Psychiatry.Ink is a clinical writing workspace built specifically for psychiatric documentation: admission histories, progress notes, psychopathological findings, diagnoses, medication plans, labs, and therapy planning — all in one calm, case-centred workspace, with optional AI assistance that always waits for your review.

After signing in you land on the dashboard ("My patients"). Click the new-patient button, enter a name or working label, and the case opens with all clinical areas: history, progress notes, diagnosis, labs, medication, and therapy. Patient identifiers are encrypted in your browser before anything is stored.

Yes. On first login a short tour walks you through the workflow, the clinical areas and the role of the AI. It opens with an optional question about your care setting (e.g. outpatient, inpatient, forensic) that tunes the case overview to your daily routine — changeable at any time later. At the end you choose whether to explore the fully documented demo patient or create your first patient right away. The tour is skippable and can be restarted any time from the Help menu. The dashboard shows a "Getting started" checklist that guides you to your first finished document, small, sparingly shown first-use hints explain the key controls once, and empty sections tell you what to do next. Subtle suggestions — computed entirely on your device — help you structure notes, and nothing is committed without your approval.

Yes. One product, several emphases: pick your care setting (inpatient, outpatient, forensic, consultation-liaison, psychotherapy, nursing, allied therapy, or general) in the intro tour or under Settings > Care setting. It changes only the DEFAULT order and emphasis of three surfaces — the dashboard care-area cards, the case-overview sections and the ward-round panels — for example an inpatient ward leads with the round and labs, while outpatient leads with the calendar and letters. It never changes your permissions, your data or where anything lives, and it never hides safety information: risk, abnormal values and backup warnings always stay first. You can reorder each surface yourself and reset any surface to its preset default. The choice is a device-level view preference — it is not synced and does not touch your records.

There is one global search that reaches everything: press Cmd/Ctrl+K anywhere in the app, or use the "Search" button in the top bar. It opens as an overlay — the patient and area you were working in stay open behind it. Results are grouped into patients (by name), the current case's documents, the whole knowledge base (the full curated drug catalogue by generic/brand name, the authored ICD-10/ICD-11 diagnostic-criteria sets by code and title, the patient-information topics, and — with a case open — therapy offers), templates and tests, and quick navigation commands. Selecting a knowledge-base result opens the relevant page with that item ready — a drug in the medication browser, a criteria set in the diagnostic-criteria browser. Matching is a plain on-device text search that ignores accents, so a name typed without its accent still matches; there is no AI, and neither patient names nor your search text ever leave your browser for the search. Move with the arrow keys, open with Enter, and close with Esc.

The full interface is available in German, English, French, and Spanish. The public site language follows the domain (psychiatry.ink is English, psychiatrie.ink is German); inside the app you can pin your preferred language in the settings at any time.

No. Psychiatry.Ink runs entirely in a modern browser on desktops and tablets — there is nothing to install and nothing to maintain. The workspace is optimised for larger screens, since clinical documentation needs room.

Yes. A synthetic demo patient is provisioned for new accounts so you can explore documentation, diagnosis support, medication plans, and lab trends without touching real data. All demo material is clearly marked and contains no real patient information.

Yes. The introduction is complete HTML throughout: an opening photograph with the statement “Every story deserves to be understood.”, two further statements paired with scene images — “Understanding takes more than notes.” and “Connect what matters.” — and the product claim with the “Start Free”, “Sign in” and “See how it works” buttons. On phones the picture stays on screen and only the words change: the three statements follow one another over the photograph, then the product claim covers it with the same three buttons and the trust line, and the normal page sections follow. There are no scene images on a phone. With reduced motion or without JavaScript on larger screens, every statement, scene and the product claim appear in normal page flow. On desktops and tablets the same content plays as a scroll story built from fades and one slide — no WebGL or canvas is required. Keyboard and screen-reader users can reach “Start Free”, “Sign in” and “See how it works” immediately; the photograph and scene illustrations are hidden from assistive technology.

The India edition extends the core clinical workspace with features built for high-volume outpatient psychiatry clinics in India: an organisation patient registry (with clinic MRN/UHID, optional ABHA, and duplicate detection at registration — exact match on MRN/UHID plus a normalized-exact candidate check on name+date of birth and phone, computed from keyed cryptographic digests on the device so the server never sees plaintext; this catches the same person re-registered with consistently entered details, but does not do fuzzy, edit-distance, phonetic, or spelling-variant matching), a walk-in and scheduled OPD day queue with numbered tokens, and check-in management from the calendar day view. It is in a controlled pilot phase and only available to organisations that have been enrolled in the pilot — workspaces not yet enabled will not see these features.

