Privacy
GDPR for independent therapists: five questions to ask any software
You are the data controller. Your tools are processors. Here is what to check before you put a client's name into any of them.
Sessio team · 24 September 2026 · 5 min read
Psychological documentation is health data — a special category under GDPR. As an independent practitioner you are the controller; every tool that stores or touches client data is a processor working on your behalf.
Five questions
- Where is the data stored? Prefer the EU, and ask about every sub-processor.
- Will you sign a data-processing agreement (Art. 28 GDPR)?
- Is anything recorded? Video calls and AI notes are where data quietly multiplies.
- Can I export a client's file — without my working notes — when they ask for it?
- What happens to records after five years, and can I produce a destruction protocol?
The free stack has a legal cost
Google Calendar, a free video tool and notes in a cloud doc are how most practices start. They work. Their weakness is not features, it is that client data ends up spread across US services with no agreement and no structure.
Sessio stores data in the EU, signs a DPA with every therapist, never records sessions, and keeps working notes out of client exports.
Keep reading
Your practice, your clients.
149 zł a month, all-in. Founding therapists keep that price for life.