We'd rather explain too much than ask you to trust too quickly
Trust & Transparency
OutSession sits alongside therapy — not inside it. That position demands clarity about what we do, what we don't, and how we handle the things people share with us.
How we use AI
AI generates structured worksheets — not conversations. You describe a situation, and the tool returns a personalised reflection grounded in CBT frameworks. An empathy playback of what you shared. Reflective questions to sit with. Suggested exercises to try.
Think of it as the digital equivalent of a printed thought record a therapist might hand you — but adapted to your specific situation. There is no back-and-forth. No ongoing dialogue. No chatbot.
What AI does
Adapts CBT worksheet questions to your scenario. Follows evidence-based frameworks. Generates structured, time-bound reflections. Every output is validated against a strict schema before you see it.
What AI doesn't do
Diagnose conditions. Offer clinical advice. Handle crisis situations. Have conversations. Score or label anything. Replace a therapist's judgement. Therapists can disable AI tools entirely — the platform works without them.
Data & privacy
OutSession was built by a cybersecurity engineer. Privacy isn't a feature we added — it's the foundation everything else sits on. We designed the access model around the realities of therapy, not the conventions of SaaS.
No email required for clients
Therapist-connected clients log in with a short code and PIN, handed to them in session. No welcome emails. No app icon that needs explaining. No account tied to a real name.
Private by default, shared by choice
Everything a client creates stays private. Sharing is always opt-in, always controlled by the client. The therapist can't access the studio after handoff — clients are forced to change their PIN on first login.
No tracking, no profiling
No tracking cookies. No behavioural profiling. No data shared with external parties. AI calls are routed through Cloudflare's AI Gateway — your prompts don't train anyone's model.
SSL encrypted, GDPR aligned
All data is encrypted in transit. Cookies are HttpOnly, Secure, and SameSite=Strict. We store what's needed for clinical safety and nothing more.
Clinical safety
OutSession is not equipped for crisis intervention — and we don't pretend to be. What we can do is recognise when someone might need more than a worksheet, and point them toward the right support.
Crisis detection
Every input is scanned against crisis indicators before any AI processing begins. If flagged, no worksheet is generated. Instead, we surface contact details for trained professionals — Samaritans, Crisis Text Line, NHS 111, Mind, CALM, and Papyrus.
Intent classification
Before generating a worksheet, we classify whether the input is appropriate for a CBT reflection. Medical symptoms, diagnostic queries, and out-of-scope requests are redirected with warm, non-dismissive messages — typically toward a therapist or GP.
Multi-stage validation
Every worksheet passes through schema validation on input, crisis scanning, intent classification, AI generation, and output validation before it reaches you. Every generation is logged for clinical safety audit.
If you or someone you know is in immediate danger, please call 999 or contact the Samaritans on 116 123.
NCPS relational safeguards
The National Counselling and Psychotherapy Society published six principles for AI in therapeutic contexts. We designed around them — not as a certification claim, but as a framework we hold ourselves to.
Worksheets are discrete, completed exercises — not ongoing conversations. Each reflection has a beginning and an end.
Explicitly between-session support. The therapist maintains oversight through the Session Board. We sit alongside the work, not in place of it.
CBT exercises only — never treatment plans, diagnosis, or clinical recommendations. The tool supports reflection, not direction.
Clear disclaimers throughout. Users know content is AI-generated. Limitations are stated openly in our FAQs, on this page, and inside the tools themselves.
Crisis detection with six UK helplines displayed inline. All generations logged for audit. Intent classification gates every request. Multiple validation layers before output.
Clients control what to share with their therapist via the Session Board toggle. Sharing is never forced. Content created before a connection upgrade stays private.
Therapist control
We don't impose a single model on every therapeutic relationship. Therapists set the boundaries when they create a client studio — and those boundaries are respected throughout.
AI on or off
Some therapists welcome AI-generated worksheets as a reflection tool. Others prefer a simpler resource-sharing space. Therapists choose when creating each studio — and the platform adapts accordingly.
Two-way or one-way connection
A two-way connection means the client can share items via the Session Board. One-way means the therapist can push resources but the client's studio remains entirely private. Upgrading from one-way to two-way requires the client's explicit consent.
Liability-aware design
Many therapists are cautious about digital tools — particularly the fear of missing something a client shares. We designed sharing controls with this concern in mind. Therapists opt in to visibility, not the other way around.
What we'll never do
Claim to be therapy
The language throughout OutSession carefully avoids claiming therapeutic benefit. We support preparation and reflection — not treatment.
Sell or share your data
No data is shared with external parties. Your prompts don't train models. Your reflections stay yours.
Force sharing
Visibility is always the client's decision. Therapists can invite a two-way connection, but the client must accept. Content created before an upgrade stays private.
Handle crisis alone
When someone needs more than a worksheet, we stop generating and surface trained professionals. We don't pretend to be something we're not.
Optimise for engagement
We don't send nudges, streaks, or notifications designed to pull people back in. Therapy doesn't rush. Neither should we.
We'd rather you asked than assumed
If something on this page isn't clear, or you'd like to know more about how we handle a specific concern — reach out. We'll answer directly.
Out|Session 2026|Give Feedback