Teletherapy Platform Development — Therapy Video That Stays Private, Even in Groups.
Trembit is a teletherapy platform development company that builds the video layer for online psychotherapy and mental health care, wherever you operate: 1:1 and group sessions, private by architecture, hosted in your own jurisdiction, and designed to meet the standard your market applies — KBV certification in Germany, HIPAA in the US, GDPR/DSGVO across the EU. We built webPRAX Face2Face, a KBV-certified psychotherapy video platform in Germany, now used daily by thousands of therapists.
Trusted by Product Teams Worldwide
Teletherapy Platform Development, In Brief
Trembit is a teletherapy platform development company: we design and build the secure video layer behind online psychotherapy, from 1:1 sessions to group therapy and supervision circles, and prepare it for the regime that applies in each market you serve — KBV certification in Germany, GDPR/DSGVO across the EU, HIPAA in the US. A typical engagement starts with a two-week architecture and compliance assessment. A dedicated team of 2–4 engineers plus a tech lead then builds a production-ready MVP in about 3–4 months, followed by certification support. KBV certification itself takes months rather than weeks, from submission to listing. The main cost drivers are which regimes you need (KBV, GDPR/DSGVO, HIPAA), group sessions versus 1:1, recording or AI features that need server-side media, hosting and residency constraints, clinical tools, and the number of platforms. We give a firm estimate after a scoping call.
A teletherapy build typically includes:
- A media path matched to the session: peer-to-peer for 1:1, a forwarding SFU for groups
- Self-hosted, in-region STUN/TURN and hosting that keeps session data where the law requires
- Therapist workflows: waiting room, scheduling, encrypted notes, consent-based recording
- 2FA for practitioners, tamper-evident audit logs, and documentation reviewers can check
- Certification and compliance support for the standard your market applies: KBV in Germany, GDPR/DSGVO in the EU, HIPAA in the US
Sound Familiar?
Group sessions are fine with four people and fall apart at six.
Video turns choppy, audio cuts out, and clients on phones drop, just as the group starts to open up. It isn’t a bug. It’s where fan-out, audio mixing, and device limits converge.
German therapists can't bill your video sessions to statutory insurance.
Without KBV certification, psychotherapy sessions on your platform aren’t reimbursable in the statutory system. And the requirements rule out most off-the-shelf video stacks by design.
You can't say where patient media actually goes.
A hosted video API, a media server that decrypts streams, or a TURN relay in another region: each one puts a session’s content somewhere you can’t audit. Reviewers will ask.
Your therapists are running a meeting app, not holding a session.
Busy toolbars, participant grids, and notification badges pull attention away from the client. In therapy, the interface is part of the room.
Recording and notes feel like a liability.
Who consented, when, to what, and who can open the file later? If the answer lives in a terms-of-service page, it won’t survive a complaint or an audit.
Your compliance model doesn't travel.
A platform built for HIPAA in the US doesn’t pass German review. A DSGVO-first platform still needs BAAs and US policies. Expanding means re-architecting unless the foundation was planned for both.
One Platform, Three Rulebooks — What Each Regime Asks of Your Video Layer
Teletherapy compliance works like a ladder. The higher the rung, the more it prescribes about the media path itself, not just the paperwork around it. Design the architecture to the highest rung you’ll need, and handle contracts and policies market by market.
HIPAA (United States)
The rules are about the deployment, not the product. HHS doesn’t certify any product as “HIPAA-compliant”. What counts is encryption in transit and at rest for recordings, role-based access, tamper-evident audit logs, retention and deletion policies, and a signed Business Associate Agreement with every vendor that touches patient data, from video API to TURN relay to recording storage.
GDPR / DSGVO (EU, Germany, UK)
Mental health data is special-category data. Article 9 needs a specific legal basis. Article 28 needs a data processing agreement with every processor, including your SFU and TURN providers and their subprocessors. Residency has to be enforceable, not just “EU region”. Recording consent must be separate from session consent and withdrawable mid-session. Erasure has to reach recordings and backups.
