Can I use AI to write SOAP notes under UK GDPR?

Yes, UK therapists can use AI to write SOAP notes under UK GDPR, provided you have a lawful basis, a data processing agreement with the provider, a valid mechanism for any transfer outside the UK, and a privacy notice that explains it. NoteSono stores notes in the EU; some AI processing uses providers outside the UK and EU under data processing terms that exclude training on your data. It is ICO registered and does not record sessions.

What is the lawful basis for using AI therapy notes under GDPR?

For clinical notes, most therapists rely on Article 6(1)(b) (contract) as their lawful basis, plus the Article 9(2)(h) health-care condition for health data. If your AI tool records sessions, you may also need the client's explicit agreement to the recording. Post-session summary tools process less data, which makes data minimisation easier to show.

Does using AI for SOAP notes require client consent?

It depends on the tool. Recording live sessions needs the client's explicit agreement and must be explained in your privacy notice. Tools that work from a post-session summary you dictate capture no session audio, but you still need to tell clients, in your contract and privacy notice, that AI helps write their notes. NoteSono uses the post-session summary model and does not record your sessions.

What do I need to include in my Privacy Notice for AI therapy notes?

Your Privacy Notice should explain that you use an AI tool to assist with clinical documentation, name the tool and its provider, explain what data is processed and how, state the lawful basis, explain how long data is retained, and explain how clients can access or request deletion of their data. You should also conduct a Data Protection Impact Assessment if the processing is high-risk.

Is a SOAP note format GDPR compliant?

SOAP notes themselves are a clinical documentation format — they are not inherently GDPR compliant or non-compliant. GDPR applies to how client data is processed, stored, and protected. A SOAP note stored securely on EU servers with proper access controls is GDPR compliant. A SOAP note processed by an AI provider with no Data Processing Agreement and no valid transfer mechanism is not. NoteSono stores notes in the EU and has data processing terms in place with the AI providers it uses, some of which are outside the UK and EU.

Do I need to register with the ICO to use AI for therapy notes?

Most therapists in private practice who hold client records electronically must pay the ICO data protection fee, whether or not they use AI. It is £52 a year for most sole practitioners, or £47 by direct debit. If you use an AI tool, list it in your record of processing and make sure you have a Data Processing Agreement with the provider.

How does NoteSono handle AI SOAP notes?

NoteSono is built for UK private practice and designed around UK GDPR. It is ICO registered (ZC045529), stores notes in the EU, and works from your post-session summary rather than a session recording; we don't keep your recording. Some AI processing uses providers outside the UK and EU under data processing terms that exclude training on your data. SOAP is included on the free plan.

AI SOAP Notes and UK GDPR: 6 Checks Before You Trust a Tool

AI tools for therapy notes have advanced rapidly. A well-prompted AI can now draft a usable SOAP note from a brief post-session summary. For UK therapists, the question is not whether the technology works — it is whether using it is consistent with UK GDPR and your professional obligations.

The short answer: yes, UK therapists can use AI to write SOAP notes under UK GDPR. But the details matter. This guide covers the checks to make.

What are SOAP notes and why do UK therapists use them?

SOAP is a structured clinical note format that divides each session into four sections:

Subjective — what the client reports: their mood, presenting concerns, what they say happened since last session
Objective — your clinical observations: affect, behaviour, appearance, mental state
Assessment — your clinical interpretation: formulation, diagnosis if applicable, progress towards goals
Plan — next steps: interventions planned, homework, referrals, next session

SOAP notes are widely used by UK therapists in private practice, NHS Talking Therapies and other NHS settings. They provide a clear structure for clinical records. Professional bodies don't require any particular format, but SOAP covers what a good record needs.

How AI writes SOAP notes in practice

There are two main approaches AI tools use to generate SOAP notes:

1. Session recording and transcription

The AI records the therapy session in real time, produces a transcript, and generates a SOAP note from the transcript. Tools like Upheal and Mentalyc offer this approach (Mentalyc also accepts dictated summaries). It is powerful but creates significant data protection obligations: the client must consent to recording, the recording must be stored securely, and you need to ensure the recording is covered by your GDPR compliance framework.

2. Post-session dictation

After the client leaves, the therapist speaks a brief summary — covering what happened, how the client presented, what interventions were used, and what the plan is. The AI formats this into a structured SOAP note. No session audio is captured. Tools like NoteSono use this approach.

For GDPR purposes, the post-session dictation model is significantly easier to justify. The data processed is limited to what the therapist chooses to share, and the client's voice is not captured. You still decide what goes into the summary, so keep identifying details out of it.

UK GDPR and AI therapy notes: what you actually need to know

1. Lawful basis for processing

UK GDPR requires a lawful basis for every type of personal data processing. For clinical notes, you likely rely on:

Article 6(1)(b) — processing necessary for the performance of a contract (your therapeutic contract with the client)
Article 9(2)(h) with DPA 2018 Schedule 1 paragraph 2: the condition for processing health data for health-care purposes, including maintaining clinical records

If your AI tool records sessions, you may also need explicit consent from the client under Article 9(2)(a) — which must be freely given, specific, informed, and withdrawable.

