GDPR Consent for Therapy: UK Notes, AI Tools, and Recording

A new client signs the intake pack without reading the third page. Two months later they ask whether sessions are recorded for AI notes, who stores the draft, and whether they can refuse. That is the real test of GDPR consent for therapy: not a signature on day one, but whether you can explain each processing choice when the question arrives.

This guide is a consent map for UK therapists, counseling psychologists, psychotherapists, CBT clinicians, and private-practice owners who handle notes, recordings, and AI documentation tools. It separates treatment consent from recording consent, AI transparency, and the data-processing basis for special-category health data. It is educational guidance, not legal advice. High-risk or unclear cases belong with your data protection officer, solicitor, supervisor, or professional body.

Educational resource for licensed and registered mental-health clinicians practicing in the UK (and UK clinicians seeing EU clients by telehealth). UK GDPR, the Data Protection Act 2018, and ICO guidance change over time. Verify current requirements against official sources before you rely on any workflow.

GDPR consent for therapy is not one form

GDPR consent for therapy is often searched as if one checkbox solves notes, recordings, and software. It does not.

In plain language you usually need four separate conversations:

Conversation	What it answers	Typical document
Consent to treatment	Will we work together, and on what clinical terms?	Clinical consent / treatment agreement
Consent to record	May we capture audio, video, or a transcript of this session?	Recording consent (specific, optional where care does not depend on it)
AI-tool transparency	Who drafts notes, who signs, what is stored, can the client refuse optional recording?	Privacy notice + plain-language AI disclosure
Lawful basis + Article 9 condition	Why may we process health data for the clinical record?	Privacy notice + internal record (not always “consent”)

If those four collapse into one generic signature, clients cannot give informed choices and you cannot defend the file later. The sibling guide on GDPR for therapists covers the wider notes, retention, and processor workflow. This page owns the consent layer only.

Who this guide is for

Use this page if you are a UK-based therapist or practice owner who:

• Holds therapy notes in a digital system
• Records or is considering recording sessions
• Uses or evaluates AI note-drafting tools
• Sees UK or EU clients by telehealth from a UK practice
• Needs client-facing wording that matches ICO expectations without sounding like a policy binder

HCPC standards still expect clear consent, confidentiality, and records that support safe care, even when a software vendor holds the bits and bytes. Professional rules and data protection sit side by side.

The four consent conversations therapists confuse

1. Consent to treatment

This is clinical and ethical. It covers the nature of therapy, risks and benefits at a practical level, boundaries, fees, cancellation, and how emergencies are handled. It is not automatically a UK GDPR lawful basis for holding progress notes for years.

2. Consent to record a session

Recording is a higher-friction choice. Clients need to know:

• Why you want audio, video, or a transcript
• Who can access the file (you, supervisor, vendor, AI processor)
• Where it is stored and for how long
• Whether refusal is possible without losing essential care
• How they can withdraw for future sessions

Write the answer before the first record button is used. “It helps me write notes” is not enough if a third-party processor stores the file.

3. AI-tool transparency

AI drafting is not magic and it is not invisible. Clients should understand, in ordinary language:

• A tool may help draft a note from a transcript, audio, or structured inputs
• You remain the clinician who reviews and signs
• Session content is not supposed to train public models (confirm that in writing with the vendor)
• Optional recording or transcription can be refused where care can continue without it

Transparency belongs in the privacy notice and, where recording is used, in the recording consent. Do not bury it in a 14-page terms PDF the client never sees.

4. Lawful basis and Article 9 condition

Therapy notes that reveal mental health are special-category personal data. Under UK GDPR you need:

1. An Article 6 lawful basis for processing personal data
2. A separate Article 9 condition for special-category health data

The Information Commissioner’s Office publishes the UK baseline on lawful bases and special category data. Explicit consent is only one of several routes. For ongoing clinical records, many practices document a health or social care condition under Article 9 rather than forcing every note onto consent that must remain freely withdrawable.

When explicit consent is valid

If you rely on explicit consent for a processing activity, the ICO’s consent guidance expects it to be:

• Freely given: no essential care bundled with optional marketing or optional recording
• Specific: separate choices for separate purposes
• Informed: plain language about who processes data and why
• Unambiguous / affirmative: a clear yes, not a pre-ticked box or silence
• Withdrawable: as easy to withdraw as it was to give, for future processing of that optional activity
• Documented: who consented, to what, when, and how

That standard fits optional extras well: non-essential recordings, research, marketing emails, or a specific AI transcription product a client can decline.

When consent is the wrong data-processing basis

Consent is a poor fit when the client cannot truly say no without losing care, or when you must keep the record for clinical continuity, claims, safeguarding, or legal defense.

Be careful about promising “we only keep notes while you consent.” Clinical records often need a retention schedule that survives a change of mind about marketing or optional recording. If consent is not workable for the core record, document a different lawful basis and Article 9 condition, explain them in the privacy notice, and do not pretend a signature on intake is the whole answer.

This is where practices get into trouble: one form labeled “GDPR consent” that tries to justify every processing activity forever. That form fails both transparency and withdrawability.

Edge cases (court orders, multi-agency safeguarding, contested access) belong with your DPO or solicitor, not a template blog sentence.

