AI-assisted session notes, professional confidentiality and GDPR: how to use them safely

AI tools can turn a few words into a decent draft of a post-session note and give a therapist back hours every week. But documentation in therapy is an area of professional confidentiality and special-category data. So before you paste anything into any chat, read these five rules.

1. Data minimisation: the AI does not need to know what happened in the session

The biggest misunderstanding goes like this: "for the AI to help with the note, I have to tell it about the session". You do not. A good tool works on short organisational jottings that you choose yourself, and the less data you provide, the smaller the risk. This is the minimisation principle from GDPR word for word (Article 5(1)(c)): process only what is necessary for the purpose.

In practice, a draft note can be built from phrases like "fear of exposure, worked on homework, progress on a 1-10 scale", with no surname, no biographical details, no quotes from the session. Only you connect the client's identifying data with the clinical content, in your own documentation.

2. Human approval: the AI proposes, a person decides

A clinical note is a document the therapist is responsible for, not the language model. That is why the only safe working pattern is approval by a human: the AI generates a draft, and you read it, correct it and consciously accept it. Research on AI-supported notes in healthcare shows that clinicians routinely correct part of the generated text. That is not a flaw, that is exactly the safety mechanism.

Professional guidance points the same way, from the Polish Society for Cognitive and Behavioural Therapy's annex on the use of AI in CBT to the guidelines of international psychological associations: AI is meant to support clinical judgement, not replace it. A tool that publishes or saves a note without your click does not belong in a practice.

3. Ephemerality: check what happens to the draft

The key question for every provider: what happens to the text I type in and to the draft that comes out? The safe answer is: processing is ephemeral, the content is not stored after the draft is generated, it does not end up in logs and it is not used to train models. If a provider cannot answer this question in one sentence in their privacy policy, keep looking.

The second part of the question is about where the processing happens: for data from a European practice, the servers should be in the European Union.

4. Paperwork: a data processing agreement and a record of processing activities

If a system processes client data on your behalf (even just appointments and contact details), you need a data processing agreement with the provider (Article 28 GDPR), and your practice should keep a record of processing activities (Article 30 GDPR). This is not bureaucracy for its own sake. These are the two documents the data protection authority will ask for first.

The good news: both can be generated automatically. In MentAI you print them from the panel, filled in with your practice's details (Settings → GDPR, practice documents).

5. The client has the right to know

Transparency is the foundation of both GDPR and the therapeutic relationship. If AI helps you with documentation, tell the client in plain language, ideally in the practice's documents or at the first visit. For purely organisational tools (appointments, reminders, a draft note from your own jottings) honest information is enough. If a tool were to record or transcribe the session, you would already need explicit, separate consent, and that is a completely different category of risk.

What NOT to do

How it works in MentAI

We built the AI note precisely around these rules: you jot down a few words, the system proposes a draft (you can choose the language of your approach, from CBT to integrative), and only what you approve goes into the documentation. Drafts are processed ephemerally in the EU. We do not store them, we do not log them and we do not train models on them. Our rules for working with AI are public, and you generate the data processing agreement and the record of processing activities from the panel. The full philosophy of boundaries, five things AI in a practice should not do, is described in "An AI assistant for therapists".

Update (20 August 2026): what about transcribing the whole session?

The minimisation rule from point 1 remains MentAI's default setting. Since August 2026, however, there is one deliberate exception: the optional session transcription module. The design difference is fundamental. Here the basis is not "the AI does not know the content" but the explicit consent of every participant in the conversation (Article 9(2)(a) GDPR), recorded in the system BEFORE recording starts; this also applies to couples and group sessions, where each participant gives consent separately.

The other rules from this text apply in the module even more strongly: the recording and the raw transcription are deleted automatically as soon as the transcript is returned, and a draft note is created only at the therapist's request (ephemerality from point 3); only a note approved by the therapist goes into the documentation (human approval from point 2); and the practice's record of processing activities is updated with the transcription activity by itself (paperwork from point 4). The therapist can also download a copy of the recording or transcript to their own device. It then becomes part of the practice's documentation and the practice is responsible for securing it. You can also upload a recording made earlier with a voice recorder, provided the participants' consents existed at the time of recording. The full rules of the module: section 3d of the terms of service (in Polish).

Try the AI note, 30 days without a cardSee the AI rules

The product interface is in Polish.

This article is for information only and does not constitute legal advice. Current as of 15 July 2026; updated 20 August 2026 (session transcription module).

New posts every week (in Polish). Follow MentAI on Facebook or Instagram: one thing a week that takes paperwork off the practice's desk.