Local AI for therapists: work with session notes without PHI leaving your Mac

The duty you can’t hand to a vendor

You are the custodian of every progress note, intake summary, and treatment plan in your practice. If a client’s record is exposed, the responsibility lands on you personally — not on a platform, not on a support queue. That is the reason a general-purpose cloud chatbot is a poor fit for clinical documentation: the moment you paste a session note into it, protected health information has left your control and entered a system you cannot inspect and did not build.

On-device AI for clinicians in private practice exists precisely because the alternative — sending patient notes to a cloud model — is a decision you have to defend afterward, to a board, a client, or yourself. This page describes a technical control that removes that decision: the AI runs entirely on your own machine, so your notes never leave it.

Why a cloud chatbot is a data-exposure problem for a solo practice

When you send session notes to a cloud AI, three things happen that are hard to account for later. The text travels over the network to a third party. It may be retained, logged, or used to improve a model, depending on terms that can change. And you have no independent way to prove, after the fact, where a specific note went or who could read it.

For a hospital with a legal department, those risks get papered over with contracts. For a solo or small practice, there is no procurement team to negotiate a data-processing agreement and no one to absorb the liability but you. Keeping patient notes off the cloud is not caution for its own sake — it is the simplest way to keep the record inside the boundary you are actually accountable for.

SealedBrief takes the opposite approach to the usual cloud workflow. It indexes your files where they already sit and does not send them anywhere. The category difference matters more than any feature: a private AI for therapy session notes has to run local, or it isn’t private.

How SealedBrief works with your notes, locally

SealedBrief is a desktop AI workspace that reads your own documents and answers questions about them on your machine. You point it at a folder of notes — PDF, DOCX, TXT, Markdown, and more, including scanned pages read by on-device OCR — and it indexes them in place. There is no proprietary cloud store and nothing is uploaded.

From there you can:

• Search across your caseload notes by meaning, not just exact wording.
• Ask questions over your own records and read answers that cite the source passages they came from. Answers are grounded in retrieved paragraphs from your files and show those passages alongside the response, so you can check each one against your own records. When the model cannot ground a claim in your notes, it is built to say so rather than invent a citation — but it can still be wrong or mis-cite, which is why you verify against the cited passages.
• Draft summaries, letters, or continuity-of-care notes from what is already in your records, then edit them yourself.
• Export anything you produce to Markdown or PDF.

This is offline AI for counseling and clinical notes in the literal sense: the download is roughly 15 GB and includes the models, so no model weights are fetched at runtime — the interface’s only network calls are the licence and update checks described below. The AI is a local open model (Qwen3), not a frontier cloud model — capable, but to be checked, which the scope-and-limits section covers plainly.

A record you actually own

Because the workspace runs on your hardware, the trail of what happened stays with you. SealedBrief keeps an on-device log of what it indexed — a record you hold, rather than a log handed to a vendor and requested back later. If you ever need to show your own account of how a document was handled, it is a file on your disk, not a support ticket to a company that may or may not still exist.

That is the whole idea behind an audit trail you actually own: the defensible record of your documentation lives where the documentation does — a theme SealedBrief returns to in its overview of private, local AI for confidential documents. The Professional tier adds an exportable evidence surface for this — an at-rest encryption proof, a network-egress attestation, and the ingestion audit log — for clinicians who want to keep that evidence on hand.

What encryption at rest does — and the honest carve-outs

SealedBrief encrypts the text of your notes and their metadata at rest with AES-256-GCM, and the searchable index with SQLCipher AES-256 page encryption. The master key is held in your operating system’s keychain.

Two carve-outs you should know, because precise claims are the point:

• Embedding vectors are stored unencrypted. Similarity search needs plaintext math, so the numeric vectors derived from your text are not encrypted, even though the text and metadata are. It is not accurate to say everything on disk is encrypted, and SealedBrief does not claim that.
• The key exists in memory while the vault is unlocked. The tested guarantee is narrow: the raw key bytes SealedBrief manages are cleared after per-record keys are derived, and a memory scan finds no copy once you lock the vault. While it is unlocked and in use, working copies exist, as they must for any tool that reads your files.

Verify that your notes never leave your machine

You do not have to take a privacy claim on faith. SealedBrief runs as two separate processes that cannot swap roles. The Compute Plane — the part that touches your notes, runs the model, and searches your index — has no network access by construction. The Presentation Plane, the interface, contacts sealedbrief.com only to validate your licence and check for updates. Neither process contains your documents or your questions.

That is what makes the claim checkable. Run a packet capture on your own machine while you query your notes and watch the traffic: the document-handling process opens no connection, and the interface’s calls carry a licence check and an update check, never your records. This is the kind of evidence you can put in front of a reviewer — a technician can reproduce it in a few minutes. AI notes without sending PHI to the cloud is a testable property here, not a slogan. Follow the full verify-it-yourself walkthrough for the exact commands.

Note the honest boundary: SealedBrief is not claiming the entire application never touches the internet. It is claiming that the part that reads your notes has no egress, and that the part with network access never carries your notes. Those are different statements, and only the specific one is true.

Scope and honest limits

A few things need saying plainly, because a clinician personally liable for this data deserves the boundaries, not just the pitch.

• This is a technical control, not a compliance certification. Keeping PHI on the device is a meaningful safeguard, but it does not by itself satisfy any regulation, and nothing on this page is legal advice about your obligations. How a given control maps to your duties is a question for your own counsel.
• Treat every AI answer as a draft to verify. The model runs locally and cites its sources, but it can be wrong. Read the cited passages before you rely on an answer — the way you would review a junior colleague’s draft. It is a research and drafting aid, not an authority on a client’s care.
• Hardware and platform. SealedBrief runs today on an Apple Silicon Mac (M1–M4, on Metal) or a Linux workstation with a 12 GB or larger NVIDIA GPU; it also runs CPU-only, more slowly. Plan on about 16 GB of RAM and roughly 15 GB of free disk. Windows is a waitlist, not a release — it is blocked on an encryption-library dependency, so if you work on Windows you can join the waitlist and you won’t be charged until it ships. It is not available on Windows today, and this page won’t imply otherwise.

How to try it privately

The free 14-day trial is the full workspace, not a limited demo. Download it, choose “Start 14-day trial” on the welcome screen, and begin — no account, no credit card, and starting the trial makes no network call. For 14 days you can index your own notes, ask cited questions, search, and export, all on your own hardware.

After 14 days, the app opens read-only. Nothing is deleted and nothing is locked away: you keep full read, search, and export of everything you have already indexed. Only indexing new documents and asking new questions pause until you enter a licence — no reinstall, no lost work.

When you are ready to buy, compare the two tiers on the pricing page: Personal is $199 and Professional is $499, both a 3-year term rather than a subscription, and every purchase is backed by a 30-day, no-questions refund that is separate from the free trial. Start with the trial, run the packet capture yourself, and decide once you have seen the evidence.