The privacy policy

Who holds the record

The Lighthouse is software a therapy practice runs. Clients, notes, appointments, assessments and documents are held by the practice, on the computer or server the practice runs this software on. Lance Nabers, d/b/a Wayward Robots does not keep a second copy of your clinical record and cannot read it.

That is the argument for this product rather than a feature of it: no company sits in the middle of the record.

[who is responsible for publisher-operated hosting — to be confirmed]

Where it is stored, and what protects it

The record lives in a SQLite database file in the practice’s own data directory, with rotating snapshots beside it.

A practice can set a passphrase that encrypts every snapshot taken from then on. Snapshots already written stay as they were — re-writing them would mean this software reading every old backup and writing it back, which is more handling of the record, not less.

The record itself is not encrypted at rest. The file on disk is readable by anything that can read that computer’s disk, so the protection around it is the protection around that machine. This is said here rather than left to be discovered, and the software is forbidden from claiming otherwise.

Video sessions are not recorded

No video or audio file of a call is written. When the call ends, it is gone. There is nothing in the session room that could record it.

The written transcript, and the audio behind it

A written transcript is off until the therapist starts it, and the client’s own screen says it is on before their voice is heard at all.

When it runs, the software asks a model on the therapist’s own computer first, and the audio does not leave that computer. A speech service built into their browser is a fallback the therapist has to choose in Settings, and the room names which one started, before and after.

No cloud transcription service is offered, and the server refuses one. Listing a provider it will not use would be a choice that refuses.

Where audio is kept at all it lives in one directory behind one authenticated route, and it is destroyed 3 days after the note is signed. A note that has not been signed keeps its recording until it is — losing the audio under an unfinished note would lose the one part of a session that cannot be reproduced.

Writing the note up

Once there are words, the practice may have an AI service help draft the note from them. Today this deploy is configured to use no AI service on this server — a model on the practice’s own computer, or in the therapist’s own browser window, may still draft a note when the practice has chosen one in its settings.

Where that service is somebody else’s, no business associate agreement covers it. Session text sent for drafting reaches a company that has made this practice no promise about health information. The practice chooses whether to use one at all, and a model running on their own hardware or in their own browser window is preferred over a service whenever one is available.

Every model-backed route in this product — what it is for, what it is given, what it cannot know, and who is accountable for it — is published at /api/ai-transparency, which needs no login. A disclosure a person has to sign in to read is a weaker disclosure.

What reaches a client’s phone

A therapist assigns a tool and it opens in the client’s app; a receipt comes back. What travels is the assignment and the receipt, not the clinical record.

Where a practice runs on its own computer, that traffic passes through a relay so the phone can find it. The relay forwards sealed frames it cannot read and stores nothing.

[who is controller and who is processor, country by country — to be confirmed]

What this software does not do

There is no advertising, no analytics, no tracking pixel and no third-party measurement anywhere in the workspace. Nothing here reports what a therapist looked at to anyone.

The workspace fetches no fonts, scripts or images from another company’s servers; the typefaces ship inside the application.

One exception, and it is on the page a buyer meets first: the public trial and showroom pages load a typeface from Google Fonts, which means opening them sends your browser’s request — and with it your IP address — to Google. Nothing about a practice or a client is in that request.

What this page is not

This is a description, not a certification. The Lighthouse is not HIPAA compliant, has never had a SOC 2 audit, and holds no security accreditation. It says what it does so a clinician can decide for themselves where a record may go.

Questions, and changes to this page

Write to ask@lancenabers.com.

This page is versioned. If a word of it changes, the version changes with it, because agreeing to the old wording is not agreeing to the new one.

This website

The pages of The Living Story Company are plain pages served by Netlify. They set no cookies, keep nothing in your browser, and carry no analytics or advertising.

The type on every page is loaded from Google Fonts, and the Landfall page loads its motion scripts (GSAP and Lenis) from cdnjs.cloudflare.com and cdn.jsdelivr.net, so opening it sends your browser’s request to those two as well. Some films play from the company’s other sites, landfall2-showroom.netlify.app and xaitherapy.com, and some buttons open the worlds on their own addresses, landfall2-showroom.netlify.app and mrf-lance-62f8f1.netlify.app.

A Start or Write to us button opens a letter in your own mail app, addressed to ask@lancenabers.com. We receive what you send, and use it to answer you.

---

Still to be answered

1. who is responsible for publisher-operated hosting — to be confirmed — When a practice runs The Lighthouse on hosting the publisher operates rather than on their own computer, who is responsible for that server, and is a business associate agreement offered? (Today the only hosted deploy is a test one, not a live practice.) (Lance)
2. who is controller and who is processor, country by country — to be confirmed — In each place this is sold, is the therapist the controller of their clients’ records and the publisher a processor, and what does each side have to do? The answer differs by country, which is why it is not written here. (counsel)

Questions about this page: write to us.