Last updated: August 30, 2026
Massage Scribe ("we", "us", "the app") helps massage therapists create and manage clinical session notes. This policy explains what we collect, how we use it, who processes it, and the choices you have. By using the app you agree to this policy.
Our direct users are massage therapists. Therapists enter information about their clients to produce session notes. Therapists are responsible for having an appropriate basis to record their clients' information and for complying with the laws that apply to their practice.
We do not sell your data, and client records and note content are never used for advertising. To measure our own ad campaigns (for example on Reddit or Meta), the app uses AppsFlyer, an install-attribution service. It processes a device advertising identifier — on iOS the IDFA, and only if you allow it via Apple's App Tracking Transparency prompt; on Android the Google Advertising ID — together with basic app events (install, sign-up, trial, subscription). You can decline the iOS prompt, or reset or delete the advertising ID in your device settings at any time, and the app keeps working fully.
Account data, therapist profile, client records, session notes, and private notes are stored in our database (Supabase, PostgreSQL) and are scoped to your account with row-level security so only you can access your records. Your practice logo is stored in Supabase Storage. Data is encrypted in transit (HTTPS/WSS).
On your device, the app keeps a local copy of your data (so it works offline) in a database that is encrypted at rest using SQLCipher (AES-256). The encryption key is generated on your device and stored in the iOS Keychain / Android Keystore. It never leaves your device and is not accessible to us. Voice recordings are never written to this database.
We rely on the following service providers to run the app. Each receives only the data needed for its function:
| Provider | Purpose | Data it receives |
|---|---|---|
| Supabase | Database, authentication, storage, backend functions | Account, profile, client records, notes, logo |
| Anthropic (Claude) | Generates note and home-care text | Structured session data you enter for the note (regions, techniques, pain levels, complaint, observations, plan). Never client identity, raw audio, or private therapist notes. |
| AssemblyAI | Voice Mode transcription (Pro) | Live session audio stream (not stored) |
| RevenueCat | Subscription management | Purchase/entitlement status and an app user identifier |
| Brevo | Sending account and appointment emails | Your email address and sign-in codes. For appointment emails you choose to send, your client's email address and first name, the appointment time, and the practice, service and location shown on it. No notes, health information, or client records. |
| Firebase | Crash reporting & app diagnostics (Crashlytics) | Crash reports and device/OS details. No client records or note content. |
| AppsFlyer | Ad measurement / install attribution (which of our ads led to an install) | Device advertising identifier (IDFA with iOS consent / Google Advertising ID), install and marketing events (sign-up, note created, trial, subscription), approximate country, and device model. No name, email, client records, or note content. |
| Google Analytics | Anonymous website & in-app usage analytics | Page views, approximate region, device type, and non-identifying interaction events. No name, email, or client data. |
| Ad conversion measurement (Reddit Pixel) | Anonymous page-visit and click events used to measure our Reddit ads. No name, email, or client data. |
We work only with providers whose terms restrict use of your data to providing their service and that do not train their models on it. Each provider receives only the data described above.
Our website and app use Google Analytics to understand aggregate usage (which pages and features people use) so we can improve the product. Our website also uses the Reddit Pixel to measure whether our Reddit ads lead to sign-ups. Both collect only anonymous, aggregate events; neither is linked to your identity, we do not enable advertising audience signals, and we never sell any data. You can opt out with the Google Analytics opt-out add-on, Reddit's ad-personalization settings, or your browser's cookie controls.
Your private therapist notes are never included in any AI prompt and never appear in exports. Raw audio is never sent to the note-generation model; only your structured inputs are used to write the note.
We keep your data for as long as your account is active. You can delete individual records in the app at any time, or delete your entire account (see below), which removes your notes, sessions, clients, and profile.
Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA. Contact us to exercise them.
The app is intended for licensed massage-therapy professionals and is not directed to children.
We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above.
Massage Scribe is operated by UTTERWARE SRL, Spl. Independenței 202 B, Cam. 42, Sectorul 6, Bucharest, Romania. Questions or requests: support@mscribeai.com.