Is Wysa private? Who can read your chats, from its AI providers to your employer

The Morse teamPublished November 11, 202610 min read

As of November 2026, Wysa is private enough that you can use it without registering, under a nickname, but it isn't private from Wysa or from the AI companies behind its replies. Your chats can be kept on Wysa's servers for up to 10 years, and OpenAI, Anthropic, or Google models help write the replies. If you get Wysa through an employer, school, insurer, or the NHS, that organisation can also receive usage and safety data, and an alert can send it your name and the message that raised it.

We read Wysa's global privacy policy (version 7.2.2, revised October 16, 2026), its change log, its list of service providers, its terms (revised June 5, 2026), its US state and UK privacy notices, its FAQ pages for the app, workplace users, clinical programmes, and Memory, its employer and NHS pages, and its App Store and Google Play listings, all on November 11, 2026. Wysa writes much of this down. It names every outside company that touches your data, keeps a dated change log, and has zero data retention set up with its AI model providers.

This isn't medical advice. Wysa says its app is "not recommended for use in crisis situations." In the US, the 988 Lifeline answers calls, texts, and chats day and night (988 Lifeline), and Wysa's policy says the app points you to helplines when you need them (Wysa).

Wysa privacy at a glance

Wysa's consumer app on iOS, Android, and the web, from its own pages, read November 11, 2026.

Who can read my Wysa chats?

Wysa says only Wysa. Its FAQ answers "Who can read and use my messages?" with "Only Wysa," and says all conversations with its AI and human coaches "are private and not shared with anyone" (Wysa). Its privacy policy adds that "No real people can listen to what you are talking about within the Conversation Space," which is Wysa's name for the AI chat (Wysa).

Software outside Wysa does read them. The policy says the Conversation Space uses third-party large language models "by default," and Wysa's service provider list names "OpenAI, Anthropic LLM, Google Gemini LLM" as receiving "conversation data" (Wysa). The prompts sent to them include "your message, summaries of your chats over a period and our validated instructions." Wysa says it has "enabled Zero data retention with the LLM provider," that your messages "are not used as training data by the LLM," and that a tool from a company called Private AI checks your messages for personal details first. If it finds any, the app asks you to change the message before it goes out.

Other services on the list get your words too. Microsoft Azure Translator, Google Translate, Dubpro, and DeepL translate chats in languages other than English, and Cerebras powers the optional Memory feature. Wysa's own staff "check the appropriateness of the LLM response at frequent intervals," and "some of the messages you send to your Wysa Coach are checked for quality" (Wysa).

The two pages don't agree on where the AI runs. The privacy policy says "all data processing by the LLM provider" happens "in their Europe data region." Since August 26, 2026, the provider list has given "USA or UK residency (for specific clients)" for the same three model providers (Wysa change log). We couldn't tell from either page which one applies to the consumer app.

Does Wysa share data with your employer or the NHS?

Wysa shares usage and safety data where your institution requires it, though its workplace FAQ doesn't mention the safety part. Wysa calls any employer, school, university, insurer, or health service that offers you the app an "Institution." Its FAQ for workplace users says your organisation does "not have any access to your conversations" and gets "overall dashboards that reflect population-related health trends" which "cannot ever reveal individuals" (Wysa).

The privacy policy is wider. It says "Where required by your Institution, and without affecting your rights, We may also share your usage and safety data with them," and "If the Conversation Space detects something that seems like an emergency, we may inform your Institution" (Wysa). The service provider list spells out how. Wysa uses Mailgun "to send an email to your Institution when you trigger an SOS, Self-harm, or abuse alert in the App," and "The email will have your name, contact, and the message that caused the alert" (Wysa).

In NHS and other clinical versions, a clinician can see more. The UK privacy policy says that with the Therapist Companion service, "with your consent we share your conversation data with your Institution to help with your care," and "Any data involving safety or risk is shared automatically" (Wysa UK). The clinical FAQ adds that once you've agreed to send app data to an NHS record system or your GP, what was sent "cannot be deleted" by Wysa (Wysa).

Does Wysa use your chats to train AI?

Its own AI, yes, in small amounts. The FAQ says "The Wysa team occasionally uses some anonymized messages to train Wysa's AI," and the privacy policy says "We might use some anonymous chats to help our AI learn better" (Wysa). Neither page offers a switch to opt out. The terms add that all data used for internal research is anonymised first (Wysa).

The outside models don't train on it, by Wysa's account. The policy says your messages "are not used as training data by the LLM," and the Memory FAQ says what Wysa remembers "is never used to train any AI model, whether ours or an external provider's" (Wysa). For what a zero retention promise does and doesn't cover, see what is zero data retention.

Is Wysa anonymous?

