Switching therapy practice software without losing data

Before you start: what “not losing data” really means

In a therapy practice, your records are not just a convenience. They are health data — special-category data under Article 9 GDPR — and in most countries you are also legally and professionally required to keep them for a set period. So a successful switch has three goals:

• Completeness — every record you are obliged to keep still exists, in a form you can read, after the old account is closed.
• Security — the data is protected throughout the move, including the exported files sitting on your computer in between (Article 32 GDPR).
• Accountability — you can show what you moved, where it is now, and that the old provider deleted or returned what it held.

This is general information, not legal advice. Record-keeping rules differ between countries and professions, so check your national law and your professional body’s guidance before you delete anything.

Step 1: take stock of what you have

Make a simple inventory of everything your current system holds. It is easy to remember the session notes and forget the rest:

For each category, note how many records there are and how long you must keep them. Your Article 30 record of processing activities, if you keep one, is a good starting point. Our guide on how long therapists should keep client records in Europe covers retention periods in more detail.

Step 2: read your current contract and DPA

Your current provider is your processor under Article 28 GDPR, and your data processing agreement (DPA) should say what happens to your data when the contract ends — typically that the processor deletes it or returns it to you, at your choice. Look for:

• Which export formats are available, and whether exports include attachments and signed documents.
• How long you can still access your account after cancelling.
• When and how the provider deletes your data, and whether it confirms the deletion in writing.
• Any notice period or annual commitment that affects your timing.

Do the same for the new provider before you sign up: read its DPA and security information. Our data processing agreement checklist lists what to look for.

Step 3: choose your migration approach

There are broadly three ways to move. Many therapists combine them:

Do not assume a new provider can import another system’s data automatically; ask, and if it cannot, plan for the archive-plus-manual route. For a small practice that route is often the most reliable anyway, because you see every record you carry over.

Step 4: export and archive securely

1. Export every category from your inventory, in the most readable format available (PDF for notes and documents, a spreadsheet or PDF for invoices).
2. Store the export only on an encrypted drive or in an encrypted container, never in an email attachment or an unencrypted shared folder.
3. Spot-check the export: open a sample of records from different years and confirm they are complete and readable.
4. Write down the retention end date for the archive, so you know when it may be deleted under the storage limitation principle (Article 5).
5. Keep a short migration log: what you exported, when, where it is stored and who can access it.

Remember that clients keep their right of access (Article 15) to archived records. Make sure you can still find and produce a client’s data from the archive within the legal deadline.

Step 5: set up the new system and run both briefly

Plan a short overlap, ideally two to four weeks, rather than a single switch-over day. In PRAXINGO the set-up typically looks like this:

1. Create your account and set your encryption password. Client data is encrypted end to end with a key derived from it, so PRAXINGO cannot read it. Store your recovery key safely — see security for how this works.
2. Add your session types and fees, and connect Google Calendar. Sync is two-way, and appointments appear there anonymised, without the client’s name.
3. Pick your note template — SOAP, DAP, GIRP, BIRP or free-form — so new notes follow the structure you are used to.
4. Add active clients and their future appointments. Send updated documents, such as the therapy agreement and GDPR consent, from the built-in templates for digital signature or checkbox acceptance.
5. From a fixed date, write all new notes and invoices in the new system only. Two places for the same kind of record is how data gets lost.

Step 6: tell your clients — briefly

Your privacy notice must name the categories of processors you use, so update it if the change affects what it says. A short message to clients is good practice: you are moving to a new system, their data stays protected, and reminders and invoices may look slightly different from a given date. If clients will start receiving reminders by email or SMS for the first time, mention that too.

Step 7: close the old account properly

Once the overlap is over and your archive is verified, cancel the old subscription and ask the provider, in writing, to delete your data as its DPA requires. Keep the confirmation with your migration log. If the old provider ever suffers a breach that affects your data, you as controller may need to notify your supervisory authority within 72 hours (Article 33), so knowing exactly what it still holds matters.

Common mistakes when switching

Still deciding where to move? Our guide to choosing practice management software for therapists helps you compare options, and GDPR for therapists covers the wider obligations. You can see what PRAXINGO includes on the features page and compare plans on the pricing page.

Frequently asked questions