this website has no tracking pixels, ad scripts or third-party analytics.
Crisis resources come first
If someone mentions being in crisis, Labsky shows 988 and 911 right away, stops booking and alerts your practice.
A note on wording: there is no official HIPAA certification, so we don't claim one. We describe Labsky as built for HIPAA, and we back that with a signed BAA before any practice goes live.
For what we collect and how long it's kept, see our privacy policy. Security questions are welcome: tahmina@labsky.ai.