Notes, recordings, transcripts, and AI drafts

Different artefacts need different consent and notice treatment:

Artefact	What clients usually need to know	Consent note
Progress / clinical notes	Why you keep a clinical record, retention, who sees it inside the practice	Often not “explicit consent only”; explain lawful basis + Article 9 in the privacy notice
Session audio / video	Purpose, storage, access, retention, refusal path	Specific recording consent before capture
Transcripts	Same as recording if generated from audio; who processes the speech-to-text	Covered by recording + processor transparency
AI drafts and edited notes	That a tool may draft, you sign, drafts may be stored briefly	Transparency + processor contract; optional recording still needs consent
Between-session messages about symptoms	That portal or email content can enter the clinical file	Privacy notice, not a separate consent for every message

Write what another competent clinician needs for continuity and safety. Leave gossip and unverified third-party detail out of the shared record. Cleaner notes reduce both clinical risk and data-protection risk.

GDPR-compliant AI therapy notes

This is the section clinicians reach for under GDPR-compliant AI therapy notes and related searches such as “AI SOAP note GDPR.”

AI can draft. It cannot hold your registration, your judgment, or your duties as controller. Before session audio, a transcript, or clinical detail enters a tool, complete two tracks: the vendor track and the client track.

Vendor track (processor diligence)

1. Signed UK GDPR-ready data processing agreement
2. Named sub-processors and data residency / transfer mechanism
3. Written confirmation that client content does not train public models
4. Retention, export, and deletion controls you can actually operate
5. Encryption, access control, audit logs, and breach-notice timing
6. Human review before any draft is filed as the record of care
7. DPIA when the workflow is new, large-scale, or higher risk for health data

For product-side note patterns, see AI SOAP notes for therapy practices. Use that page for how structured notes are drafted. Use this page for consent, transparency, and lawful-basis boundaries. Platform encryption, access control, and audit logging are summarized on the security page. Product claims stay limited to published capabilities: human review before signing, no public-model training on session content, and encryption in transit and at rest.

Client track (consent and transparency)

Tell clients, before optional recording starts:

• A documentation tool may help draft the note
• You review and sign; the AI does not replace clinical judgment
• Whether audio or transcript leaves your desk to a processor
• How long drafts, audio, or transcripts are kept
• That refusing optional recording does not mean refusing essential therapy, if that is true in your workflow

Sample disclosure language you can adapt after legal review:

“I write clinical notes after sessions. With your agreement I may use a secure documentation tool that helps draft the note from an audio capture or transcript. I always review and edit the draft before it becomes part of your clinical record. The vendor is under a data processing agreement and does not use session content to train public models. You can decline recording and still receive care; I will write notes manually.”

If a vendor cannot answer the processor checklist in writing, do not put client data in the tool. If a client declines optional recording, keep seeing them and write the note yourself.

Privacy notice versus consent form

Document	Job	Typical content
Privacy notice	Transparency map for all processing	What you collect, why, lawful basis / Article 9, processors (including AI), retention, transfers, rights, ICO complaint route
Consent form (clinical)	Agreement to treatment	Clinical terms, risks, boundaries, fees, emergency process
Consent form (recording / AI capture)	Specific optional permission	Purpose, storage, access, retention, refusal and withdrawal for future sessions

A privacy notice is not a consent form. A consent form is not a privacy notice. Clients need the map even when you do not rely on consent as the lawful basis for the clinical record. Update both when you add an AI tool or change storage.

Withdrawal, refusal, and access requests

Refusal of optional recording: stop the capture for that client, note the refusal, continue care with manual notes.

Withdrawal of consent for an optional activity: stop future processing that depended on that consent. Do not claim you can un-send an email already delivered, but do stop the mailing list. Do not auto-delete the clinical record solely because marketing consent was withdrawn.

Access requests: clients can request access to their personal data. You normally respond within one month, subject to limited exemptions such as serious harm or third-party confidentiality. Build the process before the first request arrives. Search notes systems, exports, and AI draft stores.

Erasure is not always available for clinical records you still need for care, claims, or legal duties. Say that in the privacy notice before someone asks.

Download the UK GDPR therapy consent map

The downloadable map puts treatment consent, recording consent, AI disclosure, lawful basis / Article 9, withdrawal and refusal, privacy-notice updates, and DPA / DPIA prompts on one printable sheet for intake design or supervision.

How Emosapien fits this consent workflow

Emosapien is built for mental-health clinicians, not generic medical scribing. The Scribe Agent drafts structured notes for clinician review; session content is not used to train public models; and security controls include encryption plus audit-oriented safeguards described on the product security pages. UK practices still complete their own lawful-basis documentation, privacy notice, recording consent where used, DPA review, and DPIA where required. No software removes that controller work. If you want to test documentation support inside a review-first workflow, start a free trial.

US readers looking for HIPAA-framed product language should use the separate HIPAA compliant therapy notes page. That framework is not a substitute for UK GDPR consent mapping.

Closing checklist

• Treatment consent, recording consent, AI transparency, and lawful basis are four conversations, not one signature
• Explicit consent is free, specific, informed, unambiguous, withdrawable, and documented
• Core clinical records may need a lawful basis other than consent; do not overclaim
• Privacy notice names processors, retention, rights, and AI use in plain language
• Optional recording can be refused without losing essential care
• AI drafts always get human review before sign-off
• Edge cases go to your DPO or solicitor

That is the practical bar for GDPR consent for therapy in day-to-day UK practice: clear choices, honest limits, and notes you can stand behind if a client, supervisor, or regulator asks.

References

• Information Commissioner’s Office. UK GDPR and data protection guidance hub (consent, lawful basis, special-category data, controllers and processors, DPIAs, and right of access).
• Information Commissioner’s Office. Make a complaint.
• UK legislation. Data Protection Act 2018.
• UK legislation. UK GDPR (retained Regulation (EU) 2016/679).
• Health and Care Professions Council. Standards of conduct, performance and ethics.