GDPR and therapy session recordings: what UK practitioners need to know

AI note-taking tools are increasingly popular in UK private practice. Many work by recording the therapy session, transcribing it, and generating notes. Before you adopt one, it's worth understanding exactly what UK GDPR says about session recordings — because the obligations are significant.

Are session recordings special category data?

Yes. Under UK GDPR, audio or video recordings of therapy sessions almost certainly contain special category data (Article 9 UK GDPR). This includes:

• Health information
• Mental health information
• Information about religious or philosophical beliefs (common in therapy contexts)
• Information revealing racial or ethnic origin

Special category data has a higher protection standard than ordinary personal data. Processing it requires an explicit legal basis under Article 9(2) — not just the standard Article 6 lawful basis.

What legal basis applies to session recordings?

For most private practitioners, the relevant basis for processing clinical data is Article 9(2)(h): medical diagnosis, the provision of health or social care treatment, or the management of health or social care systems — provided it's done under a contract with a health professional who is subject to a duty of confidentiality.

This covers your clinical notes. It may not automatically cover recording the session itself, especially if the recording goes beyond what's clinically necessary.

Consent: is it enough?

Many practitioners assume they can simply get patient consent to record sessions. Consent is valid under UK GDPR — but the Information Commissioner's Office (ICO) notes that consent must be freely given, specific, informed, and unambiguous. It must also be as easy to withdraw as to give.

In a therapeutic context, the power imbalance between therapist and patient can make "freely given" consent difficult to establish. The ICO has raised concerns about consent as a basis in healthcare contexts precisely because patients may feel they cannot refuse without affecting their care.

The storage problem

Even if the recording is lawful, storage creates obligations:

• Recordings must be stored securely (encrypted, access-controlled)
• They cannot be retained longer than necessary for the clinical purpose
• They should be deleted securely when no longer needed
• Any third party who stores recordings on your behalf is a data processor and needs a Data Processing Agreement (Article 28 UK GDPR)

If you're using a US-based AI transcription tool (Otter.ai, many others), that tool is your data processor. International transfers of special category data require additional safeguards under Chapter V UK GDPR — and the US remains a jurisdiction where these are complex.

The safest approach: no storage

The cleanest GDPR position is to never store the audio recording at all. Process it in memory — transcribe and then delete — so there's nothing to protect, retain, or eventually delete.

This is how afterclinic is built. Audio is processed entirely in memory. There is no recording, no file, no retention obligation. The only thing persisted is the structured clinical note — which you were always going to keep anyway.

What you should do before adopting any AI note tool

1. Ask the vendor: does audio leave my device? Is it stored? Where? For how long?
2. Check the DPA: do they have a GDPR-compliant Data Processing Agreement? Are they willing to sign an Article 28 contract?
3. Check transfers: if the vendor processes data outside the UK, what are the transfer safeguards?
4. Check your professional indemnity: does your insurer cover AI-assisted note-taking? Some policies have conditions.
5. Update your privacy notice: if patients might be recorded (even briefly), this needs to be in your information governance documentation.

afterclinic

afterclinic is a UK-built AI clinical notes tool designed from the ground up for UK GDPR compliance. Audio is processed in memory and never stored. No recordings, no retention obligations, no complex data transfers.

You dictate a brief post-session summary. We generate a structured clinical note. The audio never leaves your device, and nothing is stored except the note.

Join the waitlist — launching 2026.