The web app
Dashboard, patients and cases, schedule, front desk, intake, accounting, team, website editor. The daily workspace for therapists, secretaries and owners.
Showcase · Psyche A clinic platform
A clinic platform
that keeps its secrets.
Psyche is the practice-management platform we built for mental-health clinics: a web app for the whole team, a desktop companion that runs AI on the therapist’s own machine, and a public website tailored to each clinic. Clinical notes are encrypted before they leave the browser, so nobody, not even us, can read them.
Three surfaces, one record
🌐 Web app💻 Psyche Desk🏛️ Clinic website🔐 End-to-end encrypted🗣️ 7 languages
What Psyche is
One clinic, three surfaces.
Every clinic gets its own isolated installation: its own database, its own storage, its own domain. Nothing is shared between clinics, and nothing about a clinic is hardcoded.
Psyche Desk
A desktop companion for Windows and macOS. It decrypts a therapist’s notes locally and runs summaries, timeline extraction, dictation and read-aloud on a private, on-device model.
The clinic’s website
A public site delivered with the platform and edited from the admin: pages, colours, fonts, logo, favicon, opening hours, tariffs, team, blog and policies, in up to seven languages.
Security & confidentiality
The server never reads a note.
Each therapist sets a personal passphrase. It derives a key inside the browser that unlocks their private key. Everything clinical is sealed with that key before it is sent. What the database stores is ciphertext.
Therapist’s browser
🔑 passphrase → private key (unwrapped in memory)
note · timeline · summary → AES-GCM per field, wrapped for author + owners
ciphertext only
Psyche server
validates shape & recipients, never decrypts
ciphertext only
Database
{ v:1, iv, ct, wk }Envelope encryption per field
Every note body, private reflection, timeline event, relationship entry, clinical summary and AI summary gets its own AES-GCM-256 key, wrapped with RSA-OAEP-2048 for each authorised reader.
Keys are born in the browser
The key pair is generated on the therapist’s device. The private key is wrapped with PBKDF2-SHA256 at 310,000 iterations. The passphrase is never stored and never transmitted.
Owners are recovery key-holders
Every record is also sealed for the clinic’s owners, cryptographically, not by an access flag. A forgotten passphrase means an owner can re-encrypt the notes for the therapist.
Validated, not decrypted
The server checks the shape of every envelope and refuses a write that is missing a required reader. It never holds a key that could open one.
Choose how long a key lives
Ask for the passphrase on every reload, keep the key for the tab, or until sign-out. Lock now drops it from memory instantly.
Default-deny database rules
Nothing is readable unless a rule says so. Clinical collections are read-only for clinicians and closed to client writes entirely.
The front desk sees no clinical text
Secretaries get the same patients, appointments and payments, and none of the notes are even loaded for them.
A 14-day, undoable erasure
Deleting a patient hides them everywhere and stops every reminder, with a fortnight to undo. Then a cascade removes notes, summaries, appointments, ledger rows and packs, children first.
Pseudonymised exports
Financial exports name patients by initials and a derived dossier number, never by name.
Private calendar mirroring
Google Calendar entries carry a generic title, private visibility and no attendees. The refresh token is encrypted at rest with a separate server key.
Strict sessions
HTTP-only, same-site strict cookies with a five-day life, CSRF-protected sign-in, allowlist-gated access and instant lock-out of a suspended colleague.
Legal pages that match your jurisdiction
Staff privacy and terms pages ship in EN/FR with a switch for Senegalese (CDP) or European (GDPR) regimes.
Therapy note taking
Notes built from appointments, not the other way round.
The dossier lists every past session and asks for the note that belongs to it. A session nobody wrote up shows as “to write”. A run of cancellations stays visible, because that too is clinical information.
Four note kinds
First session, follow-up, assessment and closing. The first note on a case defaults to the intake kind, the rest to follow-up.
