What AI therapy notes tools are GDPR compliant in the UK?

There is no official certification, so check each tool yourself. NoteSono is designed around UK GDPR: it is ICO registered (ZC045529), stores notes in the EU, processes your post-session summary rather than a session recording, and includes a client consent template. Some AI processing uses providers outside the UK and EU under data processing terms that exclude training on your data. Many other AI notes tools were built for the US market first, with HIPAA as their starting point.

Can UK therapists use US AI notes tools like Upheal or Mentalyc?

Yes, if the terms are right. Check where data is stored and processed, which transfer mechanism covers it, and whether you get a UK GDPR Data Processing Agreement. Upheal, for example, states GDPR compliance and offers an EU/UK DPA. Whatever tool you use, tell clients about it, and get their explicit agreement if sessions are recorded.

Do I need to tell clients I use AI for therapy notes?

Yes. BACP hasn't published specific guidance on AI clinical notes, but its Ethical Framework asks you to be open with clients about the tools you use, and UK GDPR requires your privacy notice to explain how notes are processed. Clients should understand what the AI processes (your summary, not the session), where data is stored and processed, and how to ask you not to use it. NoteSono includes a ready-to-use consent template.

Is mental health data special category data under UK GDPR?

Yes. Mental health information is explicitly classified as special category data under UK GDPR, requiring heightened protection and a specific processing condition in addition to your lawful basis. The relevant condition for therapists is usually Article 9(2)(h) with the health or social care purposes condition in Schedule 1 of the Data Protection Act 2018.

AI Therapy Notes and UK GDPR: A Practical Guide

AI therapy notes tools have gone from curiosity to mainstream in the space of two years. Most UK therapists know someone who is using one. But the question that keeps coming up in supervision groups, Facebook forums, and CPD events is the same: is it actually safe to use these tools under UK GDPR?

This guide gives you a practical answer in plain language: what you need to know to use AI notes tools safely and ethically in UK private practice. It isn't legal advice, so take advice on anything specific to your situation.

Why UK GDPR matters more than HIPAA for therapists

Many AI therapy notes tools were built for the US market first, where the main health data framework is HIPAA. Some, such as Upheal, also state GDPR compliance and offer EU/UK data processing terms; others are HIPAA-focused. Check each tool's own terms rather than assuming.

As a UK therapist, HIPAA is not your framework. UK GDPR is. The two are significantly different:

Data storage — UK GDPR restricts transferring personal data outside the UK without a valid mechanism. For the US, that means the UK-US data bridge (for certified companies) or the UK IDTA or Addendum. HIPAA has no equivalent restriction.
Special category data — UK GDPR classifies mental health information as special category data requiring heightened protection and a specific processing condition. HIPAA uses the concept of Protected Health Information (PHI) differently.
Individual rights — UK GDPR gives clients rights of access, correction and, in some cases, erasure and portability. Any tool you use needs to let you honour them.
ICO fee: most UK therapists in private practice must pay the ICO data protection fee (£52 a year for most sole practitioners, or £47 by direct debit). This is a UK-specific requirement.
Accountability — Under UK GDPR, you as the therapist are the data controller. You are responsible for the compliance of tools you use, even if the tool provider has their own compliance measures.

The three types of AI therapy notes tools

Understanding how different tools work is essential for assessing their GDPR implications. There are three main approaches:

Type 1: Session recording tools

Tools like Upheal can record the actual therapy session — the conversation between you and your client. The session audio is transcribed and processed to generate notes.

GDPR implications: This is the highest-risk approach. You are processing actual therapy conversation content, including everything your client says, as special category data. You need explicit client consent for session recording, a robust DPA with the provider, and confidence that the data is handled according to UK GDPR.

Therapeutic considerations: Research on session recording in therapy shows mixed results. Some clients find it changes how they speak. Some therapists find it changes how they work. The therapeutic relationship consideration is separate from — but related to — the GDPR one.

Type 2: Post-session dictation tools

Tools like NoteSono and Quill work differently. You speak a brief clinical summary after the session ends — in your own words, without the client present. No session is recorded. The AI processes your summary, not the therapy content.

GDPR implications: Lower risk. No recording of the session enters the system; only your summary does. Your summary should not include client names or identifying details, only reference codes and clinical content. The AI processes what is effectively your clinical notes draft.

Type 3: Template-filling tools

Some tools provide structured templates that you type into manually, with AI assistance to suggest language or complete sections. No recording is involved.

GDPR implications: Depends on what data you enter. If you enter client-identifying information, it is processed by the tool. If you use reference codes only, exposure is minimal.

What "UK GDPR compliant" actually means for AI notes tools

When a tool claims to be "GDPR compliant," it's worth unpacking what that actually means in practice. There is no GDPR certification or accreditation — any company can claim compliance. What you should actually verify:

Data storage location — Is data stored in the UK or EU? If in the US, what transfer mechanism is in place?
Data Processing Agreement — Can they provide a DPA that covers UK GDPR requirements? This is a legal requirement when using a data processor.
What data is processed — Exactly what is sent to the AI? Session recordings? Transcripts? Your summaries?
Data retention — How long is data retained? Can you delete it?
Sub-processors — What third parties does the tool share data with? (Most AI tools send your data to a large AI company for the processing. Is that company named and covered in the DPA?)
ICO registration: is the company registered with the ICO? A UK company that controls personal data normally pays the fee.

How to assess any AI notes tool for UK GDPR compliance

Before using any AI therapy notes tool, ask these questions directly:

"Where is my data stored — specifically, in which country?"
"Can you provide a Data Processing Agreement for UK GDPR purposes?"
"What data transfer mechanisms do you use for any processing outside the UK?"
"Exactly what data is sent to AI models for processing — session audio, transcripts, or summaries?"
"Which AI model providers do you use, and are they covered in your DPA?"
"How do I respond to a Subject Access Request from a client?"
"Is audio/session data deleted after processing, and can I verify this?"

A tool that cannot answer these questions clearly is not a tool you should use with UK client data.

Client consent: what you actually need to say

BACP hasn't published specific guidance on AI clinical notes (it has surveyed members). Its Ethical Framework still applies: be open with clients about the tools you use, keep accurate records you've reviewed, and protect confidentiality. Telling clients and seeking their agreement is good practice, and it means the client genuinely understands what happens. A paragraph in small print at the bottom of your contract doesn't achieve that.

You need to explain, in plain language:

That after their session, you speak a brief summary into an app
That AI formats this into a structured clinical note
That their session is not recorded (if using a post-session dictation tool)
That you use reference codes rather than their name
Where data is stored and processed
That they can ask you to stop using AI for their notes

This conversation is usually short, and many clients have no objection once they understand what actually happens. The ones who do have objections deserve to know — and their wishes should be respected.

NoteSono includes a client consent template that covers all of this, ready to add to your existing therapeutic contract.

How NoteSono answers these questions

NoteSono was designed for UK private practice. Our answers:

ICO registered: ZC045529
Notes stored in the EU
Some AI processing uses providers outside the UK and EU under data processing terms that exclude training on your data
Post-session summary workflow: no session recording
We ask you to use reference codes rather than names; NoteSono never needs a client's name
We don't keep your recording
Client consent template included
Export of your notes and client list, and account deletion, at any time

If you want to try it, create a free account. No card needed. The consent template is included in your account.

The honest bottom line

AI therapy notes tools can be used safely and ethically in UK private practice. The key is choosing a tool that gives clear answers about where your data is stored and processed, and putting the right paperwork in place.

The questions to ask are not complicated. But you do need to ask them — and get clear answers — before using any tool with client data. Your professional insurance and your clients' trust depend on it.