Safety, privacy & security
Plain answers about BLS, transcription, privacy, and where your records go.
Is bilateral stimulation safe?
Whether BLS is appropriate depends on the person, the treatment plan, and the therapist’s training and judgment. Before starting, the therapist and client should agree on the pace and on a clear way to stop.
Helo Echo gives the therapist direct control over speed, direction, duration, audio, pause, and stop. If the experience becomes uncomfortable, disorienting, or more intense than intended, pause it right away.
Is Helo Echo AI? What happens to session audio?
Yes, mostly for transcription. Session audio is sent securely to OpenAI, turned into words, and destroyed when the words return to Helo Echo. Helo Echo does not save the recording; only the transcript can be saved, and the therapist should review it for mistakes.
This audio handling and destruction is backed by Business Associate Agreements with OpenAI and DigitalOcean. A BAA is a HIPAA contract that limits how protected health information may be used, requires safeguards, and makes deletion and privacy duties legally enforceable. You can download Helo Echo’s BAA.
How is sensitive information protected?
Helo Echo uses encrypted connections and record storage, separate therapist and client permissions, multifactor authentication, automatic sign-out, audit logging, and protected backups.
Security is still a shared responsibility. Practices remain responsible for account access, device security, privacy notices, retention rules, and staff procedures.
Does Helo Echo share or sell client information for advertising?
No. Helo Echo does not sell client information or use charts, journals, transcripts, or clinical documents to build advertising profiles.
That information is used to provide the clinical workspace and support the work between therapist and client.
Who decides where records are stored?
Therapists and clients can use Helo Echo’s encrypted cloud storage for convenient access and recovery, or export records to an encrypted drive and keep them offline.
The practice decides how long to keep records, who can access them, how often to make backups, and when something should be moved or deleted.
What happens to records and backups?
Each saved document is kept for three years by default; clinicians can choose longer. About 30 days before deletion, Helo Echo attempts to notify the client and therapist so they can export a copy.
At the deadline, the document is permanently deleted from active storage even if the account remains open or the chart is archived. Only a valid legal hold pauses deletion, and encrypted backup remnants expire separately. Practices must select a period that meets their legal requirements. See the Data Retention Schedule.
What if I find a privacy or security problem?
Email a short description to info@heloecho.com. Tell us which page or feature you were using, what you tried, and what happened.
Do not send client names, clinical details, passwords, access codes, or sensitive screenshots in a regular email. We will arrange a safer way to share more information if needed.