Upheal

The model is the engine of Upheal's core module: transcription, speaker identification, note drafting, treatment plans, the compliance checker, the AI Assistant and the session analytics all run on learned models, several of them trained by Upheal on session data from clients who opt in. The platform also carries value that stands without them.

Scheduling, client portal and messaging, practice forms, telehealth, card payments and insurance billing make it a working practice record system, and Upheal offers telehealth calls without AI notes. Upheal leads with its AI notes, but remove the models and a practice management system remains.

The oversight structure is described. Upheal drafts notes, treatment plans and summaries, and the clinician reviews, edits and signs; its post answering AI questions says clinicians should always evaluate and edit its drafts. The clinician can pause capture for a sensitive topic or a whole session, which stops transcription for that span. A compliance checker audits the finished note for documentation gaps before it goes to a payer, a second check between the draft and the claim.

Since September 2026 practices can add billers and practice managers whose accounts cannot see clinical notes, treatment plans, transcripts or AI generated clinical content. What is missing is what happens after a draft is wrong: no edit rate or acceptance figure is published, and nothing describes how errors are reported or corrected. The paid AI Assistant Pro tier adds automated jobs, with no description of what they may change without a clinician's approval.

Upheal describes its approach in a September 2025 post answering questions about its AI. Notes are drafted by a large language model configured and instructed by Upheal and trained further on session data from clients who opt in, with a clinical team curating and validating note content. Separate models identify which voice belongs to the therapist and which to the client, correct commonly misspelled drug names in transcripts, and find the names of people and places for de-identification.

Neither the language model's provider nor a version is named, and nothing is published on how a model change is tested or announced, although product changes appear in a public changelog. The platform also produces session analytics, including talking ratio, cadence and sentiment along the session timeline, with no description of how they are computed.

Only part of the chain is named: AWS for cloud infrastructure and storage, and Nylas for the Google Calendar connection. Upheal does not name the provider of the large language model at the core of its notes, which its post answering AI questions describes without identifying.

The privacy policy for clinicians refers buyers to support or to the trust center for the list of providers, and the US data processing agreement says authorized sub-processors are listed in an Annex IV that is not reproduced on the published page.

Some terms that govern data once it reaches a provider are stated: sub-processors must accept the same obligations as Upheal, a new one needs the customer's prior written authorization, and processing may take place in the customer's country, the US, the EU, or wherever a sub-processor is established. What moves through the chain includes session audio and, when the telehealth room is used, video, alongside transcripts, notes and derived session analytics.

The evidence offered is scale of use: more than 70,000 providers and more than 800 organizations, with customer stories and testimonials on its site. Adoption on that scale is not evidence of benefit. Upheal cites no study, controlled evaluation or accuracy assessment of its notes, treatment plans or compliance checker, and no method or denominator stands behind its descriptions of note accuracy or time saved.

Its post answering AI questions says Upheal evaluates note quality on session data from clients who opt in, and no results from that work are published. The session analytics produce quantitative measures such as talking ratio and sentiment, with no validation against clinical outcomes.

Upheal states retention, training use and de-identification specifically enough to be tested. Transcripts and notes are stored for the practice; audio and video recordings are kept only if the clinician chooses to store them and the client consents, and stay until deleted or until the contract ends. The practice sets the retention period for its records, processing ends one month after the service ends, and data is then returned, deleted or anonymized at the customer's choice.

Sessions are not used to train Upheal's models unless both the clinician and the client opt in. Where a client opts in, Upheal keeps de-identified transcripts for one year and de-identified derived data such as notes and insights for five years (its post answering AI questions, September 2025), and the client can ask for deletion at any time. De-identification uses a model trained to find and replace the names of people, locations and places.

Health data is stored pseudonymized, and support engineers open it only to investigate a problem a clinician has reported. A clinician can pause capture for a sensitive topic or a whole session. Upheal publishes nothing on safety engineering: no description of guardrails, hallucination checks, or how a note containing content that was never said is handled.

The Business Associate Agreement is public, posted on Upheal's privacy and compliance page (effective 25 March 2026), and Upheal states that it handles protected health information as a HIPAA business associate. The agreement is accepted by click-through, and Upheal states that every covered entity using the platform agrees to it at sign-up, so it applies on every plan, the free plan included.

It binds subcontractors that create, receive, maintain or transmit protected health information to the same restrictions and conditions, and requires Upheal to return or destroy data at termination, including data held by subcontractors. The customer sets the retention period for its records, and Upheal may use only deidentified, aggregated information to improve the application.

HIPAA audit logs are deleted after six years unless the customer asks for longer, and liability under the agreement is subject to the limits in the service terms. Upheal also states compliance with Canada's PHIPA and PIPEDA, confirmed by an assessment it attributes to an external auditor it does not name, and publishes separate data processing agreements for the US, Canada, and the EU and UK.

The company states that it holds a SOC 2 Type II attestation and presents it as its own. Neither the report period nor the services in scope is stated on its privacy and compliance page. It also states that external security firms run regular penetration tests to OWASP standards and that results are reported in its trust center at trust.upheal.io, which is linked from the site. Infrastructure and storage run on AWS; certifications held by AWS belong to the host, not to Upheal.