When the India queue feature is enabled for your organisation, the calendar day view shows a queue panel alongside appointments. Patients with a scheduled appointment are checked in from there; walk-in patients are found in the organisation registry and checked in with one action. Each check-in allocates the next numbered token (Q1, Q2, …) for the site and date — token allocation happens on the server so numbers are never duplicated across multiple reception devices. Queue state chips (waiting, called, in consultation, completed, etc.) appear beside each appointment on the calendar. If the network is unavailable when a check-in is attempted, a provisional local token (marked P1, P2, …) is held in a device outbox and submitted automatically when connectivity returns — the final server token may differ from the provisional number, and provisional tokens are always shown separately from confirmed ones. The queue is tied to one clinic site: your first site (“Main Clinic”) is created automatically the first time an administrator opens Settings → Queue site, and further locations can be added or renamed there under “Manage sites” — no support ticket needed.

The dashboard greets you with one rotating artwork per day. Small "Yesterday" and "Tomorrow" links beside the caption let you step back to yesterday's piece or peek at tomorrow's — each works once per day, on purpose, so the daily surprise stays intact. If you prefer a completely quiet dashboard, switch the artwork off under Settings → Appearance → Daily artwork; the toggle applies to the clinical dashboard and the administration area on that device.

Yes — under Settings → Account → Profile picture. The chosen image is cropped and downscaled to a small square on your device before upload, then shown in a circle beside your name on the dashboard and beside your name in the practice team lists, where your practice colleagues can see it. It is your own directory photo — never patient data — and you can remove it again at any time.

Patient identifiers (name, date of birth) are encrypted in your browser and stay encrypted at rest, with the keys held on your device. Clinical content is stored end-to-end encrypted on EU-hosted infrastructure; we never persist or log plaintext identifiers. For some AI and dictation features, identifiers may be transmitted transiently to the server so clinical text can be de-identified or transcribed before it reaches a model — used only for that processing, never stored and never logged. An optional account backup, encrypted with your passphrase, is available for recovery and moving between devices.

Identifiers do not. Two independent layers protect every AI call: identifiers are encrypted client-side and are never part of AI requests, and the server additionally de-identifies all clinical text before it reaches any model. If residual identifying patterns are detected, the request is blocked instead of sent.

Not inside the clinical workspace — the logged-in app contains no analytics or tracking of any kind, and patient or case data is never measured. On our public marketing pages (start page, features, pricing, legal pages) we use Google Analytics and the Meta Pixel (ad measurement), each behind its own consent category: nothing loads unless you choose “Accept all” in the cookie banner or enable a category in the cookie settings; with “Essential only”, nothing is loaded and no data goes to Google or Meta. You can change or withdraw your choice per category at any time on the Cookie Policy page.

No — by design. Scans and PDFs can carry patient identifiers in the image itself (letterheads, stamps) that cannot be reliably removed, so the system does not read them at all: the file is stored encrypted as a document you can view, and no content is extracted (no OCR, on the device or the server). Structured data from a scan is entered manually. Only text formats (DOCX, TXT, CSV, XLSX, JSON) are parsed automatically.

Each case carries only a random identifier (a UUID). The link between that identifier and the real patient — name and date of birth — exists only as ciphertext: on your device in the vault, and, if you use the encrypted account backup, on the server only inside a block encrypted with your passphrase. The server can see, for example, that "case a1b2c3… has an encrypted 12 KB snapshot," but not that a1b2c3… is "Jane Doe, born 1980." Even if our servers were breached, only ciphertext and non-identifying metadata would be exposed — no names, no mapping, no case contents, and no readable scanned documents (scans leave your device only end-to-end encrypted, when a practice shares them within the team).

The keys that protect patient identifiers exist only on your devices — we cannot read them, and neither could anyone who compromised our servers. The flip side: you are responsible for your device access and backups. The app offers an encrypted account backup with a passphrase for recovery and device transfer.

Four modes, selectable under Settings → Privacy: "Local only" (everything stays in this browser), "Sync patient list" (list available across devices, case files local), "Sync everything encrypted", and "Sync case file only" (clinical content end-to-end encrypted in the cloud while name and date of birth stay on the device). The app requests persistent browser storage at sign-in so the browser does not evict local data automatically. Still important: manually clearing browser or site data irrecoverably deletes all local cases — export a vault backup regularly or enable one of the sync modes. In Chrome and Edge you can additionally pick a local backup folder: the app automatically stores encrypted backups of your case files there that survive even clearing browser data — restorable with your passphrase.

Only if you share them. Team workspaces support roles and per-case access with audit logging; case discussions with colleagues use de-identified case packages by default. Nothing is shared automatically.

The product is designed around GDPR principles: data minimisation, client-side encryption of identifiers, EU hosting, de-identification before AI processing, and full export of your data at any time. A data processing agreement (DPA) and the current list of sub-processors are published on this site.

The Architecture page explains the core design in plain language: the zero-knowledge patient vault, the single guarded gateway every AI call must pass, and the three named systems behind the workspace — Mira, the knowledge curator, Noevia, a deterministic clinical inference engine, and CMEA, the clinical metadata extraction agent. The Security page adds step-by-step diagrams of the encryption with concrete examples.