Two bodies per note
The shareable account of the session and the therapist’s private reflections, encrypted separately.
Draft, then sign
Notes stay drafts until signed with a legal timestamp. The dashboard counts unsigned and missing notes as “notes to write”.
Markdown with shortcuts
Bold, italic, underline, strike, lists. ⌘/Ctrl+B, I, U, E, K and Shift+7/8, rendered safely.
Timeline of the client’s life
Dated events, with an impact level from low to traumatic, linked to the people involved.
Ecosystem map
Family, partners, friends, employers, schools and institutions around the client, each with a relationship quality.
Provenance on every entry
Entries written by hand and entries extracted by Psyche Desk are labelled, with the model tag and the notes they came from.
Author-only edits
Only the author can overwrite or delete their note. Owners can remove extracted entries.
The same workspace in light mode · Demo data
Psyche Desk · enhanced note taking with a local LLM
AI that never leaves the room.
Psyche Desk is a native app for Windows and macOS. It pairs with the clinic’s server, unlocks the therapist’s notes with the same passphrase as the web app, and runs every model on the therapist’s own machine. Decrypted text and audio only ever travel to 127.0.0.1.
Walkthrough: unlock, open a case, generate a summary, extract the timeline and ecosystem, lock. Demo data.
How a session becomes a summary
- 01
Pair once
Generate a pairing key on your account page. The desk app checks it against the clinic server and stores it locally. The server keeps only a hash.
- 02
Unlock with your passphrase
The same passphrase as the web app unwraps your private key in memory. Lock drops it, and every decrypted byte with it.
- 03
Pick a case, generate
Summary, timeline or ecosystem, from every note you can read, with an optional focus you can type or dictate.
- 04
Review, edit, save
Everything is a draft until you press save. It is then re-encrypted for you and the owners and written back through the clinic server.
Case workspace: decrypted notes, Summary / Timeline / Ecosystem · Demo data
Clinical summary
Presenting themes, progress, risks and suggested focus in Markdown, under a prompt that forbids inventing facts, dates or diagnoses.
Timeline extraction
Dated life events with an impact level, resolved against the date each note was written, sorted chronologically.
Ecosystem extraction
People and institutions with relationship label, type and quality. The therapist and the clinic are excluded by rule.
Schema-constrained output
The model must answer in JSON matching Psyche’s exact record shapes, at low temperature. A batch that breaks the schema is reported, not half-saved.
Deterministic merging
Long cases are processed in batches merged in Go, never by a second model pass: same title is the same event, same name is the same person, in English and French.
Dictation on device
Native microphone capture transcribed by a local whisper.cpp server. Audio never touches the disk.
Read aloud
Kokoro text-to-speech, locally, with 17 English voices, so a summary can be reviewed while walking between rooms.
Self-managed engine
The app downloads and runs its own private Ollama on a random loopback port, verifies the download’s checksum and fails closed if it cannot.
Hardware-aware model tiers
Fast (3B, 8 GB RAM), Thinking (8B, 16 GB) and Ultra (12B, dedicated GPU). It recommends a tier from your memory and free disk.
Works offline
Once the models are downloaded, summarisation, extraction, dictation and speech need no internet at all.
Nothing clinical on disk
Decrypted notes, drafts and transcripts live in memory only, cleared on lock or case change. Only the pairing config and the model weights are stored.
Same design system
Light and dark, the clinic palette and fonts. It reads as another surface of the same product.
Fast granite4.1:3b · ~2 GB · 8 GB RAM
Thinking granite4.1:8b · ~5 GB · 16 GB RAM · default
Ultra gemma4:12b · ~8 GB · dedicated GPU · opt-in
Scheduling, reminders & notifications
Reminders that never page a patient at 3 am.
Week, month and year views for each therapist, a read-only clinic-wide agenda for the front desk, and a booking dialog that knows about rooms, packs, currencies and recurrence. Patients hear from the clinic over WhatsApp and email, and their replies come back to the calendar.
