privacy

that notes are only for the therapist?

They might think that they're doing so, yet still use onedrive / google docs. Ignorance - inexcusable ignorance if you ask me - but sadly not rare.

Law now says clients have to be given access to their notes, you can probably access them through a web portal or by asking. That said I do not encourage people to do so regularly because it creates the wrong kind of feedback loop where you're trying to influence the notes instead of following your therapist's (hopefully) guidance.

But HIPAA rules apply to notes, for instance the therapists I support have 365 HIPAA or better (self hosting has its own problems and most therapists aren't scaled for it).