The same zero-knowledge principle as the core product applies. Patient identity — name, date of birth, clinic identifiers — is encrypted on the clinic's own devices before it reaches the server. The server stores only ciphertext and opaque tokens: it never holds plaintext names or identifiers. When a receptionist picks a patient from the registry to check them in, no patient name is transmitted to the server — only an opaque internal identifier is used. The keys that seal these identities are generated and held on the clinic's own devices; the server cannot decrypt them. A passphrase-sealed recovery package must be created and tested before go-live so the clinic is not locked out if the original device is lost.

Drafting and structuring clinical text, dictation with transcription, inline voice editing of selected text, diagnostic criteria support, summaries, and medication-related checks. Every AI output is a draft: nothing is written into the record until you review and accept it.

No. Diagnostic criteria support (Butterfly) evaluates documented criteria deterministically first and uses AI only for unresolved points — and even then the output is advisory with evidence quotes. A diagnosis only enters the record through your explicit clinical decision and attestation. On the Diagnose page an advisory evidence matrix brings each criterion together with its source, its state, and any uncertainty; where evidence is lacking it keeps three distinct states apart — documented absent, not documented, and not assessed — and every pending decision is taken directly on the criterion rows, none of which is ever accepted automatically.

NOEVIA is a deterministic, rule-based analysis that turns a case's documented findings into a structured clinical overview — dimensional profiles and mechanism hypotheses across 27 dimensions and 15 mechanism domains, each traceable back to the source documentation. It runs entirely on your device, uses no language model in its scoring and consumes no AI credits. It is advisory only: it never makes a diagnosis and never writes to the record — your clinical judgement always decides. All 27 dimensions and 15 mechanism domains carry active rules, so a run evaluates the full profile — and every reading remains advisory, always subject to your clinical judgement. You will find it inside a patient case as the "Dimensions" tab — while NOEVIA is active it replaces the earlier separate "Clinical Intelligence" menu entry. Results stay stored encrypted on your device and reappear automatically when you reopen the tab — with a date stamp and a notice if the case data has changed since. The "analysis path" shows, with real run counts, how the assessment was computed; when the deterministic yield is thin you can optionally trigger an AI deep-dive that contributes additional candidate signals through the secured gateway — it uses AI credits, stays marked as an AI suggestion, and never becomes clinical truth automatically. The results open as a workspace with tabs (Overview, Dimensions, Mechanisms, Evidence, Gaps, Changes): a summary card distils the clinical picture, and the dimensions are grouped into seven clinical families with progressive disclosure.

CMEA — the Clinical Metadata Extraction Agent — turns what you document into structured, reusable clinical facts. When chart sections change, it reads them once in a single batched pass, de-identified before anything leaves the workspace, and extracts facts such as medications, symptoms and lab values — each tagged with the source it came from. Deterministic rules run first; a language model is used only where they fall short, and its output stays marked as a suggestion. CMEA never asserts a diagnosis and never writes to the record — it exists so other features can reuse one verified extraction instead of re-reading the chart, which also keeps AI usage and cost down.

AI actions (drafting, dictation, analysis) consume credits depending on the length and depth of the task. Tools like the short progress-note summary and Translate show the estimated cost before you start. Your plan includes a monthly credit allowance, and additional credits can be purchased. If your balance falls below 100 credits (and again below 25), you receive a one-time email warning — no repeated reminders. When credits run out, all writing, editing, and exporting keeps working — only AI actions pause.

Psychiatry.Ink routes AI tasks to leading models in three quality tiers — Economic, Standard, and Thorough — plus an explicit opt-in maximum tier for the hardest tasks. An EU-resident model option is available for practices that require it. All calls go through the same de-identification gateway regardless of provider.

The psychopharmacology knowledge base is curated with the help of Mira, our internal knowledge-curation system. Mira audits the database for gaps and contradictions, monitors sources such as PubMed, Europe PMC and the FDA (openFDA), and prepares fully traceable improvement proposals — and every risk-relevant change is reviewed by clinicians before it is published. Mira works exclusively on the knowledge base and has no access to patient data. The Architecture page describes how she works. Only editorial reviewers can edit the catalogue directly; everyone else uses "Suggest a change" on a drug entry to propose a correction with its source, or reports a problem — both land in the same review queue.

Yes. AI assistance is optional and per-action — nothing runs in the background on your notes without you triggering it. The workspace is fully functional as a pure documentation tool.

