Sweetwalnut

Draft notice · 14 September 2026

Privacy notice

This describes how Sweetwalnut handles accounts and hosted practice data. It is not legal advice and not a claim that we are “UK GDPR or HIPAA certified”. Families should also receive their practice’s own notice.

Who we are

Sweetwalnut is practice software for licensed therapists. The legal person is Frank Vevle, a Norwegian sole trader (ENK) — not a Ltd company and not a CEO title. For your login and billing we act as a controller (draft). For clinical records you enter about families we act as a processor for your practice (draft).

What we collect

  • Account: name, email, password hash, role, organisation, specialisation.
  • Practice use: cases, members, notes, journals, plans, formulation, assessments, calendar, invoices.
  • Optional session audio (encrypted), transcript, summary, and a consent attestation.
  • Portal: client login, HITL messages, agreements, homework, appointments.
  • Public booking enquiries on /p/[slug].
  • An httpOnly session cookie; Stripe billing identifiers; AI usage cost metadata (not note text).

Artificial intelligence

AI may draft a progress note, session plan, summary, or short message. A licensed clinician must review, edit, and sign. We do not auto-sign the clinical record. Production sending of patient content to OpenAI stays off until a Business Associate Agreement and Zero/Modified Retention are in place.

Where data lives

The app and database run on a single international stack (typically United States / global edge). There is no UK-only clinical region yet. See subprocessors.

Retention and erasure

Clinical retention is primarily the practice’s duty. After an erase request we tombstone clinical text, delete case knowledge chunks and audio files, and rotate encryption keys. The HMAC audit chain (hashes and opaque IDs, not note plaintext) is kept for integrity.

Portal clients can erase portal-side data. That does not wipe signed journals in the clinician chart.

Your rights

Staff and portal users can use the product APIs for export and erasure (schema v2). Dedicated in-app buttons are not shipped yet — ask your practice admin. You may complain to the ICO (UK), Datatilsynet (Norway), or your US state authority as applicable.

Children

Family work often includes children. The product does not implement a separate parental-consent workflow. Recording consent is the clinician’s attestation that the right people agreed.

Internal DPIA, practice template, and PHI inventory live in the product compliance pack — they are not republished in full here.