🫠 Psychonaut POV

Welcome to Tricycle Day. We're the psychedelics newsletter with a reasonable cookie policy. (We prefer oatmeal raisin but won’t turn down anything freshly baked.) 🍪

Victoria Cvitanovic keeps psychedelic businesses out of trouble for a living. Believe it or not, people rarely get into healing work to think about cybersecurity or compliance. So she handles it for them, along with the scary legal letters nobody wants to open.

We asked Victoria why psychedelic content keeps getting censored on social media, what facilitators owe the people trusting them with their data, and why you should think twice before reaching for AI in and around a journey.

We started Althea's Pick because (like many of you) we were frustrated.

Too many people who could benefit from psilocybin had been priced out.

So we put our heads together and figured out how to organize a complete journey with a licensed facilitator (prep and integration included) for $500. All without skimping on quality.

We did it, and it’s been a huge hit so far.

On Tuesday, the price goes to $750. So if cost has been what’s held you back, now's the time.

And since booking starts with a quick screening, you'll want to request your spot ASAP to make it in.

I graduated law school just as progressive prosecution—the idea that you could do more good inside the system than outside it—was taking off. That's what drew me to a government job as a prosecutor. But the longer I did it, the more I saw that the people weren't the problem; drug policy was. I kept seeing people I thought should be patients getting prosecuted instead, and I couldn't do it anymore.

So I pivoted into healthcare and tech law. I wanted to understand how we have one of the most technologically advanced healthcare systems in the world and also one of the least accessible, and to become a better advocate for the policies that would change that.

I thought I'd do that for the rest of my life. Then a random accident at the gym left me in extreme pain. A doctor client told me I needed to try ketamine therapy. I was a sober Buddhist who didn't even drink, so I laughed and said I would never. So she called my priest. He asked me whether psychedelics are about connection or escapism, and that's when my whole conception of intoxication started falling apart. My loved ones weren't asking me to get high and forget the pain. They were asking me to come back. I booked the first session that day.

Coming out of the experience, the first thing I said was, "You have to let me look at your insurance." My first integration session was, effectively, going through this ketamine therapist’s insurance stack and finding gaps in coverage because I thought what she was doing was sacred. That led to other clients, and eventually I had to choose between a stable job and this work. I left because I think this is worth it.

One way these social media companies cut payroll is by outsourcing content review to AI. But AI only works as well as you govern it, and governance is expensive. Right now an AI is reading complex terms and conditions and making calls with very little oversight, so the same image in a different context can lead to a different decision. People are getting suspended and reinstated constantly, which is evidence that something's wrong with screening.

You might wonder if these platforms will fix this problem on their own. I don't think they will, for two reasons. First, they can absorb enormous losses without changing course. Meta disclosed in litigation last year that it made $16 billion off fraudulent ads, and that didn't force any real change. Users complaining about psychedelics censorship aren't going to move a company that size either. Second, the biggest verdicts against social platforms right now come from people advocating for child safety. Removing borderline psychedelics content costs these companies almost nothing, while child-safety lawsuits are producing huge verdicts. That math points toward more censorship, even when it sweeps up legitimate content like ours.

This is why psychedelic advocates need to care about AI and how it's regulated. If we don't fight for governance ourselves, the same biases that have kept certain voices from being heard will propagate automatically. I hope our community treats what's happening to us as a bellwether for censorship everywhere else.

This starts with something broader than cybersecurity. When clients come to a facilitator or healing center, they're handing over deeply personal information. They're sharing their emotions, admitting to using Schedule I substances, and sometimes disclosing a disability or a stigmatized medical condition. Someone is trusting you with pieces of themselves they can't take back, and cybersecurity, in the end, is about respect.

The US doesn't have an overarching cybersecurity law like the EU. We're operating with 50 sets of rules, and the biggest mistake I see is people thinking the only laws that apply are the ones where they're located. Very often it's where the data subject is located, and a choice of law clause doesn't always get you out of that. I also see a lot of vague consent. A client agrees to share data for one purpose, but later it gets used for something they were never told about. Failures here cost trust, and increasingly, lawsuits.

Compliance is complicated, but doable. Something I don't get asked about much, but see constantly, is businesses getting targeted by predatory lawsuits over cookie banners or age gates that fire incorrectly. Usually it's because they built their website on a third-party platform with pre-installed tracking tools. Right now it's mostly dispensaries, but I have a feeling psychedelics businesses are next. Make sure your cookie rejection actually works. Someone who wants you gone can complain to your state AG for free, or file a lawsuit for a few thousand dollars, and either one can put you out of business.

Let's start with general, publicly available AI. You're giving a lot of vulnerable data to a company that has told you it may use that data publicly, and when people are vulnerable, they tend to share identifiable information. Even with de-identification, the risk that you could be re-identified by what you put in never fully disappears.

There's also the risk of not getting helpful responses. We talk a lot about scary cases like AI psychosis, but the scariest thing to me is people in crisis using AI to search for a helpline. In incident response, we see threat actors post fake helpline numbers all at once on sites like Reddit, so AI search pulls up the most repeated number. Then you call it, they ask for your information, and that gets used to commit identity theft or ransom you. People don't understand that AI can be manipulated, and you're more susceptible to missing that when you're in a heightened state.

Specialized integration tools carry significantly fewer risks, but AI can still be wrong, and when you're open and suggestible and talking to something that's not a human, you're less able to spot its mistakes. People assume AI works like a calculator, but the same question asked ten times won't get ten identical responses. It's working on probability, not scientific accuracy. I worry about using AI in and around journeys not because there's no safe way to do it, but because contextualizing the answers gets a lot harder when you're more open.

The first thing they need to know is that they have rights, and those rights depend on where they live. Take a moment to google your state or country plus privacy laws, and you'll get a good overview of what you're entitled to.

The second thing is that there are tools to help you if something gets leaked. I like Cloaked, but there are many tools that can remove information from the dark web or pull things down after an alert.

The third thing is, if you get a data breach notification, don't ignore it. Take ten minutes to read the letter, know what got breached, and change your passwords.

And lastly, when you're choosing practitioners or organizations to trust, don't be afraid to ask about their plans for handling your data. You're entitled to control the information out there about you, and exercising that right protects you and everyone else who trusts that organization. Being reminded of their privacy obligations is good for them, too.

Connect with her on LinkedIn, or explore the legal resources and services available through her firm, Rudick Law Group.

That’s all for today, Cyclists! Whenever you’re ready, here’s how we can help.

Forwarded this email? Subscribe here.

DISCLAIMER: This newsletter is for educational and informational purposes only and is not intended as a substitute for professional medical advice. The use, possession, and distribution of psychedelic drugs are illegal in most countries and may result in criminal prosecution.