The core documents of a patient case — the mental state examination (MSE), progress notes, and treatment course — lead with "Structured entry": a focused dialog with clinical domains, selection chips (for the MSE the AMDP domains, including a one-click "unremarkable" quick-set), fields and a live text preview. Applying writes normal, editable text into the document. Free writing, pasting and dictation remain available at any time — patient-bound documents no longer carry a free page title; their identity is the document type, the patient and the date. The Anamnesis opens directly as its own page with a section rail and a per-section writing card: you type straight into it, a mic toggle on the editor dictates into the active section, an AI action row at the bottom of the card generates on demand, and the structured findings sections are filled inline rather than in a pop-up. An action bar beside the page title acts on the whole document — preview (an editable view of all sections composed together), save, copy, print and sign; saving shows where the document was filed (under Documents) with a direct jump there. The substance use history is captured checkbox-first — a substance checklist unfolds a compact detail grid per checked substance, and the remaining substances can be documented as "no use". The diagnostic assessment section enters diagnoses directly: ICD search, classification (suspected by default) and an explicit clinician apply — in patient charts this creates the entry in the Diagnosis area, which owns it from then on. "Save & next" saves the section and moves on to the next one. A new progress note opens from the case in a single action with the date, time and author already filled in — text or dictation leads and structuring is optional, so a note is saved in two clicks after typing. The mental state examination additionally offers a rapid keyboard-first capture with explicit "unremarkable", "abnormal", "unchanged" and "not assessed" states kept distinct from a not-yet-entered section; reusing the last exam carries only its structure, never the earlier finding, and replacing an existing finding always shows a review-before-replace comparison rather than overwriting silently.

Yes. Every section of a structured document carries a change-log icon (a small document with a clock) in its section header — on the History page it sits next to the section’s copy button. In the progress-note feed, every saved entry carries the same icon in its action row, and the feed header opens an aggregate log across all entries — including entries that have since been deleted. The log is read-only and lists every change: timestamp, origin (typing, paste, dictation, AI generation, checklist, template, restore, deletion), the character delta and the changed region; each revision expands to its full text, and the list ends with the initial version. Rapid typing bursts are coalesced into one entry per editing burst, and up to 50 revisions per section or entry are retained. Like the document text itself, the log is stored encrypted on your device and — when sync is enabled — synced inside the encrypted workspace snapshot.

Admission and history documentation, longitudinal progress notes, psychopathological findings, diagnoses with ICD-10/11 coding, medication plans, lab documentation with trends, psychotherapy and complementary therapy planning, discharge summaries and letters, plus reusable document templates.

Yes. Under Settings → Documentation → Anamnesis sections you decide which sections appear in new anamneses: remove standard sections and restore them later at their clinical position, or add your own sections with a custom title. Content you have already documented stays in saved documents — removed sections simply no longer appear in new anamneses. At least one section always remains, and the default can be restored at any time.

When you build a discharge letter (the German physician letter or the English discharge summary), AI-generated sections stay drafts until you review them. A staged panel helps you finish: you tick exactly which missing or unreviewed sections to generate — sections you have already reviewed or edited are protected and can never be overwritten by a bulk generate; a review list shows each generated section as awaiting review, edited by you, or accepted (editing and accepting stay distinct, and nothing is accepted automatically); and an on-demand final-check pass — deterministic, no AI — compares the discharge-medication section against your medication plan, the diagnosis section against your recorded diagnoses, and checks that a follow-up section is present, flagging anything worth a look and linking to its source. For the treatment-and-course section you can pick the target length of the generation (compact, standard or detailed). Export and print stay disabled until every AI-generated section has been reviewed (accepted or edited), and the button tells you how many are still open. A purely manual letter with no AI sections exports exactly as before.

Switching a medication to "discontinued" opens a short structured step in the same dialog: a discontinuation reason is required (fixed clinical set — insufficient response, adverse effect, interaction, remission, patient preference, switch — or free text), while a response summary and a taper plan are optional. The existing change history is preserved completely and unchanged; the captured context is visible read-only in the drug's history. The discontinued agent then automatically appears under "Previously tried medications" — with reason, response, dose at discontinuation and treatment duration. In addition, every medication entry can optionally carry a source attribution (reported by patient, prior letter, own prescription, imported, other).

Adding a medication opens one staged form: (1) the drug via knowledge-base search, with the authored reference single/daily dose shown for orientation only — never pre-filled; (2) dose, route and timing, including PRN with an explicit maximum per day; (3) provenance (reported by patient, prior letter, own prescription, imported, other) and dates; then a review-and-confirm step. A minimal add is three clicks: Add, pick the drug, confirm. You can mark each entry as confirmed or unverified, and it stays visibly marked as unverified until you confirm it. Before you confirm, the review step shows a deterministic safety delta — any new drug interactions the drug introduces against the current regimen and the monitoring it requires — as advisory information; it never blocks the save and, when reference data are missing, it says "not checkable" rather than implying no interactions. Every add, edit, discontinuation, deletion and confirmation is recorded in an immutable, append-only change log per case, viewable read-only from the plan.

On wide screens (from roughly 1400 pixels) the progress-notes page adds a "progress navigator" rail on the left — which also moves the reading column toward the centre of the screen. It carries three things: a compact treatment snapshot (primary diagnosis, day of treatment, documented allergy status — when nothing is documented it says so explicitly, never "no allergies"); a date and event index of every entry currently shown, grouped by month, marking today's entries and the admission anchor, where one click jumps to that entry; and the source filters (manual, admission findings, medication, psychotherapy, …) with a count per source. While the navigator is visible it replaces the toolbar's filter menu — the same filter state, in one place. The navigator moves within the record only; the clinical areas stay in the main left-hand navigation. On narrower screens the page keeps its previous layout and the filter menu.

