Legal & compliance

Licensing — no category applies today

Counselling, psychology and psychotherapy are not licensable healthcare services in Singapore today: the Healthcare Services Act schedules sixteen licensable services, and no mental-health counselling service is among them. But the Act defines a “healthcare service” broadly — care of the body or mind, reward or not. We therefore design strictly on the non-clinical side of that line, and watch for any future scheduling.

AI in health — the standard regulators would reach for

MOH and HSA’s AI guidance (AIHGle 2.0, 2026) is written for licensed providers, so it does not formally bind a non-licensed service — but it is the yardstick a regulator would use. Its sharpest rule: consumer AI must not produce outputs that require clinical expertise to interpret safely, even when accompanied by disclaimers. Disclaimers never rescue a clinical design. That is why the AI here is never the therapeutic actor, and every screen says what it is.

Titles and the professions

“Counsellor” is not a protected title in Singapore; SAC registration is voluntary and has been since 2003. Psychologist titles are changing: MOH announced in May 2026 that the five subdisciplines — including counselling psychology — will be reserved for registered practitioners, with a public register to follow. Teman never uses reserved titles, for the AI or for anyone on the panel who is not registered.

The code we build to

We hold the operating design to the Singapore Association for Counselling’s Code of Ethics: truthful public statements (Section I), confidentiality bounded by the duty to protect from harm (B.4), competence and supervision (C.2–C.3) — and no fee sharing with third-party agents (A.4.3). Our panel counsellors’ registration obligations stay theirs.

And A.4.3 is now the live question, not a settled one. Sessions are booked and paid through Teman, which collects the member’s payment and remits the counsellor’s share after deducting an administration fee. That is a fee-sharing structure with a third-party agent, and A.4.3 is the clause that speaks to it. We are not going to argue the point in our own favour on a public page. It is with Singapore counsel, and the answer decides whether this model can open at all. Until it is answered, no panel counsellor is asked to rely on the arrangement — nobody joins the panel on terms that depend on an answer we do not have.

Where your conversations are kept, today

Your conversations are kept on Teman’s own server — a single machine in a Singapore data centre. What that machine is, and what it is not, is the paragraph below.

One machine we control is easier to reason about than a service we do not: the whole of your history is one file that can be inspected, backed up, and deleted from. It is also the same file that has to be protected, so what protects it — and where that protection stops — is the card beside this one.

Your account and conversations are on that server. Your check-ins, bookings and cases are still kept in the browser you used, and do not follow you to another device.

The safeguard, precisely — and what is missing

• In transit, encrypted — the site is HTTPS only
• Passwords are never stored — only a scrypt hash, which cannot be turned back into your password
• Every read and every write is scoped to your account — the server resolves who you are from a session cookie the page cannot read, never from anything the page sends, so no request can ask for somebody else’s conversation
• The service runs sandboxed — a read-only filesystem, one writable directory, and its own service account
• No sale, no ads, and no consent-free reuse — nothing you write is used to improve the system unless you separately, explicitly opt in. That switch is on your Member page: off unless you turn it on, and yours to turn back off. Nothing reads it yet, so today nothing is used either way

Conversations are encrypted in transit. On the server they are protected by the operating system’s file permissions and a service account that can write nothing else — not by encryption at rest. Anyone with root on that machine can read the database file. Access to the machine is the boundary, and we would rather say that than let “encrypted” stand unqualified.

One more, because it is easy to assume otherwise: your messages do reach the AI provider, and that provider is outside Singapore. Identifiers are stripped on the way out — NRIC and FIN numbers, phone numbers, email addresses, links, handles and postal codes are replaced with markers before the call, and the words themselves stay in the store on this server. Names, places and employers in ordinary sentences are not removed. A pattern cannot find “my supervisor at DBS, Priya” without either missing it or shredding the sentence it is in, so that is not attempted rather than half-done. The pass reduces what crosses the border; it does not make the text anonymous, and we do not call it that.

How long we keep it, and what happens if it leaks

If you use Teman without an account, what you say is kept too. That changed on 9 October 2026 and it is worth saying plainly rather than burying: a conversation held before you sign up is stored on this server, on the same terms as one held inside an account, and the team running Teman reads it while the service is new. The footer links this page from every page of the site, and this is where it is stated in full — the same 24 months apply to those conversations and the same age-based delete covers them; what a guest does not have is the button, because there is no account for a delete to be scoped to. If you would rather not be read at all, 1771 is answered by a person who is not Teman.

Conversations are deleted after 24 months with nothing said in them — counted from the last message, not from when the conversation began, so one you still use is never purged and one you have left behind does not sit on the machine indefinitely. It is the same real delete as the ones you can ask for below, and what survives is the same textless record: when it went, how many messages went with it, and that the reason was age rather than a request.

When a reply is read aloud, the audio is kept with the conversation — that is what makes the speaker button still work when you open a past conversation months later. It is stored beside the message it reads, it is deleted with it (a delete takes the voice as well as the words), and it ages out on the same 24 months. Nothing is kept for a conversation you never signed in for: a guest's replies are read aloud at the time and not stored.

If data is ever exposed it is handled as an incident rather than filed under a policy: opened on the machine, assessed as notifiable or not, and — where it is — notified to the Commission and to the people affected, inside the region’s strictest clock of 72 hours. Singapore’s PDPA sets no hour count; 72 is the bar we hold ourselves to, not a local deadline. The assessment and the reason behind it are recorded either way, because an incident that was assessed and closed is the record the law asks for, and an incident quietly dropped is not.

What you can ask for

• Deletion while you are signed in — delete any single conversation from Chat sessions, or every conversation at once from Member. The messages are destroyed, not hidden, and the spoken audio goes with them: a delete is a real delete, and it is not recoverable
• What survives a deletion, and why — a record with no text in it: the dates, how many messages went, and whether the crisis screen had fired. It exists so that a conversation the crisis screen fired in is not indistinguishable from one where it stayed quiet — the fact that a screen matched, and when, is the one thing a deletion does not take with it. It holds no message, and no title — a title is your own first sentence, so it goes with the rest
• Access, correction and export — a copy of your data and anything wrong put right, within statutory timelines. Today this is answered by a person over email rather than self-service
• Closing your account entirely — not built yet. It needs rules for bookings you have paid for and are owed, so it is being written rather than improvised. Until it exists, ask and it is done by hand
• A human — data requests and complaints are answered by people, not a chatbot

The data groundwork is built once, to the strictest standard in the region rather than four times over as each market opens — Indonesia’s GR 33/2026 is the tightest bar in it, and the one this section is written against.