2. Data minimisation

UK GDPR requires you to collect only the personal data that is necessary for your stated purpose. A tool that records an entire 50-minute session and produces a transcript processes significantly more client data than a tool that processes a 2-minute post-session dictation. Data minimisation is both a legal principle and a practical risk management approach.

3. Data location and international transfers

If your AI tool stores or processes data outside the UK, that is a restricted transfer under UK GDPR and needs a mechanism. For the EU, the UK recognises EU data protection as adequate. Transfers to the US need either the UK-US data bridge (if the US company is certified under it) or the UK International Data Transfer Agreement (IDTA) or UK Addendum. Ask your provider which applies, and mention it in your privacy notice.

NoteSono stores your notes in the EU. Some AI processing uses providers outside the UK and EU under data processing terms that exclude training on your data.

4. Privacy Notice requirements

Your Privacy Notice must be updated to include:

That you use an AI tool to assist with clinical documentation
The name of the tool and its provider
What data is processed and for what purpose
The lawful basis for processing
Data retention periods
Client rights (access, deletion, correction)
Any transfer of data outside the UK, and the safeguard used
How to complain to you about data protection, and how to complain to the ICO

5. Data Processing Agreement

When you use a third-party AI tool to process client data, that company becomes a data processor under UK GDPR. You must have a Data Processing Agreement (DPA) in place with them. Any reputable AI notes tool will provide this.

6. ICO registration

Most UK therapists in private practice must pay the ICO data protection fee, whether or not they use AI tools. It is £52 a year for most sole practitioners, or £47 by direct debit. If you use an AI tool, update your record of processing to include it.

What BACP and professional bodies say about AI notes

BACP hasn't published specific guidance on AI clinical notes (it has surveyed members). Its Ethical Framework still applies, and to our knowledge UKCP, NCPS and COSCA have not published AI-specific guidance either. Applied to AI notes, the general principles point to:

Transparency with clients — clients should be informed if AI is used in any part of their care, including note-writing
Data minimisation — use tools that process the minimum necessary client data
Lawful data handling: make sure the tool fits UK data protection law, including any transfer outside the UK
Clinical oversight — AI-generated notes must be reviewed and approved by the therapist before becoming part of the clinical record
Accuracy — the therapist is responsible for the accuracy of the note, not the AI

A practical checklist for using AI SOAP notes under UK GDPR

Before using any AI tool for clinical notes, work through this checklist:

You know where the tool stores and processes data, and which transfer mechanism covers anything outside the UK
You have a Data Processing Agreement with the tool provider
Your ICO data protection fee is paid
Your privacy notice has been updated to mention the AI tool
You have recorded your lawful basis for processing
If the tool records sessions: clients have given explicit, informed agreement before recording begins
You review every AI-drafted note before filing it as part of the clinical record
You have a process for responding to subject access requests that includes AI-drafted notes

How NoteSono answers these checks

NoteSono was built for UK therapists in private practice. Here is how it answers the checklist:

Notes stored in the EU; some AI processing uses providers outside the UK and EU under data processing terms that exclude training on your data
ICO registered: ZC045529
Post-session summary: no session recording
We don't keep your recording
Data Processing Agreement provided
SOAP, DAP, BIRP, GIRP, Narrative, Intake and 14 more formats: 20 in total
Start free — 5 notes a month, no card, no time limit — with a 7-day trial of everything whenever you want it
£14.99/month for unlimited notes and all formats

SOAP is included on the free plan. Create a free account

Does a post-session workflow suit high-volume practitioners?

For therapists with a high session volume, speed of documentation matters. NoteSono is built around the post-session summary: you speak a short summary after the client leaves, and the AI drafts a SOAP, DAP or BIRP note for you to review. There is no in-session recording to manage, no session transcript to clean up, and no upload step.

How much setup does it take?

Some AI note tools need setup time: configuring templates, connecting to an EHR, or learning a new workflow. NoteSono's workflow is simple: open the app after a session ends, tap Record, speak naturally, tap Stop. Your note appears in the format you chose, ready to review. There are no integrations to configure and no templates to build.

Common questions

UK therapists often ask whether AI-drafted SOAP notes are acceptable to professional bodies and insurers. No UK body prohibits them, but check with your insurer. What matters is that the note accurately reflects the session, has been reviewed and approved by you, and is stored lawfully. The AI generates a draft; the therapist is responsible for the final content.

Some therapists worry that AI notes will feel generic or miss important clinical nuance. NoteSono's AI is prompted to produce clinical language appropriate for UK private practice, and you can add AI style instructions to adjust the tone — clinical and formal, reflective and person-centred, or integrative.

Related guides

Free tools: our CPD hours calculator and private practice earnings calculator are free to use with no sign-up.