KBV (Germany, psychotherapy billed to statutory insurance)
The most prescriptive rung: it governs the media path itself. KBV Anlage 31b requires end-to-end encryption, with no intermediary server able to access media content. It also requires German or EEA residency for every component (TURN servers included), mandatory 2FA for practitioners, a separate append-only audit trail, and video and audio quality floors that hold under degraded networks. Independent accredited bodies assess IT security and data protection before a service is listed.
| What the video layer must do | HIPAA (US) | GDPR / DSGVO (EU/UK) | KBV (DE psychotherapy, GKV) |
|---|---|---|---|
| Media encryption | In transit (DTLS-SRTP) + recordings at rest | “Appropriate” measures; E2E recommended for health data | End-to-end; no intermediary access to media content |
| Who may route media | Any vendor under a signed BAA | Processors under a DPA (Art. 28), whole subprocessor chain | No third-party media routing; STUN/TURN in-region |
| Where data lives | No federal residency rule; contracts decide | Enforceable EEA/UK residency or a valid transfer mechanism | Germany/EEA, provable per data flow |
| Access | Role-based access control | Data minimisation, purpose limitation | Mandatory 2FA for practitioners; time-limited patient links |
| Audit trail | Tamper-evident access logs | Records of processing; consent evidence | Separate append-only audit store |
| Recording | Encrypted storage, access controls | Explicit, separate, withdrawable consent | Documented consent; server-side processing must be declared |
| Who says you pass | Your own risk analysis + audits (no product certification) | Your DPO / supervisory authority | Accredited certification bodies, then KBV listing |
1:1 Sessions, Group Therapy, and the Six-Participant Cliff
Therapy video isn’t one architecture. A 1:1 session and a group of eight have different media paths, different privacy properties, and different failure modes. We pick the topology per session type, not one for the whole platform. On webPRAX Face2Face, group sessions run peer-to-peer or through a forwarding SFU, chosen by the size and shape of the session.
1:1 therapy: peer-to-peer
Media flows directly between therapist and client. When a direct path fails, it relays through a TURN server you host in-region. No media server sits in the path, so no server can process, record, or intercept the session. It’s the most private option and the cheapest to run at modest volume. This is the architecture behind webPRAX Face2Face’s 1:1 sessions.
Small groups: where P2P runs out
In a peer-to-peer mesh, each person uploads their stream to every other participant. With five or more people it’s functionally unusable on typical home and mobile connections. Even with a media server, each client in a six-person session downloads five streams, about 7.5 Mbps at 1.5 Mbps per stream, and decodes all of them. That’s past what many home connections and phones sustain.
Group therapy at scale: a forwarding SFU, tuned for therapy
The server forwards encrypted packets without decrypting them. Simulcast serves each device a stream it can handle. Audio gets its own reserved budget, because trimming “quiet” speakers is fine for a meeting and clinically unacceptable in therapy. Bandwidth pre-flight checks and mobile defaults (480p, 15–24 fps) stop a session from degrading halfway through. We test at six participants on budget phones before any group size is promised.
Source for all figures: Group Therapy Video Calls: Why 6 Participants Is a Hidden Scaling Cliff and P2P vs SFU for Telemedicine.
Session Privacy, Built Into the Architecture
When a therapist tells a client “nothing leaves this room,” the architecture has to make that literally true. These are the controls we build in, and the ones certification reviewers look at.
Media path
Hosting & residency
Recording & notes
Access & audit
Messaging
Stack we've shipped it on
Teletherapy Platform Development Services
Custom Teletherapy Platforms
For digital mental health companies and practice networks launching their own platform.
A full build of the session video, therapist and client apps, scheduling, and the compliance layer your markets require.
- Media path chosen per session type: P2P for 1:1, SFU for groups
- A calm, distraction-free session interface
- Web plus iOS and Android clients
- Compliance designed in from the first sprint, not added before launch
KBV Certification-Ready Psychotherapy Video
For platforms entering German statutory insurance care.
Architecture, documentation, and review support for KBV Anlage 31b, from teams that have been through it for psychotherapy.
- Germany-only hosting and self-hosted STUN/TURN
- End-to-end encryption and audit trails reviewers can verify
- Gap analysis of an existing platform against the requirements
- Support through reviewer feedback rounds until listing
Group Therapy & Supervision Video
For platforms whose group sessions break past a handful of participants.
Group video tuned for therapy, where every voice matters, including the quiet ones.
- SFU architecture with simulcast and per-device stream selection
- Reserved audio budget and speech-optimised Opus settings
- Breakout rooms and supervision circles
- Load tests at real group sizes on real client devices
Privacy Remediation for Existing Platforms
For teletherapy products that work but can't pass review, or were left behind by another team.
We inherit the codebase, find where session data leaks or residency breaks, and fix it at the protocol level.