Rooms come from the floor plan
Owners draw the premises floor by floor. Bookable rooms appear in the dialog with clinic-wide conflict detection and live occupancy.
Recurring series, materialised
Weekly to monthly, 2 to 52 occurrences, DST-safe and month-end-safe. One occurrence can move without touching its siblings.
From intake to first appointment in one step
Converting a referral creates the patient, the case and the first session together.
Non-clinical events too
Meetings, workshops, conferences, admin and personal time on the same grid, so availability is real.
Google Calendar, opt-in per therapist
Best-effort mirroring that never blocks a booking, with generic private titles.
Multi-channel reminders
WhatsApp template messages with quick-reply buttons and AWS SES email, at several lead times, in the patient’s language.
Quiet hours, guaranteed
Nothing goes out between 22:00 and 08:00 clinic time. A lead landing in the window shifts to its edge, and the sender refuses to run inside it as a backstop.
Exactly once
An idempotency ledger claims each (appointment, recipient, channel, lead) before sending. Re-running the job can never double-send.
Booking, move, cancel, reinstate emails
Lifecycle confirmations sent the moment staff act, or queued until morning and collapsed so the patient reads what is true by then.
Replies never act alone
A confirmed or cancel-requested reply is recorded on the appointment and raised to staff to acknowledge. A human decides.
Consent per channel
Each patient opts in to WhatsApp and email separately, with a preferred language. Clinic-wide toggles sit above.
Dashboard queues instead of noise
Appointments to settle, waiting on payment, notes to write, urgent intakes and referrals waiting, all on the home screen.
Front desk, intake & dispatch
The same patients, minus the notes.
Secretaries run a parallel view of the clinic: contacts, appointments, settlements and payments for every patient, and not one line of clinical text. A secretary who follows a clinical link lands on the front-desk file for that same patient.
Two-pane triage queue
Every request in one searchable list, filtered by channel, status, urgency, gender and modality, with a detail pane for the one you are handling.
Seven intake channels
SMS, WhatsApp, phone, email, web form, walk-in and other, with one-click call, text, email or WhatsApp back.
A real pipeline
New, screening, referred, scheduled, waitlisted or closed, with urgency, clinical tags, screening notes and a therapist assignment.
Callback log
Every contact attempt with its outcome: no answer, voicemail, message left, reached, bounced.
Settle appointments from the desk
Came, cancelled by patient, by therapist or missed, charge it or not, paid or waiting, and the tender used.
Dossier numbers, not names
An unguessable derived number lets staff refer to a patient out loud or on a form without naming them.
Accountancy
A booked appointment is the ledger row.
Nothing is typed twice. Pricing, packs, settlements and payments flow from the schedule into a ledger the owner validates, then into analytics and a spreadsheet the bookkeeper can open.
Fee schedule with offers and specials
Individual, couple, group and workshop tiers, unlimited clinic-defined offers, and free-form discounted rates for students or first sessions.
Session packs
Pre-purchased bundles drawn down per session at the price captured on purchase. A cancelled session hands its seat back.
Late cancellation rule
Half of the price that appointment carried, never the list price. A pack patient loses a whole seat, stated as a clinic rule.
Per-case agreed rate
A negotiated amount, currency and reason, prefilled into every booking for that case.
Multi-currency, honestly
Each session keeps the currency it was billed in. The owner authors exchange rates, and anything without a rate is reported separately rather than guessed.
Clinic-defined tenders
Cash, Wave, Orange Money, card, whatever the clinic accepts, offered at booking and settlement.
Analytics with d3
Monthly revenue validated vs pending, sessions, new and returning patients, retention, average per session, revenue by offer and by therapist, pack liability as deferred revenue, at-risk patients.
Excel export
Seven sheets with frozen headers, filters and totals, periods resolved on the server, patients pseudonymised, in all seven languages.