Use the "Findings (ECG/EEG)" card in the workspace. The card opens the page directly — you choose between ECG and EEG on the page itself, via the "+ ECG" / "+ EEG" buttons (in the findings list on the left and in the empty state). Saved findings appear in the list and can be copied, edited, deleted, and signed.

In the patient-less workspace, the "Document a finding" card opens the somatic and neurological exams, among others. Guided entry asks about each exam component individually — for the neurological exam: consciousness and orientation, speech, cranial nerves, motor function, sensation, reflexes, coordination, gait, extrapyramidal signs, focal deficits, and seizures/syncope — and ends in a structured findings document with one labeled line per examined component; undocumented components are omitted, never invented. You review and edit the result, then save it as a note. An accidental click outside the entry window no longer discards your entries: once anything is captured, the window closes only via Cancel/X (or Escape), and reopening resumes where you left off. The free-text variant with "Optimize with AI" likewise delivers the full component-by-component finding rather than a one-sentence summary.

Yes. The knowledge base includes a read-only diagnostic-criteria browser with two catalogues you switch between: ICD-10 (grouped into the F0–F9 chapters) and ICD-11 (grouped into its own sections). Each lists every disorder under collapsible chapter headers; expand one to browse its disorders, or search by name, that catalogue’s code or criterion text. For each disorder you see its criterion groups in the active classification, code chips (ICD-10, ICD-11, DSM-5-TR), source and differential diagnoses; switching catalogue re-renders the same disorder in the other classification. ICD-11 child codes show only their applicable authored severity or subtype criteria; when the parent criteria are shared, the browser says so explicitly. ICD-10 child criteria are never mixed into ICD-11 trees. It is reference only — no diagnosis, no evaluation; the criteria are original paraphrases.

Click the dictation control in the editor, speak, and the transcription is inserted as text. Before the first recording you confirm via checkbox that the patient has consented; no recording starts without this confirmation (switching to another case asks again). You can also select any passage and give a spoken or typed instruction (keyboard shortcut ⌘⌥B) — the AI proposes a rewrite that you accept, reject, or rerun.

Yes. The detail view of a document in the Documents area offers a "Sign & lock" action. It records who signed and when; the document then becomes read-only — editing and "Open in workspace" disappear. Signed documents can still be duplicated, exported, and printed. To make changes, use "Duplicate" to create an editable, unsigned copy; the signed original stays untouched.

Only product-generated material: overviews, lab tables, medication and therapy plans, templates and generated documents, patient handouts and similar exports carry a small "Psychiatry.ink" wordmark header, kept deliberately quiet — a serif text line with a hairline underneath, no logo image. Official clinician-issued documents always print without any branding: prescriptions, physician letters, discharge summaries and medical certificates. Editable Word downloads are not stamped.

Deletion is deliberately safeguarded: restorable objects — such as to-dos, personal notes, or archived patients — are removed immediately, and a 10-second "Undo" notice restores them with one click. Permanent deletions (e.g. templates or therapy entries) first ask in a dialog that names the affected object. Clinical status changes such as discontinuing a medication are also confirmed in a dialog — the medication history is fully preserved.

Yes. Open Visit mode from the dashboard: appointments from today's calendar are included automatically, further patients are added by search, and the order is arranged by drag & drop. Per patient, the visit view shows diagnoses, current medication (editable, incl. the last change), safety signals with an update-risk action, the latest progress entries, abnormal lab values and the last ECG — plus the same adaptive quick actions as the overview (guided progress note, dictation, risk update, medication change and more), a to-do box (tasks store only the case ID, never the patient name) and a quick-entry box for the progress note, optionally polished by AI (the suggestion is only applied after your review). Each patient opens with a deterministic "Since last visit" summary — recent changes, safety, medication and due tasks first, derived only from data timestamps, with no AI ranking. Previous/next buttons or the Alt+Left / Alt+Right shortcut move between patients (an unsaved quick note asks to save first), the round resumes on the same patient when you return, and the full case file is one click away.

Butterfly checks your documentation against operationalised diagnostic criteria, shows which criteria are met, unmet, or unclear, and suggests targeted questions for the unclear ones. You resolve each point clinically (present / absent / unclear), and your attestations — not the AI — are the source of truth.

A dedicated psychotherapy workspace in a folio layout — a serif header with a status chip and document actions (copy, download, print, version history) plus a sections rail that shows, for each section, whether it is filled in: overview, case formulation (guided SORKC behavioral analysis and Beck-style cognitive conceptualization plus macro analysis), therapy goals with success criteria, phase-based treatment planning, session documentation, exercises and homework, evaluation with score series and goal-attainment ratings, and relapse prevention. Sessions can be documented briefly, in detail, by dictation, or as free text, and saved sessions appear as regular entries in the progress notes. The version history archives plan states — manually with a label, automatically with every interim review and before a restore or deletion — and lets you view, download, or restore earlier states; all end-to-end encrypted like the plan itself.

