Is an AI scribe safe for therapy? An honest risk assessment

An AI scribe can be safe for therapy practice, but only if it's built with the right data architecture and you've done your due diligence. The risks are real — audio handling, data residency, consent, and third-party processing all need scrutiny. This guide walks through each risk honestly and flags where your professional body's guidance should take precedence over any vendor's marketing.

What the actual risks are

Therapists asking about AI scribe safety are usually worried about three overlapping things: whether session audio or transcripts could be exposed, whether AI processing breaches UK GDPR, and whether clients need to consent and how to obtain it properly. These are the right questions.

Audio and transcript exposure is the most immediate concern. If a recording is uploaded to a cloud server, stored, and used to train a model, that's a serious confidentiality breach — and potentially a reportable incident under UK GDPR. The risk depends entirely on the tool's technical design. Some scribes record and store audio server-side by default; others transcribe locally in the browser so audio never leaves the device. Those are meaningfully different risk profiles, and you need to know which you're dealing with before you start.

Data residency matters because UK GDPR requires that personal data transferred outside the UK has adequate protection. If your scribe vendor processes transcripts on US servers under a standard commercial agreement, check whether a valid transfer mechanism is in place. EU (EEA) servers are generally safer from a UK adequacy perspective, but confirm with the ICO's current guidance rather than relying on a vendor's assurance alone.

Third-party AI model training is a separate issue. Many general-purpose AI tools retain input data and use it to improve their models. Clinical data must never enter that pipeline. Look for explicit zero-data-retention commitments from the AI provider the scribe uses — not just the scribe vendor itself.

GDPR and lawful basis: what you actually need

Processing therapy notes involves special-category data under UK GDPR (health data). You need both a lawful basis and a separate condition under Article 9. The most commonly applicable condition for private practitioners is explicit consent or, in some cases, the provision of health or social care. The precise requirements depend on your context, so check with the ICO or your professional body rather than treating any single article — including this one — as definitive.

In practice: you need a clear privacy notice telling clients that AI-assisted note-taking is part of your practice, what data is processed, by whom, and where. Obtain explicit, informed consent before using any AI scribe with a client. Most professional bodies (BACP, UKCP, HCPC, NCS) have issued or are developing guidance on AI use in practice — check their current position before you start, and keep a record that you did.

What to check in any AI scribe before using it

• Where is audio processed? Is it transcribed locally (in the browser or on-device) or uploaded to a server? If uploaded, is it deleted immediately after transcription or stored?
• Where are transcripts processed? Which country, which data centre, and under what legal framework?
• Does the AI provider retain data? Ask specifically about the underlying model — not just the scribe platform.
• Is the vendor ICO-registered? Organisations processing personal data on behalf of others in the UK should be registered with the ICO.
• Is there an immutable audit trail? You need to demonstrate what data was processed and when, in case of a subject access request or complaint.
• What does the Data Processing Agreement say? You should have a DPA with any vendor processing personal data on your behalf. Read it.
• Can you export and erase client data? UK GDPR gives clients rights of access and erasure. Your tools need to support those rights.

The honest limitation

No AI scribe eliminates documentation risk — it redistributes it. You're trading the risk of handwritten notes being lost or illegible for the risk of a digital system being breached, misconfigured, or used without adequate client consent. AI-generated notes can also contain errors: a misheard name, a misattributed statement, a subtlety of tone the draft gets wrong. Every note needs clinical review before it enters a record. If you're time-pressured, there's a temptation to save a draft without reading it carefully — that's where the real clinical risk lives, and no technology solves it.

Client consent in practice

Telling a client you use an AI tool to help draft your notes isn't optional. It's an ethical requirement under most professional codes and a legal one under UK GDPR. In practice, this means updating your contract and privacy notice, having a brief conversation at the start of the work, and documenting that the client understood and agreed. Some clients will have concerns — particularly those with trauma histories or who work in sensitive fields. Those concerns deserve a proper conversation, not a reassurance script.

What makes a scribe safer by design

The safest architecture is one where audio is transcribed locally (never transmitted), transcripts are processed in memory server-side and discarded after the note is drafted, nothing enters a client record until the clinician explicitly saves it, and the AI model runs with zero data retention. Data residency in the EU or UK, ICO registration, and a clear DPA are baseline requirements, not differentiators.

For more on evaluating a vendor's data handling claims, the Sorca trust and data page sets out specific technical and legal commitments in plain language — useful as a comparison point even if you're evaluating other tools.

If you're thinking about how outcomes data (PHQ-9, GAD-7) fits into your record-keeping, outcomes tracking raises similar questions about consent and storage worth considering alongside this.

For practitioners who need to demonstrate compliance to a professional body or produce records for supervision, the supervision and CPD log can help you keep a clear record of AI-related CPD and any relevant decisions you've documented.

Where Sorca fits

Sorca is a UK-based AI clinical scribe built for private-practice therapists. Audio is transcribed in the browser using the Web Speech API — it never leaves your device and is never stored. Transcripts are processed in memory and discarded after the note draft is generated; nothing enters a client record until you save it. Data is held on EU (Frankfurt) servers, Sorca is ICO-registered, and the AI runs with zero data retention. It won't make clinical decisions for you, and it won't replace your review of every note — but it's built to reduce the risk, not add to it.

You can try Sorca free for three days with no card required at sorca.life.