Bespoke website & CMS
Every clinic gets its own front page.
The public site ships with the platform and is edited from the admin, page by page and word by word. Colours, fonts, logo, favicon, photos, tariffs, team, opening hours and policies are the clinic’s. Shown here: the default template as delivered, before a clinic adds its photos.
Named drafts, one live site
Edit as many drafts as you like, preview each with a shareable link, publish one, or take the site offline.
Edit in place
Open a draft preview, switch to mobile, tablet or desktop, click any text or image on the page and change it right there.
Brand controls
Palette, per-block colour overrides, four font slots from Google Fonts, logo upload, favicon generated from the logo.
Pages included
Home, the centre, services with tariffs and cancellation rules, team with founders, contact, privacy and cancellation policy, and a blog that only appears once something is published.
Block-based blog
Headings, text, quotes, images and dividers in Markdown, per language, with cover framing and separate mobile crops.
AI for marketing copy only
Auto-translate empty languages, draft a page from a brief, propose a palette, or ask the assistant to change the site. It has no access to patient records.
Up to seven languages
EN, FR, DE, NL, ES, PT, IT. Each clinic chooses which ones its visitors see.
Image pipeline
Every upload becomes three WebP sizes with focal point and zoom; deleting an image reports and scrubs every place that used it.
Team & roles
Three roles, enforced on the server.
A colleague can hold several roles. Every action re-checks who is acting, so a crafted request cannot do what the screen would not allow. Owners are named in the clinic’s configuration and cannot be granted from a button.
01
Owner
Runs the clinic and holds the recovery keys.
Can- Everything a therapist and a secretary can
- Colleagues, roles, lock-outs
- Accounting, exports, fee schedule
- Website, blog, assistant, settings
- Floor plans
- Patient erasure and its undo
- Re-key notes for a colleague
02
Therapist
Carries a caseload and writes the record.
Can- Own patients, cases and notes
- Timeline and ecosystem
- Own schedule and bookings
- Settle own appointments
- Pair Psyche Desk
- Google Calendar mirroring
- View floor plans
03
Secretary
Runs the front desk and the intake queue.
Can- Clinic-wide read-only agenda
- Dispatch and intake pipeline
- Front-desk patient files
- Settle appointments and record payments
- Reminder consent and contacts
- No clinical text, ever
Ease of use
Built for a Tuesday afternoon at the clinic.
A dashboard that asks the right questions
Who came, who has not paid, which note is still unwritten, which intake is urgent. The day starts from one screen.
Passphrase only where it matters
The website editor, schedule and front desk never ask for it. You enter it the first time you open a case.
Seven languages in the admin too
Every screen, label and export, and the CMS preview can render in one language while your chrome stays in yours.
Light and dark
One toggle, remembered per device, on the web and on the desk app.
Keyboard shortcuts
In the notes and blog editors, and Esc to leave the device preview.
Route-shaped loading
Skeleton screens shaped like the page you are going to, so nothing jumps.
Works on a phone
The admin folds into a menu, the public site is responsive with mobile image crops.
Sign in your way
Email and password or Google, with password change and re-authentication for sensitive actions.
Everything in Psyche
The complete feature index.
Every capability in the current build, grouped by where you find it. Nothing on this list is a roadmap item.
