Built to keep a confidence
Therapists hold some of the most sensitive data there is, and most run their practices on tools never designed for it. Karu is our answer: a practice platform where privacy is structural, because clients hold no passwords, clinical notes never enter the search index, and every record carries its own audit trail. We designed and built it end to end, and it is now taking early-access applications from UK practices.
The market, and the problem worth solving
Most UK therapy happens in private practice, usually one practitioner working alone. UKCP's own member snapshot found 85 percent in private practice and 70 percent working mostly solo. These are clinicians first and administrators reluctantly, and the admin arrives between fifty-minute sessions.
The pressure is real. In BACP's 2025 survey, 36 percent of therapists described their practice as over capacity, running waiting lists or referring clients elsewhere. Hours spent on notes, scheduling and chasing payments are hours not spent on the waiting list.
And the data could hardly be more sensitive. Under UK GDPR, therapy information is special category data, and even a calendar entry showing that someone attends therapy qualifies. Yet much of the market runs on generic booking tools or platforms hosted a long way from the UK, with data residency mentioned nowhere on their pricing pages.
The brief: a practice system a solo therapist would actually enjoy, private by architecture rather than by assurance, with the data held in the UK.
What we built
The platform covers the rhythm of a practice: the diary, the session, the note, the follow-through and the money, in one quiet interface.
A diary that understands therapy
Weekly and fortnightly slots that run open-ended, edits scoped to this session, all future ones or the whole series, and proper handling of the awkward cases like months with no fifth Tuesday. Cancellations record whether they fell within policy, and non-attendance is a first-class state.
Structured clinical notes
SOAP, DAP, BIRP and GIRP formats as structured sections, with drafts that autosave locally and a finalise step that locks the record. A finalised note cannot be quietly edited, which is exactly how clinical records should behave.
Clients without accounts
Clients never get a login, because the safest credential is the one that doesn't exist. Session invites arrive by email with a calendar file, and video sessions are joined through a tokenised link that only works while the therapist has the room open.
Video built in
Sessions run on the platform's own video rather than a consumer tool, with access tokens scoped to a single room and expiring with the session. No third account, no meeting IDs floating around inboxes.
The session companion
One panel beside the calendar holds notes, homework and the client's recent history, assembled by a single call. Between-session homework is assigned and tracked, journaling, worksheets, exercises, with completion feeding the next session's context.
Practice money, visible
Session fees, collected against expected, quiet flags on unpaid sessions and a short-range forecast. Enough financial truth to run the practice, without pretending to be an accounts package.
The engineering
Fifty-eight thousand lines, 78 endpoints, 33 screens, built in about 14 weeks by two engineers. The speed came from patterns we trust; the interesting decisions are all privacy decisions.
One row per exception, not per week
A recurring slot is stored as a template, and a session row is only written when something actually happens: attendance, a cancellation, a note. A weekly client for five years costs one row until real life intervenes. Series edits stay tractable because the past is immutable fact and the template governs the future.
Isolation you can't forget to apply
Every database statement and every search query filters on business and user identity before any other condition, sourced from the token rather than the request. Strong typed identifiers mean passing the wrong ID to the wrong argument is a compile error instead of a data breach.
Notes stay out of the index
Clinical note content is deliberately excluded from the search index. Records are found by client, date and structure, never by what was said in the room. Search convenience is not worth an index full of disclosures.
The least credentials possible
No client accounts means no client passwords to phish. The video join token is checked three ways before a room token is minted, and room tokens die with the session. Status changes run through an explicit state machine, and appointments can be cancelled but never deleted.
Boring, in the right places
PostgreSQL as source of truth with the search index as a rebuildable projection, complete with a zero-downtime reindex that verifies counts and rolls itself back on mismatch. Self-hosted notifications behind an allowlisted proxy. All of it on Google Cloud's London region, so the data stays in the UK.
AI with a job to do
Therapy tech is rushing into AI, and the profession is rightly wary: BACP guidance is blunt that real session details must never be pasted into general AI tools, and NHS guidance treats AI summarisation of clinical content as likely a medical device. So we did the unfashionable thing and architected for AI without shipping it prematurely.
Notes born ready for drafting
Clinical notes are stored as structured sections per format rather than one text blob, precisely so a drafting model can propose content section by section. The finalise-and-lock flow becomes the safety mechanism: AI can only ever write to an unfinalised draft, and a clinician signs every record.
Attendance risk, computed at home
The platform already holds attendance history, cancellation patterns, session cadence and homework completion. Non-attendance risk can be scored in-process on that data, with nothing sent to a third party, and surfaced as a scheduling nudge rather than a label on a person.
Intake triage as suggestion, never verdict
Structuring a presenting-issue note into suggested session type and urgency helps a practice route its waiting list. UK GDPR has firm views on automated decisions about people, so the design is ranked suggestions a human accepts or overrides, with the override recorded.
The line we hold
Any inference over client data means UK or EU residency, a contractual bar on training with customer data, a data protection impact assessment first, and features that ship off by default. In a market where only about one in nine practitioners uses AI at all, trust is the feature.
Shape, effort and money
A tight MVP engagement: small team, short timeline, and the privacy work done first rather than retrofitted.
Indicative investment
£90k to £140k for this phase
A privacy-first practice platform at this scope, scheduling, records, notes and video with a two-person senior team, typically runs £90,000 to £140,000. Deeper regulated builds with wider compliance scope tend toward £155,000 to £210,000. Excludes VAT and third-party costs, at London rates as of mid-2026. Bands for the shape, not an invoice.
Where it landed
Fourteen weeks from first commit to a complete practice system is the headline, and the part we'd show a technical due-diligence reviewer is what that speed did not cost: tenant isolation enforced by construction, clinical content kept out of indexes, and a credential surface for clients of exactly zero.
Karu is now taking early-access applications from UK practices, and the notes architecture means the AI phase can land as a feature flag rather than a rebuild.
Asked about this project
Karu is a practice-management platform for UK therapists and small practices: session scheduling, structured clinical notes, client records, built-in video and a practice money view, designed privacy-first and hosted in the UK. It is currently in early access. We designed and built it in-house at Quantum Craft.
Ready to build the thing?
Book a free 30-minute call. We'll dig into your idea, your stack and your timeline, and give you an honest read on what it will take to build and launch. You'll leave with a clearer plan whether or not you hire us.