- Media-path and subprocessor audit (SFU decryption, TURN location, logs)
- Consent and recording workflows rebuilt to hold up
- Take-over of stalled or undocumented video codebases
- A prioritised roadmap from "won't pass" to "ready to submit"
Therapist Workflows We've Built
A therapy platform wins or loses on the minutes around the video as much as the video itself.
Before the session
Virtual waiting room, appointment management and scheduling, single-click join with automatic audio/video setup.
In the session
Distraction-free full-screen mode, encrypted chat, a multi-user whiteboard for exercises and psychoeducation.
Trauma therapy
Built-in EMDR bilateral stimulation tools, a feature generic video platforms don’t offer.
Groups and training
Group sessions and supervision circles of up to 20 participants, with breakout rooms.
After the session
Encrypted, session-linked notes; downloadable session notes; session history per client.
Between sessions
A media library of psychoeducation content: meditations, relaxation exercises, guided sessions.
Beyond psychotherapy: the same platform serves logopedists, occupational therapists, physiotherapists, midwives, and nutritional therapists.
Related: all telehealth video → telemedicine app development · compliance engineering beyond therapy → security & compliance
Not sure which rules apply in your markets?
Tell us where your therapists and clients are, and which sessions are 1:1 and which are groups. In a free 30-minute call we map the regimes that apply, the media path each session type needs, and where the certification risk sits.
How We Build Your Teletherapy Platform
Compliance Architecture Call
We map your markets to the regimes that apply, your session types to a media path, and flag where the certification risk sits.
Assessment and Data-Flow Map
Every data flow gets a legal basis, a location, and a processor. That covers media, TURN relay, signaling, recordings, notes, and logs. For an existing platform, this is where we find what won’t pass.
Build in Sprints
A dedicated team of 2–4 engineers plus a tech lead ships the session video, therapist workflows, and compliance layer in working increments. Your CTO talks directly to our tech lead.
Test Like the Reviewer
We test quality floors on throttled networks, run group sessions at real sizes on budget devices, and check audit logs and consent records against the requirements before anyone else does.
Certification Support and Launch
We prepare technical documentation and support the review, including feedback rounds. Infrastructure is frozen during review, so nothing triggers a re-assessment. We support the review for as long as it runs, until your platform is listed.
Extend or Transfer
Most clients stay 1–3+ years. If you’d rather run it in-house, we document everything and hand over the knowledge.
Teletherapy Platforms We've Built
KBV-Certified P2P Psychotherapy Platform — webPRAX Face2Face
Challenge: A KBV-certified psychotherapy video platform in Germany. Therapist and client connect peer-to-peer, with no server-side media access or storage, on 100% German-hosted infrastructure with self-hosted STUN/TURN. Dual-consent recording, encrypted therapist notes, group sessions and supervision circles of up to 20 participants, and EMDR tools. Used daily by thousands of therapists.
Read Full Case Study →Group Video Telemedicine Platform with Clinical Tools (EU)
Challenge: Secure multi-participant consultations for distributed care teams. Adaptive bitrate for group calls, EU data residency, end-to-end encryption and audit logging. Whiteboards, e-prescriptions, and multi-provider scheduling live inside the call. Load-tested under concurrent group sessions, with failover and call recovery.
Read Full Case Study →What Our Clients Say
“Webprax Face2Face is the first platform where the technology truly disappears during a therapy session. Our therapists say it feels like the patient is sitting across from them — that’s the highest compliment a telehealth platform can receive.
“They know the inner workings of the tech and were able to inherit our semi-functional code and get it to work where multiple prior teams couldn’t.
Why Choose Trembit as Your Teletherapy Platform Development Company?
-
We've taken psychotherapy video through KBV certification
Psychotherapy video had no reference implementation to copy. We interpreted the requirements, went back and forth with reviewers, and shipped the platform that got certified. We know where teams get stuck.
-
The right topology for each session
Peer-to-peer where privacy and simplicity win, a forwarding SFU where groups need it. We don’t force one architecture on every session because it’s the one we know.
-
We design for therapy, not for meetings
Every participant’s voice matters, the interface should disappear, and consent has to be provable. Those are clinical requirements, and they change engineering decisions.
-
Protocol-level WebRTC depth
We’re one of roughly 50 companies worldwide that focus exclusively on WebRTC. When a reviewer asks where a decrypted frame could exist, we answer at the DTLS-SRTP and TURN level, not the SDK level.
Frequently Asked Questions
Building or certifying a teletherapy platform?
Tell us your markets, your session types, and where you are today. We’ll tell you which regimes apply, which media path fits, and honestly where the certification risk sits.