Other stated controls are record level encryption of personal and health data, logging of all access to personal data with regular access reviews, backups held in a separate physical location, and a business continuity plan tested once a year.

Upheal makes no medical device claim and states no position on device status. It markets documentation, practice management and billing, and some outputs lean clinical: AI generated treatment plans with goals and interventions built from session data, interventions suggested from session patterns in its September 2025 post answering AI questions, and a sentiment measure of the client on the session timeline.

Each is a draft or display for the clinician, who reviews and signs before anything enters the record, and Upheal does not say whether a suggested intervention cites the session content behind it. The rules that do govern the product are payer documentation requirements, HIPAA, state licensure and consent law, and, for substance use disorder records, 42 CFR Part 2.

Upheal's answer to payer audit is its compliance checker, which checks notes against payer requirements before submission, and Golden Thread treatment plans that link diagnosis, plan goals and progress notes. On consent, it lets practices collect client consent in the app and supplies a privacy notice template for practices to adapt.

Bias is addressed in policy language only. Upheal's September 2025 post answering AI questions acknowledges that bias across gender, class and culture is a live question for AI in mental health, says its models learn from therapy sessions rather than open web text, and relies on clinicians reviewing every draft and on its clinical team curating note content. No evaluation, method or subgroup result is published.

The groups where this product's performance is plausibly at risk follow from its own inputs: accent, dialect and spoken language for the speaker identification and transcription models, and cultural differences in expression for the sentiment measure on the session timeline. Upheal lists spoken language, country and sex among the data it processes under its US data processing agreement, and it sells in the US, Canada, the UK, Australia, New Zealand and the EU.

Review before commit is the mechanism. Notes are drafts that the clinician reviews, edits and signs before they enter the record or are filled into another system, and a compliance checker flags documentation gaps before a note goes to a payer. Upheal's own post answering AI questions says clinicians should always evaluate and edit its drafts.

Nothing stands behind the output: no accuracy or error figure, no published limitations, and no warranty or remediation commitment for a wrong note, and the business associate agreement subjects Upheal's liability to the limits in its service terms. The session analytics carry the same gap. Talking ratio, cadence and sentiment describe both clinician and client, and no accuracy figure or validation is published for them.

For a practice that adopts it whole, Upheal is itself a full record system, with scheduling, forms, client portal, telehealth, payments and insurance billing, so its own notes need no transfer, and that record is not an integration. What moves notes into other systems is its Chrome extension.

The extension's Chrome Web Store listing, published by Upheal, says its Smart Fill feature fills finished notes into supported record systems it names, SimplePractice, TherapyNotes, Owl Practice, Jane App and Healthie, in one click. That is one directional writing through the browser rather than a connection to those systems' interfaces, and the listing states Upheal is not affiliated with them.

Upheal also offers a Zoom integration and the same extension for capturing sessions on other calling platforms, two way Google Calendar sync, chart migration from a previous system, and API access on its Enterprise plan with its direction not described. Insurance claims and card payments move money, not the chart. Upheal names no electronic prescribing, laboratory, health information exchange or FHIR connection.

A hosted service on AWS, Upheal is reached through a web app, a Chrome extension, and apps for iPhone, iPad, Android phones and tablets, and Mac. Residency is stated in its US data processing agreement: processing may take place in the customer's country, the US, the EU, or wherever an authorized sub-processor is established, and elsewhere only with the customer's prior written authorization.

For customers in the EU, Switzerland and the UK, the privacy policy states that data is transferred to suppliers in the US under the European Commission's Standard Contractual Clauses. Backups are held in a separate physical location, and personal and health data are encrypted at record level. Tenant isolation and the AWS regions used are not stated.

Prices are public, and there is a route to start without a sales conversation. Individual clinicians pay $1 per session, capped at $69 a month, billed monthly on usage with no minimum spend, after a 30 day trial that needs no credit card; clinical and practice features are included at that price, a free plan remains available after the trial, and a 30 day money back guarantee is stated.

The AI Assistant is included with a monthly usage limit, and AI Assistant Pro adds unlimited use and automated jobs for $39 a month. Card payments cost 2.9 percent plus $0.30 per transaction, and insurance billing costs $0.30 per claim and $0.15 per eligibility check, shown as free until the end of September 2026.

Group practices pay the same per session price with centralized billing, onboarding and migration from their current system; the Enterprise plan is priced on request and adds single sign-on, a service level agreement, volume discounts and API access. Because cost follows sessions held up to the cap, a clinician who reaches the cap every month pays a flat $69 plus any add-on.

Practice administration for outpatient mental health is the core: scheduling, practice forms, the client portal and messaging, card payments and insurance billing, alongside the AI notes. Coverage is stated clearly: outpatient mental health practice, with individual, couples and family sessions held in person, by telehealth, or captured from other calling platforms, for solo clinicians, group practices and virtual providers, with psychiatrists among the users Upheal names.

Upheal sells in the US, Canada, the UK, Australia, New Zealand and the EU, and states that it supports more than 800 organizations and 70,000 providers. Nothing published validates the coverage by setting: no study, named deployment or outcome is tied to any setting or practice size, including the larger organizations its Enterprise plan is aimed at.