Key takeaways
- Lawful basis under Article 6 — typically "contract" (the therapy contract) or "legitimate interests" (with LIA documented).
- Article 9 condition — typically "explicit consent" for private practice. Document it in your written agreement and confirm verbally at the start of recorded sessions.
- A Record of Processing Activities (ROPA) entry for AI-assisted note generation.
- A DPIA because automated processing of special-category data is a high-risk activity under ICO guidance.
The UK landscape in 2026 There is no large UK-native therapy-scribe market. Most options are US vendors that will sign a UK GDPR DPA on request. The procurement question is therefore not "which UK tool" but "which US tool with acceptable UK terms." The answer depends on three things: data residency, lawful basis, and what your professional body expects.
Lawful basis and consent Under UK GDPR, processing session audio is processing of special-category personal data (Article 9). You need:
- Lawful basis under Article 6 — typically "contract" (the therapy contract) or "legitimate interests" (with LIA documented).
- Article 9 condition — typically "explicit consent" for private practice. Document it in your written agreement and confirm verbally at the start of recorded sessions.
- A Record of Processing Activities (ROPA) entry for AI-assisted note generation.
- A DPIA because automated processing of special-category data is a high-risk activity under ICO guidance.
If you are not the data controller (e.g. you contract through an EAP or platform), you also need to verify their position on AI scribes — many platforms still prohibit them.
What BACP, UKCP and HCPC actually say None of the three bodies has, at time of writing, a hard prohibition on AI scribes. Common threads in their published guidance:
- Informed consent is non-negotiable — clients must understand audio is captured, transcribed, and processed by a third-party AI.
- Confidentiality remains the clinician's responsibility — "the tool did it" is not a defence.
- Records must be accurate — which means you must review and correct every AI-generated note before signing.
- Supervision should know you are using AI-assisted documentation.
Check your specific body's current guidance before deploying; this space updates frequently.
Tools that work well in UK private practice
| Tool | UK GDPR DPA | Data residency | Notes |
|---|---|---|---|
| Upheal | ✅ on request | EU option available | Best UK fit overall; EU residency is unusual among therapy scribes |
| Mentalyc | ✅ on request | US only at time of writing | Acceptable with explicit consent disclosing US transfer |
| Blueprint | ✅ on request | US only | US-focused product; verify UK availability of newer features |
| Heidi | ✅ | AU / EU options | Australian-built medical scribe; works for therapy but not therapy-native |
NHS-facing work A separate procurement track. Requirements typically include:
- DSPT (Data Security and Protection Toolkit) completion at the "Standards Met" level
- DTAC (Digital Technology Assessment Criteria) evaluation
- Clinical safety case (DCB0129 / DCB0160) for the deployment
- Information governance sign-off from the host trust
Most US therapy scribes are not on the DSPT register and will need a parallel assurance exercise before NHS use. For most NHS work, an in-house or NHS-approved transcription service is still the lower-friction choice.