Mostly, at sign-up. Wysa says "You do not need to register to use the app. Just give us a nickname," and its self-help page promises "No wait times, appointments or logins" (Wysa). The policy still records an app ID for your device, your age range, your device type, time zone, and operating system, and where you tap and which screens you visit (Wysa).

What you type can name you, which is why Wysa redacts it. The FAQ asks you not to share anything that identifies you and says accidental email addresses, addresses, and phone numbers are removed "within 24 hours" (Wysa). An institution can also give Wysa your phone number for verification, and the WhatsApp version stores your phone number and WhatsApp name. A coach booking asks for emergency contact details, and the policy says a coach can call you or someone you trust in an emergency.

Who sees your Wysa chats, version by version

How private Wysa is depends on which Wysa you have. From Wysa's own pages, read November 11, 2026:

What Wysa's app store labels say

Wysa's two store labels don't match. Its App Store label, which Apple says it hasn't verified, lists only identifiers, usage data, and diagnostics, all under "Data Not Linked to You," and no health or message data (App Store). The same listing rates the app 9+, while Wysa's policy sets its minimum age at 13. Wysa's Google Play label lists "Health info," "Other in-app messages," a name, and an optional phone number among the data it collects (Google Play). Developers fill in these labels themselves, which we look at across 16 apps in AI app privacy labels.

Is Wysa safe? What it claims about security and certifications

Wysa lists several certifications, and these are its own claims. Its clinical FAQ says Wysa is certified for ISO 27001:2022 and ISO 27701:2019, holds Cyber Essentials, complies with the NHS's DCB 0129 clinical risk standard, and meets the NHS Data Security and Protection Toolkit (Wysa). Its NHS page calls its Digital Referral Assistant a "UKCA Class I medical device" and says Mozilla's Privacy Not Included guide named Wysa "Best in Privacy" in 2022 and 2023 (Wysa).

Wysa's consumer pages don't call the app HIPAA compliant. The FAQ says Wysa's hosting providers "have stringent GDPR and HIPAA compliant security programs," which describes the hosts rather than Wysa, and it calls the Zoom video sessions with a coach "HIPAA Compliant" (Wysa). The policy says Wysa may share data with "courts, police, or other important organisations" when the law requires it, and with a buyer of the company, including if Wysa is "facing bankruptcy" (Wysa). Wysa says it doesn't sell personal data or share your messages with advertisers (Wysa).

How do you delete your Wysa data?

Open Settings in the app and choose Reset my data. The policy says this deletes "all your conversation information, including your ID, past chats, reminders, assessment answers, and settings," that it can't be undone, and that you'll be treated as a new user (Wysa). A reset keeps your Premium subscription, which you cancel in Google Play or the App Store.

Three things outlast a reset or need an email. Data held by a Wysa Medical Assistant or by an institution's well-being advisor stays, "to ensure continuity of care." To delete only what Memory remembered, you email Wysa, since turning Memory off keeps it (Wysa). On WhatsApp, deleting your data also takes an email.

Three Wysa settings to check today

• Coach sharing. If you have a coach, open More, then Settings, and use Unauthorize / Authorize Emotional Wellbeing Professional, or type #sharechat in the chat to turn sharing on or off.
• Memory. Turn it off in Settings if you don't want past chats carried forward, and email Wysa if you want what it saved deleted too.
• PIN. Set one in Settings so someone holding your phone can't open your chats.

How Morse keeps a hard conversation on your device

Your words can sit on Wysa's servers, under Wysa's policy, for up to 10 years, and in a workplace or NHS version, an institution's contract decides part of what happens to them. Morse is a general AI chat app rather than a therapy or wellbeing service, and it's built so your chat history, about your feelings or anything else, stays on your device.

• E2EE, for anything no one should read. Your browser checks a secure enclave's proof that it's genuine, then encrypts your message so only that enclave can read it. Our servers relay ciphertext they can't read, and the reply is decrypted only in your browser. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE runs open-weight models like GLM, Kimi, and DeepSeek.
• Private, for everyday talking things through. It's the default for a new chat. Morse has zero data retention agreements with its inference, search, and other providers, and where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• Anonymous, for GPT, Claude, or Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address. The provider still sees the message and may keep it for a limited time to check for abuse, under its own policy, so leave out names and places.

In every mode, your chat history is stored only in your browser, encrypted, and locks when you sign out. Our servers don't keep your messages or log what's in them, and your account holds sign-in details, your plan, your balance, and a usage ledger with no content. Morse doesn't train AI on your content, sell your data, or show ads, and runs no advertising trackers or third-party analytics. Character chats show crisis lines when a message reads like suicidal thinking, and that check runs on your device. Clearing your browser or deleting your account removes your chats for good, and Morse can't recover them, so keep a copy of anything you need. Morse is for adults only.

Send a first message from the Morse home page without an account, or start free with no card. E2EE chats come with Pro, at $19 a month.