AI Scribes — Vendor Intelligence Profile

Mentalyc

AI documentation platform for mental health and behavioral health providers.

Review RequiredElevated RiskHIPAA: Conditionalmentalyc.com
BAA Status

Verify Directly

HIPAA Suitability

Conditional

SOC 2

Not publicly disclosed

SSO

Not publicly disclosed

API

Not publicly disclosed

Deployment

Cloud (SaaS)

Vendor Overview

Industry

Healthcare AI / Behavioral Health

Deployment Model

Cloud (SaaS)

Primary Users

Therapists, behavioral health providers, mental health practices

Healthcare Suitability

Conditional — BAA and psychotherapy note handling must be verified

Headquarters

United States

Primary Use Cases

  • Automated therapy session notes
  • Progress note generation
  • SOAP note documentation
  • Mental health encounter documentation

Security & Compliance

BAA Availability

Verify Directly

HIPAA Suitability

Conditional

SOC 2 Status

Not publicly disclosed.

ISO Certification

Not publicly disclosed.

Authentication / SSO

Not publicly disclosed.

Access Controls

Not publicly disclosed.

Audit Logging

Not publicly disclosed.

Data Retention

Processes highly sensitive mental health PHI including psychotherapy notes. Data handling, retention, and AI training policies must be reviewed carefully.

Customer Data Usage

Not publicly disclosed.

Model Training Practices

Not publicly disclosed.

Security Documentation

Not publicly disclosed.

Privacy Documentation

Not publicly disclosed.

Incident Response

Not publicly disclosed.

BAA Details

BAA availability must be confirmed. Given the sensitivity of mental health documentation, BAA execution is critical before deployment.

Compliance Notes

Mental health notes carry additional HIPAA protections beyond standard PHI. BAA, patient consent, psychotherapy note handling policy, and data retention must all be reviewed.

AI Governance

AI Classification

Clinical Documentation AI

Human Review

Required — AI outputs must be reviewed by a qualified professional before clinical or operational action.

AI Output Risk

Not publicly disclosed.

Oversight Considerations

Sensitive mental health PHI requires heightened safeguards. Use restricted until BAA and psychotherapy note handling are verified.

Approval Workflow

Standard VNDRIQ vendor approval workflow recommended.

Monitoring Cadence

Quarterly

Suggested Owner

IT / Compliance / Clinical Governance (varies by use case)

Escalation Triggers

BAA changes, privacy policy updates, new AI features, security incidents, acquisitions.

Enterprise Readiness

Ideal Customer

Therapists, behavioral health providers, mental health practices

Vendor Maturity

Emerging — Newer entrant or limited healthcare documentation available.

Enterprise Readiness

Mid-Market — Appropriate for mid-size practices and growing organizations.

Implementation Complexity

Not publicly disclosed.

Integration Requirements

Not publicly disclosed.

EHR Integrations

Not publicly disclosed.

SSO / API

Not publicly disclosed.

Support Model

Not publicly disclosed.

Business Continuity

Not publicly disclosed.

Evaluation Criteria

Security Controls

3/5

Compliance

3/5

Data Privacy

2/5

Vendor Transparency

3/5

Healthcare Readiness

3/5

Governance Readiness

2/5

Implementation Guidance

Restrictions

Sensitive mental health PHI requires heightened safeguards. Use restricted until BAA and psychotherapy note handling are verified.

Implementation Notes

Verify BAA, psychotherapy note handling, patient consent workflow, data retention, access controls, and AI training policy.

Monitoring & Review

Under ReviewLast: 2026-06-04 · Next: 2026-12-04

Review Cadence

Quarterly

Items to Monitor

BAA status, privacy policy, AI feature changes, security certifications, EHR integrations.

Documentation Gaps

Not publicly disclosed.

Vendor Change Triggers

Privacy policy changesTerms of service changesBAA changesSOC 2 renewalNew AI featuresEHR integration changesSecurity incidentAcquisition or funding event

Approval Recommendation

Review Required

Vendor requires additional documentation review before approval. BAA, security certifications, and data handling policies must be verified.

Required Due Diligence

Verify and execute BAA
Request SOC 2 report
Verify SSO availability
Review data retention policy
Confirm AI training opt-out
Document in vendor risk register

Internal Owner

IT / Compliance / Clinical Governance

Documents to Collect

BAA, security questionnaire, privacy policy, data processing agreement.

Executive Buyer Checklist

0/11

Use this checklist to track your evaluation progress for Mentalyc.

Vendor Intelligence Hub

Explore Mentalyc in Context

Related Vendors

Discover Alternatives and Comparisons

Similar Vendors

Other AI Scribes vendors in the VNDRIQ registry.

Approved Alternatives

Vendors with approved or conditional approval status for healthcare use.

Frequently Compared

Compare Mentalyc side-by-side with these vendors.

Related Vendors

Profile Completeness

83%10/12 trust fields

Missing Fields

SOC 2 StatusEHR Integrations

Vendor Snapshot

Category

AI Scribes

Headquarters

United States

Deployment Model

Cloud (SaaS)

Healthcare Suitability

Conditional — BAA and psychotherapy note handling must be verified

Risk Level

Elevated Risk

Review Confidence

Under Review

Last Reviewed

2026-06-04

Risk Score

66/100

AI Trust Score

67/100

Start Vendor Review

Request a structured risk assessment for Mentalyc.

VNDRIQ vendor profiles are for operational risk screening and governance support. This is not legal, compliance, or cybersecurity advice. Final vendor approval should include legal, compliance, security, and contract review. Data is based on publicly available information and internal review at time of last verification.