GDPR-compliant AI scribe for therapists in Europe: how to choose

An AI scribe for therapists is software that turns the content of a session into clinical notes, then helps keep the client record and draft documents. It is GDPR compliant when the supplier can show, in a signed contract, where your clients' data goes, who processes it, how long it is kept and what it is used for.

This page gives you ten criteria to check before you sign. It is written for psychologists, counsellors and psychotherapists practising in the UK, Ireland, France, Belgium or Switzerland. It does not rank tools. For a comparison, see our page on the best AI scribes for therapists in the UK.

Why "GDPR compliant" is not enough

The GDPR does not certify software. It places duties on you, the controller, and on the supplier, your processor. Article 28 says you should use only processors "providing sufficient guarantees". Checking those guarantees before you sign is therefore up to you.

Session notes are data concerning mental health. They are special category data under Article 9, which raises the bar. The UK GDPR follows the same logic. The ICO says roles depend on who actually decides the purposes and means of processing, "regardless of how they are described in any contract".

The checklist: ten criteria to verify before you sign

1. Where data is stored, and where the AI processes it

These are two separate questions. Notes can be stored in Europe while the AI model runs in another country. Ask for the country of storage, the country of AI processing and the country of every sub-processor. A transfer outside the EU or UK is not banned in principle, but it must rest on safeguards set out in the law and appear in the contract.

Switzerland follows the same idea under the revised FADP. According to the FDPIC, data can flow freely to the countries listed in Annex 1 of the Data Protection Ordinance. Other destinations need safeguards, such as the EU standard contractual clauses recognised by the FDPIC. The FDPIC also notes that clients must be told when their data is sent abroad.

2. Health data hosting status

In France, a provider hosting patients' health data remotely must be certified or approved for it (Article L.1111-8 of the Public Health Code). The CNIL's framework for medical and allied health practices repeats this for hosted patient record software. If you practise in France, ask for the host's HDS certificate and check that it covers the servers the tool actually uses. Our page on HDS certified hosting explains more.

HDS is a French legal requirement. We found no equivalent imposed by the Belgian authority or the FDPIC, and it does not apply in the UK or Ireland. Data protection law in each country still requires security suited to the risk. Outside France, HDS or ISO 27001 certification remains a useful signal. We recommend asking which certifications cover the hosting and the AI processing, not only the company.

3. Pseudonymisation before the AI

Pseudonymisation means processing data so it can no longer be linked to a person without extra information kept separately (Article 4 GDPR). Ask whether the client's name and identifying details are removed before anything reaches the AI model, and where the lookup table is held. Pseudonymised data is still personal data (Recital 26). It lowers the risk, and the GDPR still applies.

4. Whether audio is kept

An audio file of a session holds everything that was said, including things you would never write in the record. Ask whether audio is kept, where, and for how long. Ask too how long transcripts and notes are kept, and how you can delete them yourself.

5. Reuse of data to train a model

The French regulator, the CNIL, states that a processor cannot reuse data entrusted to it on its own initiative. If it does, it becomes a controller itself. Any reuse needs the controller's written authorisation after a compatibility test, and a "prior and general" authorisation is not lawful (CNIL, 11 January 2022). Look for the exact wording in the contract and the privacy policy. Broad phrases such as "to improve our services" deserve a question. See also our page on whether AI trains on therapy notes.

6. The processor contract and the sub-processor list

Article 28 sets out what the contract must cover. The processor acts only on your documented instructions. It keeps its staff bound by confidentiality and secures the data. It helps you respond to clients exercising their rights. It deletes or returns the data at the end, as you choose. It gives you the information needed to check all this and allows audits.

It cannot engage another processor without your prior written authorisation. If the authorisation is general, it must tell you about any addition or change so you can object. So ask for the named list of sub-processors (hosting, transcription, AI model) with their countries.

7. The DPIA, and when it applies

Article 35 requires a data protection impact assessment where processing, in particular using new technologies, is likely to result in a high risk. In the UK, the ICO is direct. It says that in the vast majority of cases the use of AI will involve processing likely to result in a high risk and will trigger the legal requirement for a DPIA. If you practise in the UK, we recommend treating a DPIA as the default.

