AI, therapy notes and data protection in Ireland

Why therapy notes need extra care

Session notes are health data, which GDPR treats as a "special category" of personal data (Article 9). Processing it needs both a lawful basis and a specific condition, and it calls for stronger safeguards. In Ireland, the GDPR sits alongside the Data Protection Act 2018, and the regulator is the Data Protection Commission (DPC).

Adding any software, AI or not, to how you handle notes doesn't change who is responsible. In most private practice, you or your practice are the data controller, and the software company is a processor acting on your instructions.

Your role as controller

• You need a written data processing agreement with any provider that handles client data for you (GDPR Article 28).
• You should be able to explain to clients, in your privacy information, what tools you use and why.
• For new technology processing health data, a data protection impact assessment (DPIA, Article 35) is often expected. The DPC publishes guidance on when one is required.
• If personal data is breached, controllers generally have 72 hours to notify the DPC (Article 33), so you need to know how your provider will tell you.

Questions to ask any provider

Whichever product you're considering, these questions cut through the marketing. A good provider will answer each one plainly and in writing.

1. Where is my clients' data stored and processed? Does any of it leave the EU or EEA, and if so, under what safeguards?
2. Which other companies (sub-processors) handle the data, including any AI model provider? Is there a published list?
3. Is my clients' data used to train AI models, by you or anyone else? Can I get that in the contract?
4. How long do you, and any AI provider, keep the text I submit? Is there a zero-retention option?
5. Is the data encrypted in storage and in transit, and who holds the keys?
6. Who on your staff can access client data, and is that access logged?
7. Does the AI ever finalise a record, or does every draft need my approval?
8. Does the product record sessions? If so, how is client consent handled?
9. Can I export all my records, and can I delete them completely when I leave?
10. How and how quickly will you tell me about a security incident?

AI-specific points

• Minimise what you send. Initials or placeholders instead of full names reduce what any AI system ever sees.
• Treat AI output as a draft. You remain responsible for the accuracy of the record.
• Watch for invented detail. Good tools only organise what you wrote; check that nothing has been added.
• The EU AI Act adds transparency duties for some AI systems. Your provider should be able to tell you how it applies to their product.

Talking to clients about it

Clients are entitled to know how their information is handled. A sentence in your contract or privacy notice explaining that you use software to help draft notes, that you review every note yourself, and where the data is kept, is usually enough to open the conversation. Some clients will have questions, and that's a good sign of trust.

How Mira approaches this

Mira Practice is designed so that you approve every note, it never records sessions, and demonstration trials use fictional data only. We publish specific technical and compliance claims only once they're implemented and independently verified, so ask us any of the questions above.

This explainer is general information, not legal advice. For decisions about your own practice, consult the Data Protection Commission's guidance, your professional body, or a solicitor.