How PsychSift handles your data

Questions, generated answers, account identifiers, uploaded documents, retrieved excerpts, document metadata, and operational or retrieval telemetry may be processed. Free text and uploaded material can contain sensitive information if you enter it. Safety-plan working content is different: it remains in the current browser tab and is not sent to the application service or stored by PsychSift.

Clinical Ask accepts a typed or dictated question and non-identifying Case Context. It cannot guarantee that text is de-identified: identifier-shaped input is blocked as a warning aid, not transformed or certified. Review the transcript and remove identifiable details before asking.

Signing in creates an account record held by the authentication provider. Saved favourites and display preferences are stored against that account so they follow you between devices; they describe how you use the app, not who your patients are.

Raw question text is not written to query logs by default; logs use a keyed one-way hash. Generated answer text is also omitted from durable query logs by default. A short-lived response cache can contain the answer while its read TTL is valid. To make recent answers reappear quickly, completed answer threads may also remain in this browser tab for up to 12 hours. That tab-only copy stays in this tab, is not shared across tabs or devices, and is never sent to the application service.

Clinical Ask keeps its draft, transcript, Case Context, clarification answers, and response in ephemeral page memory for the current tab. Raw Clinical Ask content is not placed in the URL or browser history and is not attached to feedback or content-free telemetry. Clearing the case, signing out, changing account, refreshing, or closing the tab discards that in-memory session.

Documents, extracted evidence, metadata, account records, and owner-scoped operational records are stored in the configured Supabase project in Sydney. The production application and ingestion worker currently run on Railway in Singapore, so questions, retrieved evidence, answers, and ingestion material are processed in or transit through Singapore. File buckets are private and links are time-limited. The operator must verify deployed regions and contractual controls.

When external provider mode is configured, question text may be sent to the OpenAI API to create a retrieval embedding, including when the final response is source-only. When model-backed answer synthesis is used, the question and selected source excerpts are also sent. This processing may occur outside Australia. The operator must verify provider regions, retention terms, contracts, and cross-border obligations.

The requests the app sends carry deliberate limits: it asks the provider not to retain the response in the provider's own stored-response history, it never sends your raw account identifier — a keyed pseudonym is used instead when the operator configures one — and it asks for the shortest prompt-cache lifetime the model supports. OpenAI states that prompt-cache data may remain on its local GPU machines for up to 24 hours; the app's requested 30-minute lifetime is a minimum cache lifetime, not that maximum or a deletion deadline.

As an interim provider control, the OpenAI organisation inspected on 1 September 2026 has API data sharing and API call logging disabled, and its hosted MCP, web search, file search, image generation, code interpreter, and container-network access disabled. The operator has submitted a Zero Data Retention request, but OpenAI has not yet approved it, and the operator has not yet proved that the production key targets the inspected project. Until approved and configured, OpenAI's standard API controls may retain customer content in abuse-monitoring logs for up to 30 days. These controls reduce optional provider-side processing but do not establish Zero Data Retention, endpoint coverage, or a data-processing agreement.

Those are application settings, and they are the limit of what this page can tell you. Whether a data-processing agreement, a zero-retention arrangement, or a particular storage region is in place for the provider account is an operator and legal matter that the application cannot observe or promise.

Clinical Ask supports server-side external authority search only for an evidence gap, unresolved conflict, staleness, or a source marked needs review. That hosted-search path is disabled in the inspected provider project while governance review is incomplete. If an operator enables it later, returned authority extracts are discarded after the request; the answer retains attributable citations and retrieval dates. This does not mean an authority, source, answer, or feature has received clinical or governance approval.

Every document, log row, and saved item is stamped with the account that owns it, and database row-level security restricts reads to that owner. There is no shared corpus across accounts: another signed-in user cannot search, retrieve, or cite your uploads.

Document and image files sit in private storage buckets with no direct browser access. A file opens through a short-lived link that the server mints only after checking that your account owns the parent record, and those links expire after ten minutes by default. Within that window the link is usable by anyone holding it, so treat a copied link as the document itself.

Administrative access is a separate question from user access. Server-side work such as ingestion runs with elevated database credentials that are never exposed to the browser, and privileged actions are written to an append-only audit record. The operator of the deployment can also reach stored data through the database provider's own console; who holds that access is an operator control, not an application one.

Some things never reach the application service because they stay on this device. Your sign-in session, the light or dark theme, display preferences, and saved-item shortcuts are held by this browser. Recent searches use per-tab session storage and disappear when the tab closes. Completed answer threads are kept for up to 12 hours so a recent answer reappears quickly.

Safety-plan working content is stricter again: it exists only in the page's memory while the generator is open, and is discarded when you clear it or close the tab.

Clinical Ask audio is held only long enough to record, upload for transcription, or offer an in-memory retry. The browser recording and retry copy are disposed after transcription, cancellation, clear case, account change, or unmount. Audio is not put into URLs, browser storage, feedback, or telemetry by PsychSift.

You can clear this from inside the app. Settings, under Privacy and security, clears recent searches and saved items; New chat clears the current answer thread; signing out clears the thread and the session; clearing site data in your browser removes the rest. None of that affects documents or logs already stored on the server.

Repository migrations configure 30-day retention for RAG query records, 90-day retention for retrieval logs and query-miss telemetry, and a bounded hourly purge of expired response-cache rows. The operator verified the four expected schedules on production and staging and approved that evidence on 1 September 2026. Uploaded documents remain until removed under the applicable process. Completed answer threads in the current browser tab expire no later than 12 hours after the most recent answer and are also cleared by New chat, sign-out, or an account change. Safety-plan working content has no PsychSift retention: it is discarded when the component is cleared or the tab is closed. Clipboard, print, and PDF copies are outside the app and must follow the organisation's approved record-handling process.

Memory-only Clinical Ask handling is not a zero-retention promise for providers or network infrastructure. Provider retention, regional processing, the separately deployable feedback migration, clinical evaluation, and production readiness must each be verified by the responsible operator before launch.

Audit records are the deliberate exception: they are append-only and retained indefinitely by design, because an access trail that expires cannot answer a later question about who reached what.

PsychSift is assembled from three providers, each holding a different part of the system. Supabase hosts the database, the private file storage, and authentication, in its Sydney region. Railway runs the application and the ingestion worker in Singapore. OpenAI, in the United States, creates retrieval embeddings and, when model-backed synthesis is used, generates the answer text.

A fourth is optional. When the operator configures server-side error monitoring, error and performance events are sent to that service with request URLs, headers, bodies, account data, and exception messages stripped before they leave the application; browser session replay is not enabled.

Provider regions, sub-processors, retention terms, and contractual cover are operator responsibilities. This section describes which providers the application is configured to use, not what has been agreed with each of them.

Do not enter patient-identifiable information. In the Safety Plan Generator, add any patient identifier only after export through your organisation's approved clinical-record process. Upload only material you are authorised to use, keep access credentials private, review original linked sources before relying on clinical output, and report suspected privacy or access issues through your organisation's approved process.