GovernAtlasSubmit your product ↗
Discover platforms/Upheal

GOVERNATLAS / PRODUCT DOSSIER

Upheal

Upheal describes therapy notes, EHR and billing workflows for mental-health practices. Its public BAA and privacy documentation address acceptance, PHI processing and permission-dependent use of sessions for training.

Explore the product ↗Add to comparison ↗

01 / CONTEXT & SCOPE

Understand the proposition.
Define the boundary.

The decision to make

Evaluate Upheal for the specific documentation and clinician-review workflow you intend to use. Define who may handle the data and approve the result before considering efficiency claims.

What this record does not establish

Upheal publishes a BAA acceptance process. Its training statement is conditional: session use for training requires explicit permission from the practitioner and client, rather than a universal prohibition. The public statements remain vendor attributed; no executed customer agreement, clinical validation or independent security testing is established.

3 current sources · 3 published assertions
Source coverage is a research boundary, not a quality score.

02 / YOUR EVALUATION

Turn interest into a useful trial.

Open the evaluation playbook ↗
A

A test worth running

Use a fictional therapy session with a correction and an uncertain history. Inspect the draft, clinician approval and export, and request a demonstration of the consent settings governing recording and any training use.

GovernAtlas editorial proposal. We have not performed this test.

B

Evidence to bring back

  1. Retain the synthetic scenario, generated draft, corrections and clinical reviewer decision.
  2. Obtain the applicable agreement version, service and integration boundary before sharing PHI.
  3. Assign owners and dates for unresolved consent, retention, training-use and exit questions.

03 / DOCUMENTED EVIDENCE

Read the claim. Inspect the basis.

Each statement retains its classification and preserved source. A vendor assertion is not an independent test result.

01
vendor asserted

Upheal states that it does not use sessions to train its platform without explicit permission from the practitioner and clients. Scope: the supplier's stated permission condition, not an independently verified no-training guarantee.

Source, dates & preserved provenanceUpheal — Privacy and data handling ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: 32eac27a16b25f17f43936e5ec37184da1080f069888d7497625ac0ebb3553df

The hash identifies the preserved capture. The live source may have changed.

02
vendor asserted

Upheal publishes a HIPAA BAA with an acceptance-based effective-date provision for the user or represented entity. The posted agreement documents a process; the customer's authority to accept and actual agreement status require separate confirmation.

Source, dates & preserved provenanceUpheal — Business associate agreement ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: a165383d5aca608a8bc893185af0bf359c5f3956989c9d58701214e70b8c944e

The hash identifies the preserved capture. The live source may have changed.

03
vendor asserted

Upheal describes AI therapy-note, EHR and billing workflows for mental-health practices. This does not establish clinical accuracy, appropriateness for a particular patient or coverage of every integration.

Source, dates & preserved provenanceUpheal — Official product overview ↗

Authority: vendor owned
Observed 2026-11-02 · Reviewed 2026-11-02 · current until 2026-12-02

Artifact SHA-256: 9ef983678a2ee78f40ee5386b7d97388bdf411334d004514b738417f8d222b1c

The hash identifies the preserved capture. The live source may have changed.

Source register

Upheal — Business associate agreement ↗vendor owned · captured 2026-11-02
Upheal — Official product overview ↗vendor owned · captured 2026-11-02
Upheal — Privacy and data handling ↗vendor owned · captured 2026-11-02
Brand asset provenance

Organization identity asset from its official website; inclusion does not imply endorsement.

Official website ↗ · Original asset ↗

04 / BEFORE YOU COMMIT

Better questions.
A clearer decision.

Resolve these with the provider and your own evaluation team.

01

Which service, plan, region and integrations does the proposed BAA cover?

02

What retention, deletion and model-training terms apply to our exact workflow?

03

Who validates outputs and owns the clinical or operational decision?

Regulatory applicability requires a separate, current determination. Inclusion is not certification.

COMPLIANCE / CLAIMS, SCOPE & GAPS

Start with the requirement.
Inspect the support.

Prepare your vendor review ↗

These labels describe this dossier’s current evidence coverage. A published mention may be a framework mapping, a qualified assertion or a limitation; it is not a compliance finding.

HIPAA

Published mention available

US healthcare privacy & security

Vendor documents BAA availability

Upheal publishes a BAA acceptance process. Its training statement is conditional: session use for training requires explicit permission from the practitioner and client, rather than a universal prohibition.

Read the source-attributed statement

Upheal publishes a HIPAA BAA with an acceptance-based effective-date provision for the user or represented entity. The posted agreement documents a process; the customer's authority to accept and actual agreement status require separate confirmation.

vendor asserted

Upheal — Business associate agreement ↗

Explore HIPAA evidence ↗

For HIPAA-regulated use, request service-specific BAA eligibility, processing scope and responsibility details. Missing evidence here does not establish noncompliance. Payment cannot alter these evidence labels.

KEEP THE RECORD USEFUL

A dossier should stand up to scrutiny.

Have a source that changes this picture? Submit it for editorial review.

Raise an evidence issue ↗