Dashboard
- Today and tomorrow agenda
- Appointments to settle queue
- Waiting on payment list
- Notes to write
- Intake queue with urgency
- Referrals waiting
- Active caseload count
Patients & cases
- Caseload cards with search and filters
- My patients / all patients scope for owners
- Open a case without intake
- Multi-patient cases: couples, families, groups
- Dossier numbers
- Case status: active, paused, closed with closing note
- Per-therapist tallies per currency
- Session history with settlement detail
- Reminder consent per channel
- Pending-erasure list with undo
Notes
- First session, follow-up, assessment, closing
- Shareable body and private reflections
- Draft and signed states
- Markdown editor with shortcuts
- Timeline with impact levels
- Ecosystem with relationship quality
- Provenance: manual or Psyche Desk
- Author-only edits
Encryption
- Browser-generated RSA-OAEP-2048 keys
- PBKDF2-SHA256, 310k iterations
- AES-GCM-256 per field
- Owners as recovery recipients
- Server-side envelope validation
- Three unlock policies and lock now
- Re-key for transfer or new owner
- Default-deny Firestore rules
Schedule
- Week, month, year views
- Clinic-wide read-only agenda
- Booking dialog with rooms, packs, currency, tender
- Recurring series, 2 to 52 occurrences
- Non-clinical events
- Schedule from referral
- Cancel and restore
- Reminder replies to acknowledge
- Google Calendar per therapist
Reminders
- WhatsApp templates with quick replies
- Email via AWS SES
- Multiple lead times
- Quiet hours 22:00–08:00
- Exactly-once ledger
- Booking, move, cancel, reinstate emails
- Morning collapse of night-time changes
- Inbound reply classification
- HMAC-verified webhook
Front desk & dispatch
- Two-pane triage
- Seven channels
- Status pipeline and urgency
- Screening notes and clinical tags
- Callback log
- Therapist assignment and claim
- Front-desk patient files
- Settle and record payment
Accounting
- Offers, packs, specials
- Per-case agreed rate
- Late cancellation at half fee
- Multi-currency with authored rates
- Clinic-defined tenders
- Automatic ledger mirroring
- Owner validation
- d3 charts: bars, trend, donut
- Seven-sheet Excel export
Premises
- Floor plans by floor
- Rooms, desks, doors, stairs, labels
- Capacity, purpose, bookable, out of service
- Live occupancy
- Refuses to delete rooms in use
Website & CMS
- Named drafts and publish
- Preview at phone, tablet, desktop
- In-place editing
- Palette and block colours
- Four font slots
- Logo and favicon generation
- Home, centre, services, team, contact, policy, blog
- Auto-translate and content generation
- Assistant with website tools
- Visual library with crop and usage report
Psyche Desk
- Windows and macOS
- Pairing key, hash stored only
- Same passphrase as the web
- Self-managed Ollama, checksum verified
- Fast, Thinking, Ultra tiers
- Summary, timeline, ecosystem
- Batching and deterministic merge
- whisper.cpp dictation
- Kokoro read-aloud
- Nothing clinical on disk
- Light and dark
Team & platform
- Owner, Therapist, Secretary, multi-role
- Create, lock, reset, delete colleagues
- Passphrase onboarding
- Staff privacy and terms, SN or EU
- One isolated installation per clinic
- Seven UI languages
- Dark mode
- Docker deployment
Straight answers
Questions clinics actually ask.
Can Eigenplex read our notes? +
No. Notes are encrypted in the therapist’s browser with keys that never reach us. We can see that a note exists, when it was written and by whom. We cannot see what it says, and neither can a database backup.
What if a therapist forgets their passphrase? +
Every record is also sealed for the clinic’s owners. An owner unlocks with their own passphrase and re-encrypts the therapist’s records for a new key. No note is lost, and no master password exists anywhere.
Does the AI send our notes to a cloud provider? +
No. Clinical AI runs only in Psyche Desk, on the therapist’s own machine, against a local model. The only cloud AI in the product writes marketing copy for the website and blog and has no access to patient records.
Is Psyche a shared SaaS? +
No. Each clinic gets its own installation with its own database, storage and domain. Re-pointing the platform at a new clinic is a configuration change, not a code change.
What does it not do? +
It does not print invoices, and it has no mobile push notifications. Reminders go out over WhatsApp and email. The desktop app’s interface is currently English-only while the web app speaks seven languages.
Where does it run? +
The web app ships as a Docker container and runs on Cloud Run or any host that runs containers. The desktop app is a native Windows and macOS application.