In the EU, the CNIL says a DPIA is mandatory when processing meets at least two of nine European criteria. Three of them fit an AI scribe in mental health: sensitive data, vulnerable people such as patients, and innovative technology. Recital 91 says, however, that processing patient data by an individual health professional should not be treated as large scale, and that a DPIA should not then be mandatory. The answer for a sole practitioner in the EU is therefore not settled. We recommend a short DPIA, or at least a written note of why you think one is not needed. Ask the supplier for the material that feeds it.

8. Informing clients

In France, a health professional does not need written consent to use a note-taking tool; informing the patient is enough. The CNIL framework says information must be given from the point of collection, for example through a notice in the practice or a leaflet. In the UK, Ireland, Belgium and Switzerland, we recommend telling clients before the session, both verbally and in writing, and checking the guidance of your professional body. Our pages on client consent for AI note-taking and professional confidentiality and AI go further.

9. What the tool actually does

Ask for a demo on a fictional case, using your own approach (CBT, systemic, psychodynamic, EMDR). Look at the note it produces. Is it structured the way you would write it? Does the tool update the client record, or only produce a standalone note? Does it draft the letters, certificates and assessment reports you need? How do notes leave the tool, and in what format? Our page on the AI scribe for psychologists covers these uses.

10. What the tool does not do

An AI scribe is not always practice management software. Check whether it handles scheduling, invoicing or test scoring, or whether you will keep another system for that. In every case, you read and approve each note. Clinical content and decisions remain your responsibility.

What some suppliers say on their websites

We read these official pages on 30 October 2026. They may change, so check the details in the contract before you sign.

• Heidi. According to its GDPR page, data remains within the EU/EEA. According to its safety page, audio disappears as soon as it is transcribed and your data is not used to train its AI. Its site also lists ISO 27001, SOC 2 Type II and Cyber Essentials Plus. According to its site, it also drafts letters and other documents from the note. HDS certification: not stated on the pages we read.
• Tandem. According to its data and security page, patient data is processed and stored exclusively in European data centres, audio is processed in real time and deleted immediately after transcription, and it does not train AI models on patient data. The page lists ISO 27001, ISO 13485 and ISO 42001, plus NHS DSP Toolkit compliance. HDS certification: not stated on that page.
• Upheal. According to its site, it is an EHR for therapists, with session notes and billing. According to its privacy and compliance page, it offers an EU/UK data processing agreement, uses AWS, has completed a SOC 2 Type II audit and never uses sessions to train its platform without explicit permission from you and your clients. EU hosting region and audio retention: not stated on that page.

Questions to ask the supplier

Send them in writing and keep the answers with your records of processing.

• In which country are notes, transcripts and client records stored?
• In which country does the AI model that writes the notes run?
• Can you send the named list of your sub-processors and their countries?
• Is any data transferred outside the EU, UK or Switzerland? On what safeguard?
• Is your host HDS certified, or certified to ISO 27001? Can you send the certificate?
• Are the client's name and identifying details pseudonymised before the AI?
• Is audio kept? If so, where and for how long?
• How long do you keep transcripts and notes? How do I delete them?
• Is my data used in any form to train or improve a model?
• Can you send your Article 28 data processing agreement?
• What documents can you provide for my DPIA?
• How do I export all my data if I leave?
• What does the tool do, and what does it not do (client record, letters, scheduling, invoicing)?

Why Delta

Delta is the clinical assistant for mental health and allied health professionals. Its data is hosted in France with an HDS certified host, AI processing takes place in France, the client's name and identifying details are pseudonymised before the AI, no audio file is kept and data is never used to train a model. For practitioners outside France, data stays in Europe, in France. Delta writes the session report, updates the client record and drafts letters, certificates and assessment reports (see our clinical document templates), with no scheduling or invoicing.

Sources

• Regulation (EU) 2016/679 (GDPR), EUR-Lex: Articles 4, 9, 28 and 35, Recitals 26 and 91
• ICO, What are the accountability and governance implications of AI?
• CNIL, What you need to know about the DPIA (in French)
• CNIL, framework for medical and allied health practices (in French)
• FDPIC (Switzerland), Disclosure of personal data abroad (in French)