You are about to put clinical records into software someone else runs. Here is exactly what happens to them, what we hold, and what you can check for yourself.
NoteSono was designed from day one for UK private practice. Every decision — from data hosting to how you refer to clients — was made with BACP guidance in mind.
Your notes, client records and account data are stored in the EU. AI features use providers outside the UK under data processing terms, set out in our privacy policy.
Registration ZC045529. Auditable, accountable, compliant by design.
Your session is never recorded. Only your post-session summary is processed.
Client names never enter the system. GDPR-safe by default.
A ready-to-use AI consent template aligned with current BACP guidance.
Export or delete everything at any time. No lock-in.
Not a ticket number, not a chatbot, not a script. Someone who knows the product, usually within the hour. If something breaks we tell you what broke and when it is fixed.
Your data is held in the EU
Our hosting is in the EU. Transfers from the UK to the EEA are permitted without additional safeguards, and we will sign a data processing agreement with you.
ICO registered ZC045529
Registered with the Information Commissioner as a data processor. The number is checkable on the ICO register.
Sessions are never recorded
No audio of a client speaking about their private life exists, so there is nothing for them to consent to and nothing to retain.
Clients are reference codes
We hold the code you choose and no mapping to a real identity. A breach exposes clinical text attached to nobody.
Export everything, any time
In full, including after you stop paying. A lapsed account moves to the free plan — 5 notes a month, and everything you have written stays readable and exportable in full.
Built on what practitioners ask for
The no-AI mode, the person-centred format and EAP tracking all came from therapists telling us what was missing.
Your records are held in the EU, with our hosting provider's EU region. The UK recognises the EEA as providing adequate protection, so a UK practitioner storing client records there needs no additional transfer mechanism — no standard contractual clauses, no extra paperwork.
That is not the same as saying UK and EU data protection law are identical. They are not. Both began as the same regulation, but the UK's Data (Use and Access) Act 2025 — most of it in force since February 2026 — has introduced real differences in areas including recognised legitimate interests, automated decision-making, subject access requests and cookies. The European Commission renewed the UK's adequacy decision in December 2025, running to December 2031, having reviewed those changes.
What that means for you in practice: you remain a UK data controller under UK GDPR, regulated by the ICO, regardless of where the servers are. Hosting location does not change which law you answer to. It changes whether a transfer needs extra safeguards, and here it does not.
Nothing here is behind a sales call. Read it before you sign up, not after.
Privacy policy
What we collect, why, how long we keep it and who processes it.
Data processing agreement
The contract you sign as data controller with us as processor.
GDPR information
Your obligations and ours, set out in plain terms.
Our commitment to privacy
The design decisions behind how client data is handled.
BACP consent template
Wording you can add to your existing client contract.
Cookie policy
What runs in your browser and what it is for.
7-day free trial, no card required. If anything above raises a question, email us before you sign up and a person will answer it.
Create a free account