No. The six AI actions — case formulation, goal suggestions, treatment plan, homework, session summary and relapse prevention — return editable drafts tailored to the chosen therapy approach. Only de-identified plan context is sent, and nothing enters the record until you review and explicitly accept it.

The therapy area opens with the therapy offerings: a catalogue of over 120 parallel treatment offers — from psychoeducation through skills and stress-management groups to occupational and movement therapy — plus custom therapies. Each offer is a compact card with status, format and planning; sessions are documented in a short structured form from which a rule-based note text is composed instantly and free of charge. An optional AI draft uses only the observations you entered and is saved only after you explicitly adopt it; on request the note also flows into the progress notes. Right below it, the information-material section creates patient-friendly handouts from reviewed case data — each material is printed only after clinician review and release, and it does not replace individual medical consent counselling. New additions are a longitudinal overview, a builder for custom therapies with reusable patient-data-free templates, real links to diagnosis, therapy goal and calendar appointment, and a printable therapy plan.

Yes, and it runs in three clear phases — Prepare, Collaborate, Finalize — with a persistent header showing the clinical question, what was shared, the participants and the status. In Prepare you compose the request and pick the case sections that leave the case; nothing is preselected (minimum necessary), and a live preview and de-identification notice show exactly what leaves, de-identified or pseudonymised as you choose. After sending, the shared scope is locked as a "shared" record. When the consultant submits, the report appears for review — it is advisory, you mark it reviewed explicitly, and "Return to case file" stores the reviewed report as an attributed document back on the case. You can hand a request over by print or file export, or online: the access link opens a secure consultant view without any account — the consultant additionally enters the patient’s date of birth to unlock, and both the shared materials and the returning report are end-to-end encrypted. A forwarded link alone reveals nothing, and the date of birth never reaches our servers. That makes the online handover safer than a printout in an envelope or an email attachment — nothing readable in transit, access revocable at any time, and every access recorded.

When adding values you first choose: manual entry of individual values (parameter, value, unit, reference range) or report import — paste report text and the parser extracts values into structured entries; CSV/Excel files import through the Integration Hub. Values are displayed with reference ranges, trend graphs over time, and optional correlation with medication changes. Abnormal values also appear in a review list at the top of the lab page until you acknowledge them — the stored value itself is never changed. If you paste an ECG, EEG or imaging report instead of lab values, the paste zone recognises it and offers to file the text as a draft finding in the matching Diagnostics section with one click.

Yes. The template library ships with clinical document templates and assessment instruments, and a community library lets you download templates shared by colleagues (with ratings) or publish your own. The bundled starter templates always carry a complete document identity row (name, date of birth, date). Instruments are filled with one click per rating anchor (with a live total); printed or exported unanswered, they render as a tick-box paper form for hand administration, and long documents paginate cleanly across A4 pages instead of being clipped. Templates print as fillable forms too: empty text fields become ruled writing lines, selects and yes/no questions become tick boxes, and AI sections that were not generated print as blank writing space — never as the AI instruction. Spacer and page-break blocks in the builder control the printed layout. Templates never contain patient data.

"Patient education — free choice of topic" drafts patient-friendly education material on medications, conditions, therapies or free topics — AI-generated section by section and final only after your approval. While you type the subject, your own existing documents and matching templates from the library and community are offered so nothing gets generated twice. Every output — print, PDF, Word, text, clipboard and the saved note — ends with a consent section (checkboxes plus signature lines for patient and clinician). Approved documents can be saved to the template library, and each document carries created/modified metadata with a revision history. Within the Medication tab, education can also be created directly for the whole plan, for selected medications or for a single drug; if an active drug already has an approved education document in the knowledge base, it is offered there automatically.

Both are local print generators: "Generate prescription" (in the medication plan toolbar and the Visite patient view) prints a prescription pre-filled from the active medication plan, and "Generate medical certificate" (on the patient's Documents page and in Visite) prints a fitness/rest certificate — patient identity is filled in on the device and never sent to the server. The diagnosis is optional on both: a picker inserts one or more of the case's diagnoses (each pick appends, duplicates are skipped), resolved to their proper titles, or explicitly omits them; a certificate without a diagnosis uses an "under my medical care" statement instead of naming a condition. The letterhead comes from your profile settings, and a shared "Print without letterhead" option leaves the header blank for clinics that print onto their own pre-printed pad. The prescription pad designer ("Design prescription pad", available in both generators and in the templates library) generates your own printable stationery — pre-filled from your profile, every line editable, with theme and layout variations and a live preview.

