← Bryl
§ Bryl · For your compliance file

Architectural attestation

Issued 2026-05-06 · Subject to revision when the architecture changes

This attestation describes the data architecture of Bryl — the iOS app for therapy session notes, published by Roushan, Inc. — at a level of detail suitable for a licensed clinician's compliance file, an ethics consultant's review, or a small-practice attorney's record. It is plain-language; we will provide a signed PDF on request.

1. The single sentence

No client audio, transcript, or note-draft generated by Bryl ever leaves the licensed clinician's iPhone. No Bryl server stores or processes any of the foregoing. No cloud-based AI provider — OpenAI, Anthropic, Google, AWS, Azure, or otherwise — receives any of the foregoing.

2. Where the data lives

  • Audio recordings are written to the app's sandboxed Documents directory on the iPhone, encrypted at rest under iOS Data Protection (NSFileProtectionComplete) plus an additional AES-256-GCM layer keyed to a value held in the iOS Keychain.
  • Transcripts produced by FluidAudio Parakeet TDT v3 (CoreML) with diarized speaker turns, with Apple's SFSpeechRecognizer as a fallback. Both run entirely on-device. The Parakeet model is downloaded from a public bucket on first use (optional, can be skipped) and then runs offline.
  • Note drafts are produced on-device by Apple Foundation Models (iOS 26+ on iPhone 15 Pro and newer) or by a bundled local 3.8B-parameter model in the Phi-4 family. Neither path makes a network call to generate text.
  • Therapist private notes are stored in the same encrypted sandbox.
  • Encryption keys live in iOS Keychain. They are not transmitted.

3. Network calls Bryl makes

The complete set of outbound network requests Bryl can make:

  1. Apple StoreKit 2 for in-app purchase receipt validation, subscription renewal, and entitlement verification. Apple's servers are the destination; Bryl does not see your Apple ID, payment method, or billing address. Required for any iOS in-app purchase.
  2. One-time, optional Parakeet TDT v3 model download from a public bucket on first run. You can skip the download and use Apple's built-in on-device Speech framework instead. Once a transcription model is on disk, every clinical workflow runs offline.

The current Bryl iOS build ships with no analytics SDK, no crash reporter, and no usage counters. We may add an opt-in (defaults-off) telemetry surface in a future build; if so, this attestation will be updated before the relevant App Store release.

You can verify this with Airplane Mode: every clinical workflow continues to function offline.

4. Why no Business Associate Agreement is needed

Under HIPAA, a vendor becomes a Business Associate when it “creates, receives, maintains, or transmits Protected Health Information” on behalf of a Covered Entity. Because Bryl never receives, maintains, or transmits PHI, Roushan, Inc. is not a Business Associate to your practice. Equivalent reasoning applies under the EU GDPR (we are not a Data Processor for clinical content), the UK GDPR, India's DPDP Act, and similar regimes.

This is a structural property, not a policy commitment. We could not violate it without changing the architecture and pushing a software update.

5. Subprocessors

For the clinical content path: none. The Apple Foundation Models route runs entirely on-device. The Phi-4-mini fallback ships in the App Store binary. The Parakeet TDT v3 transcription model is hosted on a public bucket for the optional first-run download — content never flows back through that bucket.

For non-clinical paths:

  • Apple, Inc. — iOS platform, App Store, StoreKit, iCloud Backup (governed by Apple).
  • Cloudflare, Inc. — host of the bryl.app marketing website and the closed-beta waitlist KV store.
  • Hugging Face, Inc. — public bucket that hosts the Parakeet TDT v3 model for the one-time optional download. No identifying information is sent on the request beyond the standard HTTP headers any browser would emit.

6. What you remain responsible for

Bryl is a tool. The clinician using it remains responsible for: obtaining and documenting informed consent before recording any client; reviewing every draft for clinical accuracy before signing; storing the signed note in your system of record; complying with your licensing board, ethics body, and state law; and ensuring your iPhone is secured by a strong passcode and FaceID.

7. Verifying this document

You can verify the substantive claims yourself:

  1. Use a packet inspector (e.g., Charles Proxy with a configured iOS profile) on a test session. Confirm that no clinical-content payloads leave the device. The only outbound traffic should match Section 3.
  2. Run Bryl in Airplane Mode through a complete record → transcribe → generate → sign → export cycle. Everything should work.
  3. Inspect the App Privacy details on the App Store listing. They mirror this document.

8. Contact

For a signed PDF version on Roushan, Inc. letterhead, or for jurisdiction-specific language, write to legal@bryl.app.

Roushan, Inc. · Wilmington, DE · Issued by the engineering team behind Bryl. This document is provided for informational and compliance-file purposes; it is not legal advice. Consult counsel for jurisdiction-specific compliance questions.