AI, Therapy Training and GDPR: Protecting Client Information

A therapist who wants to practise a difficult conversation may be tempted to copy too much detail about a real case into a digital tool. An age, an unusual event, or a distinctive family history can sometimes reveal an individual's identity even when their name is removed.

The key question for AI-supported training is therefore: which information is essential to the learning task, and which information should never be entered at all?

Why does psychotherapy information need special care?

Under the EU General Data Protection Regulation (GDPR), data concerning health belongs to a special category of personal data subject to enhanced protection. Processing such data requires an appropriate legal basis, a relevant Article 9 condition where applicable, and compliance with the Regulation's other requirements.

Using a system “for training only” does not automatically satisfy those conditions. Professional confidentiality and ethical duties continue to apply when technology is involved.

Anonymisation is not the same as pseudonymisation

Pseudonymisation makes linking information to a particular person more difficult, but the data can still be personal data if re-identification remains possible.

True anonymisation means that the individual can no longer be identified using relevant reasonably available means. The European Data Protection Board emphasises this distinction. Removing a name by itself does not guarantee anonymity.

Start with fully fictional scenarios

Practising open-ended questions, empathy, and therapeutic pacing typically does not require a real person's history. A completely fictional character can present a common challenge, such as uncertainty about attending therapy or difficulty setting boundaries.

If a training exercise draws inspiration from practice, obvious identifiers and unique contextual details are a concern. Whether a description is genuinely anonymous depends on re-identification risk, not simply on the writer's intentions.

Five questions to ask before using an AI tool

1. Do I need any real-client information? If not, use a synthetic scenario.

2. What is stored, and for how long? Check retention and deletion information.

3. Who has access? Review permissions, service providers, and possible transfers.

4. What is the lawful process? Compliance requires more than a generic consent checkbox.

5. What does my institution require? Follow the relevant professional, institutional, and ethical rules, and seek specialised advice where necessary.

A responsible approach to simulations

Well-designed skills exercises can rely on synthetic, non-identifying fictional profiles. This allows learners to rehearse communication without exposing real clients to unnecessary data risks.

TheraMentor is an educational practice platform. Any case-description feature should be used without identifiable real-client information unless an adequate lawful and ethical basis exists. This article is general information, not legal advice.