I’ve recently started looking much more closely at AI transcription and note-taking tools in private practice.
If you’ve ever finished a full day of sessions with six sets of notes still to write, you’ll understand why.
Tools such as Heidi, Tortus, Upheal and a growing number of others listen during a session, create a transcript and then generate a draft clinical note. Some are built for GPs, some specifically for therapists. The admin saving is real.
Heidi did us a demo you can watch it back here
As therapists, our sessions hold some of the most sensitive information anyone can share: mental and physical health, trauma histories, sexuality, relationships, safeguarding concerns, and often information about other people who never agreed to be discussed.
Why this matters more for us than for most clinicians
Under UK GDPR, health information is special category data. So is information about sexuality, religion and ethnicity. All of these come up in therapy rooms every week.
The ICO says that to process special category data you need both an Article 6 lawful basis and a separate Article 9 condition. You also need to consider whether a Data Protection Impact Assessment (DPIA) is required.
A GP appointment might produce a few lines about blood pressure. A therapy session can produce a near-verbatim account of someone’s most private experiences. That changes the risk.
The setting most people miss
So before you press record.
Many AI scribes say they don’t keep the audio. That’s reassuring, but it isn’t the same as nothing being stored. The transcript and the generated note usually stay in your account, and how long they stay depends on a setting.
Defaults vary between platforms, and they aren’t always the short ones. Heidi, for example, is set to never delete sessions unless you change it.
So unless you’ve checked, every transcript of every session you’ve recorded could be sitting in your account indefinitely.
If you already use an AI scribe, find its retention or auto-delete setting today.
Five questions to ask before you switch any AI scribe on
What does it keep? Audio, transcript, generated note, metadata? And for how long by default?
Where is it stored? UK, EEA, elsewhere? Check the provider’s current privacy policy, not a marketing page.
Is my clients’ data used to train the AI?
Do my clients know? Something that can produce a near-verbatim record of a session shouldn’t run invisibly in the background.
Have I written down my thinking? For most therapists, that means a DPIA. More on that below.
“GDPR compliant” on a website isn’t a magic phrase that transfers your responsibility to the software company. As the data controller, you’re still accountable.
What is a DPIA, in plain English?
A Data Protection Impact Assessment (DPIA) is a written risk assessment for how you handle people’s personal information.
If you’ve ever done a risk assessment for your therapy room, it’s the same idea, applied to data. You write down:
What you’re doing. For example, using an AI tool to transcribe sessions and draft notes.
Why you need to. And whether a less intrusive way would do the job.
What could go wrong for your clients. A data breach, a transcript kept far longer than needed, an inaccurate note in their record.
What you’re doing about it. Shorter retention, multi-factor authentication, checking every note, telling clients.
Your decision. Whether the risk that’s left is acceptable, and when you’ll review it.
That’s it. It’s usually a few pages, not a report. You don’t send it to anyone. You keep it, and you’d show it if a client, your professional body or the ICO asked how you reached your decision.
I’ve put a ready-to-use DPIA template below the paywall, with example answers for an AI scribe that you can edit for your own practice, and a set-up checklist for any AI scribe, the questions to ask when choosing a platform, why a DPIA is very likely required for therapists, a fill-in DPIA template, a script for explaining it to clients, wording for your privacy notice, and what to do when a client asks for their data.