Yes — one Import entry asks what you are importing (documents, lab results, or structured case data) and opens the matching flow. Import runs in clear stages (File → Detect → Map → Confirm) and the format (Psychiatry.Ink JSON, FHIR bundle, CSV/Excel tables, CDA/XML documents) is detected automatically. Before you commit you see an explicit preview — additions, updates, duplicates and every excluded row with its reason, so nothing is silently dropped — and nothing is written without your confirmation. If a row fails it is marked for review without discarding your other corrections. For spreadsheets you can save a reusable column mapping (structure only — column and field names and format rules, never cell contents). Accepted examination findings land where you expect them clinically: findings recognised as ECG, EEG or X-ray appear as drafts in the matching Diagnostics section, cranial CT and MRI reports in the Imaging section — each mirrored in the document archive; lab values go to the lab archive as before.

At any time. One Export entry lets you choose the scope (this case, a selection, or library content) and the format — Psychiatry.Ink JSON (complete, re-importable), FHIR R4 bundle, CSV/Excel tables, or a readable PDF package. Export runs in stages (Scope → Format → Preview → Export), and before the file is generated an explicit privacy statement tells you whether it will contain patient identity and that the file leaves the protected vault. Your data is never locked in.

Yes. Appointments can be exported as a standard calendar file (.ics) that works with Apple, Google, and Outlook calendars. By default entries are privacy-neutral ("Psychiatry.ink appointment") — no patient names or clinical content leave the workspace unless you explicitly choose otherwise.

Yes. When creating an appointment you can repeat it daily, weekly, every two weeks or monthly, and end the series after a number of appointments or by a date (up to 52). Daily series offer a "Skip weekends" option: Saturday and Sunday are left out and do not use up the requested count, so a daily series of ten becomes ten weekday appointments. Every occurrence is a normal appointment you can edit or cancel individually.

A guided wizard helps you set up data exchange with hospital, practice, and lab systems, oriented to the standards common in your region. File-based exchange (FHIR, HL7, CSV) works today; direct live connections are prepared but deliberately disabled until secure credential management is in place.

You can export every case completely (JSON, FHIR, PDF) before or after cancelling. Account deletion removes your data from our systems; because identifiers are encrypted with your keys, they were never readable by us in the first place.

Practice mode extends the same application with a team workspace: you invite members via email link, assign roles (admin/psychiatrist, psychologist/psychotherapist, reception/assistant, therapist, viewer), share cases selectively, communicate via team notes, handovers and tasks, and review an activity/audit log. Practice Starter includes up to 4 seats (1 physician, 1 psychologist, 1 reception, 1 flexible clinical seat) and 1,500 shared AI credits per month; larger plans extend seats, credits and permission depth. Unused higher-value seats can be filled downward — e.g. a second reception seat on a free psychologist or flexible seat. After activation, a setup guide on the practice dashboard walks the admin through the first steps — inviting the team, credit allowances and, where applicable, the encrypted patient-registry keys — and everything it covers can be changed later in Settings. A printable step-by-step setup guide (print or save as PDF) is available in the app under the practice dashboard.

In the admin dashboard: switch between Clinical and Administration in the dashboard top bar (visible to practice members and administrators). It looks and feels like the clinical dashboard — hero artwork, at-a-glance cards for credits, team seats and the shared AI pool — and gathers every administrative surface as large cards instead of the old small buttons: the practice workspace (team, roles, case sharing, usage, billing), the Integration Hub, credits, and for system administrators the review consoles. The same switch takes you straight back to the clinical dashboard.

The practice subscription runs on the practice owner's account, whose balance becomes the shared pool: every AI action by an active member is debited from it. The admin can optionally set a monthly credit limit per member, sees per-member usage in the practice dashboard, and gets warnings before the pool runs low. Additional credit packs and auto-recharge work exactly like in single-user mode.

By default only appointments, tasks and administrative data. Clinical notes, diagnoses, medication, lab values, risk assessments and psychotherapy content are excluded — not just in the UI but cryptographically: without a granted case key, clinical content and team notes cannot be decrypted at all. The practice admin can explicitly enable individual permissions (e.g. "view clinical content") per person.

The device heals itself: on the next visit it creates a fresh key, and the old published key is superseded automatically with a full audit trail — never silently overwritten. The person at the device sees a notice that the device key was renewed, and the registration page explains the next step instead of showing a generic error. Because the key changed, an administrator has to approve the device once more (Settings → Registration keys → "Give team devices access"); access held by the old key is withdrawn automatically. Administration and registration then work as before.

Yes — a practice works as one team by default: doctors, psychologists, nursing and social work see and document on every case in the practice without anyone granting each case individually. That is coverage and co-treatment in daily practice. The role matrix applies: doctors can do everything (incl. prescribing with a verified profile), psychologists see medication but cannot edit it, nursing enters course entries and team notes but has no diagnoses, medication changes or AI. Therapists keep working on assigned cases only; reception and read-only roles never see clinical content. Case keys are wrapped for the whole clinical team automatically — when someone covers for a sick colleague, the chart still opens. The practice admin can grant additional permissions per person in the team settings.

