That's not a hypothetical clause somewhere in a 40-page ToS. That's the mechanism running under a tool a lot of tri-state clinicians already have open right now.
What Actually Changed on June 17, 2026?
SimplePractice quietly flipped a default. Clinicians who started using Note Taker before June 17, 2026 stay opted out of transcript retention automatically, no action needed. Anyone who turns Note Taker on for the first time on or after that date is opted in by default instead (SimplePractice Transcript Retention FAQ, 2026).
You can still opt out. SimplePractice says clinicians can turn retention off at the clinician, client, or individual-session level, any time (SimplePractice Note Taker FAQ, 2026). But opt-out only works if you know it's happening. A grandfather clause protects people who already had Note Taker running before June 17. It does nothing for the clinician who enables it next month, reads the setup wizard fast, and never sees the toggle.
That's the design pattern worth naming: existing users keep their old privacy default, new users get the company's preferred one. It's a quiet way to grow a data set without changing anything for the people already watching.
AI Transcript Retention: What Does SimplePractice Actually Keep?
Session audio is deleted immediately after the transcript generates and is never retained, per SimplePractice's own FAQ (SimplePractice, 2026). What gets kept, for opted-in clinicians, is a "de-identified and de-coupled" version of the session transcript, retained after the 7-day review window closes or once the note is signed and locked. The stated purpose is improving Note Taker and other AI features. SimplePractice also states it will never sell transcript content or share it with third parties for commercial purposes.
Read that carefully, because the audio piece matters. No recording sits on a server somewhere waiting for a breach. What sticks around is text, stripped of identifiers, according to the company. That's a meaningfully different risk profile than raw audio retention. It is not the same as no retention at all, and it's not the same as the old default either.
Who's Actually Cashing In? Vista Equity Partners and the EngageSmart Deal
SimplePractice's parent company, EngageSmart, was acquired by Vista Equity Partners for $23.00 per share in cash, a deal valued at roughly $4.0 billion, announced October 23, 2023 and closed January 26, 2024 (Vista Equity Partners; Business Wire, Jan 26, 2024). Post-close, Vista affiliates hold roughly 65% of the company, with General Atlantic affiliates holding the remaining 35%.
Vista Equity Partners is a software-focused private equity firm, not a healthcare company and not a clinician-founded one. That doesn't automatically make a policy bad. It does mean the entity setting your practice management defaults answers to institutional investors and a return timeline, not to a licensing board or a client sitting across from you. Worth knowing whose incentives are actually steering the toggle you didn't notice.
The De-Identification Loophole: What Your BAA Doesn't Actually Cover
Here's the part most clinicians never learn in a HIPAA training, and it's the single most important fact in this whole story. Once protected health information is properly de-identified, under the Safe Harbor method or Expert Determination, it legally stops being PHI. It falls entirely outside HIPAA's regulatory scope, including the business associate agreement you signed (HHS Office for Civil Rights, 2026).
SimplePractice states that transcripts undergo removal of all 18 HIPAA Safe Harbor identifiers under 45 CFR 164.514(b)(2), per the company's own claim as reported by the Psychotherapy Action Network (PsiAN, 2026). If that removal is done correctly, the resulting transcript is, by HIPAA's own definition, no longer your client's protected health information.
Your BAA is required to authorize SimplePractice to perform the act of de-identifying PHI on your behalf. That's real, and it matters. But once de-identification is complete, HHS is explicit: no BAA and no data use agreement is required to govern what happens to that data next (HHS, 2026). Your contract's protections effectively end at the moment the data stops being PHI, which is exactly the moment it becomes useful for training a product.
That's the loophole. Not a violation, a legal gap most clinicians assume their BAA closes and it doesn't.
Related: what a BAA actually covers.
Why Are Clinicians Pushing Back?
Clinician reaction has been loud and sustained. Trade outlet ClearHealthCosts reported in July 2026 that an r/therapists thread on the change "ran to 350 responses and counting," with therapists and clients raising concerns about privacy being traded to train AI systems (ClearHealthCosts, July 2026).
The Psychotherapy Action Network has raised its own concerns, spanning privacy, confidentiality, boundary and safety issues, informed consent, transparency, future uses of the data, and re-identification risk (PsiAN, 2026). Their framing cuts right to it: "For many therapists, the issue is not simply whether data is technically compliant with HIPAA requirements." Legal compliance and clinical ethics are two different bars, and a policy can clear the first while still failing the second. PsiAN's recommendation is not alarm, it's diligence: stay informed, read vendor policies closely, and keep the conversation going as these tools evolve.
That distinction is worth sitting with. A transcript can be perfectly de-identified by HHS's technical standard and still feel like a violation to the client who said something they never expected to outlive the session. Compliance is a floor, not a ceiling, and this policy is a clean example of why the two aren't the same conversation.
Does the AI Learn From Your Sessions? Even SimplePractice's Own Materials Don't Fully Agree
There's a real tension worth naming plainly instead of resolving falsely one way. Some SimplePractice materials state that the AI "does not learn directly from session content." Other parts of the same company's messaging describe retained transcripts as being used to improve Note Taker and other AI features. Both statements are on the record. They sit uneasily next to each other, and SimplePractice hasn't spelled out exactly how "not learning directly" squares with "used to improve." Until that's clarified, the honest answer is: it depends how you define "learn," and the company gets to pick the definition.
What This Means for Your Practice
If you already had Note Taker running before June 17, 2026, nothing changed for you automatically. If you're about to turn it on for the first time, or you're evaluating any AI notetaking tool going forward, go check the actual toggle rather than trusting the marketing page. Confirm your opt-out setting in writing, at the account level, and again at the session level if a particular client's disclosure warrants it.
More broadly, this is a good moment to ask any AI vendor you use one blunt question: is your default opt-in or opt-out, and who decided that? VibeCheck.luxury was built by a working clinician, not acquired by a private equity firm, and its data handling is opt-in stated plainly rather than defaulted quietly. That's a design choice, not a slogan. If you want the fuller list of questions to ask any AI vendor before you sign, our BAA checklist walks through it line by line.
FAQ
Does SimplePractice sell my clients' session transcripts?
No. SimplePractice states it will never sell transcript content or share it with third parties for commercial purposes. Retained transcripts, for opted-in clinicians, are de-identified and used to improve Note Taker and other AI features, per the company's FAQ.
Is session audio kept along with the transcript?
No. SimplePractice deletes session audio immediately after generating the transcript. Audio is never retained, according to the company's own transcript retention FAQ.
If I started using Note Taker before June 17, 2026, am I opted in now?
No. Clinicians who began using Note Taker before June 17, 2026 remain opted out of transcript retention by default. Only clinicians who newly enable Note Taker on or after that date are opted in automatically, and everyone can opt out at any time.
Does de-identifying a transcript remove HIPAA protection from it?
Yes, once done correctly. Per HHS, properly de-identified data under the Safe Harbor or Expert Determination method is no longer PHI and falls outside HIPAA's scope, including BAA requirements, even though a BAA is required to authorize the de-identification itself.
Who owns SimplePractice?
SimplePractice's parent company, EngageSmart, was acquired by Vista Equity Partners in a roughly $4 billion deal that closed in January 2024. Vista affiliates hold about 65% of the company, with General Atlantic affiliates holding the remaining 35%.