This article is general information, not legal advice. AI providers change their terms often, and national law and professional codes add their own requirements. Check the current terms of any tool, your national law and your professional body's guidance before you use AI with client data.

Why this is a GDPR question at all

Everything you type into an online AI chatbot is sent to the provider's servers, processed there and, depending on the product and settings, stored for some time. If that text contains information about a client, you have just disclosed health data (special-category data under Article 9) to a third party. As the controller, you need a lawful basis for that disclosure, a data processing agreement if the provider acts as your processor (Article 28), security appropriate to the risk (Article 32) and, if the data leaves the EU or EEA, a valid transfer mechanism.

On top of the GDPR sits your duty of professional confidentiality. Even where data protection law might technically allow a disclosure, your professional code may not. A client who confided in you did not agree to have their story processed by a general-purpose AI service.

“I removed the name” is usually not enough

The most common defence is that the text was anonymised. In practice, therapy content is very hard to anonymise. Under the GDPR, data is only anonymous if the person can no longer be identified by any means reasonably likely to be used. A session summary that mentions a client's age, profession, town, family situation and a recent life event can identify someone even without a name, especially to anyone who knows them.

Replacing the name with “Client A” produces pseudonymised data at best, and pseudonymised data is still personal data. The safe assumption is simple: if the text is about a real client's life, treat it as personal health data, whether or not a name is in it.

What is generally fine and what is not

The line runs between content about your practice and content about your clients:

Task	General chatbot
Drafting a blog post or your website bio
Writing a generic psychoeducation handout
Rewording your cancellation policy
Brainstorming questions for a fictional training case
Summarising a real session from your notes
Drafting a letter about a real client to a GP or employer
Asking for a diagnosis based on a real client’s symptoms
Uploading recordings or transcripts of sessions

The crosses do not mean AI can never help with clinical documentation. They mean that a consumer chatbot used with default settings is the wrong place for it. If you want AI support for notes, it needs to run inside a set-up that meets the conditions below.

Six questions to ask before any client data goes in

Whether you are looking at a chatbot's business plan, an AI scribe or an AI feature inside your practice software, work through these questions and keep your answers on file:

Is there a data processing agreement? Without one that covers your use, the provider is not your processor and you should not send client data.
Is my input used to train models? Terms often differ between free, paid and business plans, and settings can change. You want a clear, contractual no.
Where is data processed and stored, and for how long? Transfers outside the EU or EEA need a valid legal mechanism, and retention should be as short as possible.
Who at the provider can access it? Ask about human review of conversations, for example for abuse monitoring.
Have I done a risk assessment? New technology applied to health data is exactly the situation where a data protection impact assessment (Article 35) may be required. Check your supervisory authority's guidance.
Does my client know and agree? Even when another lawful basis applies, transparency is required, and many professional bodies expect explicit consent for AI-assisted notes.

The last point deserves its own document. Our guide on consent for AI-assisted therapy notes lists what such a consent form should cover, and the data processing agreement checklist helps with question one.

Risks beyond data protection

Even with a sound legal set-up, AI-generated text brings clinical risks that remain your responsibility:

Invented details: a language model can add symptoms, quotes or interventions that never happened, and a note is a record you sign.

Flattened nuance: generated summaries tend towards generic phrasing that loses the specific language your client used.

Biased interpretations: suggested formulations or diagnoses can reflect bias in the training data.

Over-reliance: drafting a note is also a moment of clinical reflection, and outsourcing it entirely can weaken your own formulation.

Shadow records: chat histories become a second, unmanaged copy of client information outside your record-keeping system.

A safer workflow you can use today

You do not need AI to cut documentation time. A lot of the saving comes from structure. Here is a workflow that keeps client data in one protected place:

Pick a note format and stick to it. SOAP, DAP, BIRP or GIRP give you headings to fill in rather than a blank page. Not sure which suits you? Compare them in our guide to progress note formats.
Write notes straight after the session in your practice software, not in a separate app you will copy from later.
Use AI only for practice-level text such as handouts, email templates or your website, with no client details in the prompt.
Keep one record. Do not paste client content into chat tools, so there is no second copy to manage, secure and delete.
Review your set-up yearly, including any AI tools, their terms and your consent forms.

In PRAXINGO, notes use SOAP, DAP, GIRP, BIRP or free-form templates and are end-to-end encrypted with a key derived from your own password, so PRAXINGO cannot read them. An AI note assistant is on the roadmap for the Max plan and marked as coming soon; it is not available yet, and when it arrives it will have to meet the same questions listed above. Read how client data is protected on the security page, or compare plans on the pricing page.

Frequently asked questions

Is it illegal for a therapist to use ChatGPT?

Not in itself. Using it for content that contains no client information is generally unproblematic. Entering identifiable client information without a data processing agreement, a lawful basis and appropriate safeguards is where you are likely to breach the GDPR and your duty of confidentiality.

Is a paid or business plan automatically GDPR-compliant?

No plan is compliant on its own; compliance depends on how you use it. A business plan may offer a data processing agreement and different training settings, but you still need a lawful basis, a risk assessment and transparency towards clients.

What if I already pasted client notes into a chatbot?

Stop, delete the conversations where the tool allows it, and assess whether this counts as a personal data breach that needs reporting within 72 hours (Article 33). Document your assessment, and ask your professional body or a data protection adviser if you are unsure.

Keep client notes where they belong

Structured note templates, end-to-end encrypted, in one place you control — no copies in chat tools.

Start free trial

14-day free trial · no credit card required

Can therapists use ChatGPT? GDPR rules for AI in private practice