Yes — the practice dashboard has a Permissions tab with a rights matrix: rows are the application's components (cases, patient registry, documentation & course, diagnostics & labs, medication & prescriptions, therapy, observation & risk, case discussion & consults, reception & appointments, AI assistance), columns are your team members. For each component you grant Read, Write and Edit via checkboxes. Defaults follow the member's role; every change applies practice-wide to every case. Subsections can be hidden individually — e.g. nursing sees the medication plan but not the receptor profile; the six standard document types (medical history, course notes, psychopathological findings, therapy course, medication record, therapy planning) are controllable per member too. Prescribing authority stays reserved for physician roles, and one click resets any member to their role default.

Yes. On the practice dashboard (Usage) you set monthly credit limits per workgroup — e.g. doctors, psychologists, nursing, reception — plus a practice-wide default. A per-member limit overrides the workgroup limit, which overrides the practice default. Without any limit, only the shared pool applies. All charges from the pool are counted per member and shown in the same table.

The reception workspace gathers the practice day in one place: the day schedule of every practitioner with compact per-person lanes and filter chips (book, reschedule, cancel appointments, check patients in — the waiting room shows live waiting times), tasks that the front desk assigns directly to the treating clinician (e.g. "prescription renewal requested"), patient registration with identity data — without access to case files — and the document inbox: documents brought by patients are uploaded, assigned to a patient and retrievable by the team, all encrypted in the browser with the shared practice key before upload. Which sections are visible is driven by permissions — the practice admin can extend them in the team settings.

Each shared case has its own AES-256 case key, wrapped individually for every team member with their personal RSA key. The server stores only ciphertext and wrapped keys — it can never read content. When the admin revokes case access, the member's wrapped key is deleted.

The single-user plan starts with a one-month free trial including 500 AI credits, then £29.99/month or £287.99/year (20% saving); Pro Plus with 1,500 credits per month is £59.99/month. For shared practices there are the Practice plans with a team workspace, roles and a shared AI credit pool: Practice Starter (up to 4 seats, 1,500 shared credits/month) at £95.99/month, Practice Team (up to 8 seats, 4,000 credits/month) at £179.99/month, and Practice Plus (up to 15 seats, 10,000 credits/month) at £359.99/month. All prices exclude VAT, which is calculated and added at checkout. Enterprise deployments for organisations are in development on request. Details are in the pricing section above.

The single-user plan is evaluated through its one-month free trial: a full month with 500 AI credits before anything is charged, and if you cancel before it ends you are never billed. Because of that, the paid subscription that follows a trial is not refundable. Where a purchase was not preceded by a trial — Practice (organisation) plans and direct purchases such as AI credit packs — you can request a full refund within 14 days of the original purchase date by emailing hello@psychiatry.ink. Refunds are not available for renewals, after those 14 days, for a gift voucher whose code has already been redeemed, or where the service was used fraudulently or in breach of the Terms. Cancelling stops future renewals but does not by itself refund the current billing period. Approved refunds are issued via Stripe to the original payment method. The full Refund Policy is linked in the footer.

Nothing is lost and nothing stops working except AI actions: you can keep writing, editing, and exporting without limits. Buy additional credits or wait for your monthly allowance to renew, and AI assistance resumes.

First use the password-reset link on the sign-in page. Sign in on the same address you signed up on — each edition (psychiatry.ink, psychiatrie.ink and the others) keeps your encrypted workspace separately in that browser, so a different address looks empty — and make sure your browser allows cookies and local storage for it. If you still cannot get in, reach us through the contact form and we will help promptly.

Patient identifiers are encrypted with keys that live on the device where they were created — that is the zero-knowledge design. To work across devices, enable the encrypted account backup with a passphrase (Settings → Privacy) and restore it on the new device; cloud sync tiers keep clinical content available across devices. Set that passphrase up BEFORE you sign in elsewhere — a second browser generates its own key, and without the passphrase there is nothing to carry the original key across (your data stays safe in the first browser, but the second one cannot read it). If individual items — such as medication-education documents or notes — are missing on the second device, click "Sync now" in the top-right of the dashboard; it reconciles case files, identifiers, education documents and notes with the account in one pass.

Progress entries now live in the browser’s large IndexedDB storage (gigabyte scale) and are no longer affected by the tight localStorage limit — existing entries move there automatically the first time the chart is opened. If browser storage still cannot be written (full or blocked), the workspace says so immediately with a clear error message, the compose field stays open with your text, and nothing is falsely shown as saved. Before giving up, the app automatically frees its own re-derivable caches and retries; if the message still appears, free up browser storage (for example by clearing other sites’ data) and save again. To keep it from getting that far, a warning banner appears in the case view once local storage is about 80% full — especially important on managed hospital machines where browser settings cannot be changed. Also enable the account backup or cloud sync in Settings so your entries are additionally protected independently of device storage.

Inside the workspace, the help assistant (the ? icon in the top bar) answers questions about features and workflows. For anything it cannot resolve — bugs, billing, privacy requests — use the contact form and our team will respond by email.