Therapist Client Notes on iPhone: Keeping Them Private
You type a quick note after a session, or photograph a worksheet a client filled in. That note now sits on a personal phone that may sync, back up and get borrowed. Lock it today, and keep your formal record where your practice rules say it belongs.
Try Cryptile free: join the beta on TestFlight
What do I need to know?
- Professional rules come first. Record-keeping duties such as HIPAA in the US are your responsibility. No phone setting makes you compliant.
- Unlocked notes are open to anyone with your passcode. So are photos of paperwork in your camera roll.
- iCloud may hold a copy. Under standard data protection, Apple holds the keys to unlocked iCloud Notes and Photos.
Where do my quick notes actually live?
On the phone, and often in iCloud too. Apple's iCloud data security page lists what is end-to-end encrypted. Notes and Photos are covered only with Advanced Data Protection turned on. Locked notes are the exception: Apple says they use end-to-end encryption in iCloud.
Photos of intake forms or worksheets land in your camera roll. They show up in search, Memories and any shared library you use.
What should I do today?
These steps are for iOS 27.
- Set a notes password. Settings → Apps → Notes → Password. Choose a password used nowhere else.
- Lock each client note. Open the note, tap the More button, then Lock. (Apple)
- Move worksheet photos out of Photos. Then delete them and empty Recently Deleted.
- Use initials or codes, not full names, in anything informal.
- Hide previews. Settings → Notifications → Show Previews → When Unlocked. Client messages then stay off the Lock Screen.
- Move notes into your record system and delete the phone copy once it is there.
Apple says a locked note stays open for a few minutes and locks again when you close Notes. Apple also says it cannot recover locked notes if you forget a unique notes password.
What can't Notes lock?
Apple lists limits. Notes with tags, PDFs, audio or video cannot be locked. Notes synced from Gmail or Yahoo cannot be locked, and neither can shared notes. If you sign in with a Managed Apple Account, you cannot lock notes at all.
Should I use a work phone instead?
Often, yes, if your practice provides one. Ask whoever runs it how notes are stored and backed up. A personal phone mixes client material with family photos, shared accounts and borrowed moments.
What this doesn't protect against
A locked note or a vault protects the phone copy. It is not an electronic health record, an audit trail or a compliance programme. Cryptile makes no HIPAA or other compliance claim. If you are unsure what your rules require, talk to your professional body or a lawyer.
Anyone who watches you draw your pattern can open your vault. If you lose both your pattern and recovery phrase, the vault is gone.
Do it with Cryptile
Cryptile keeps secure notes, photos and PDFs in a vault opened by a pattern, not your passcode. Each file is encrypted with AES-256-GCM, with keys made on your phone, no account and no server.
Cryptile is free for up to 2 vaults, 100 photos and 10 videos, with notes and files unlimited. Plus adds search inside the vault for $19.99 a year (7-day free trial) or $39.99 once.