Your Therapist May Be Using AI to Record Your Sessions. Here’s How to Protect Your Privacy

If you’re in therapy, you probably assume that what you say stays in the room—or at least in a locked filing cabinet. But a growing number of therapists now use AI tools to record, transcribe, and summarise sessions. The pitch is convenience: AI note-taking saves the therapist time, so they can focus more on you. But for patients, the privacy trade-off is rarely explained.

According to a recent investigation by All About Cookies, tools like Otter.ai and Notion AI are being adopted by mental health professionals without always informing patients how their sensitive data is handled. The result is that deeply personal conversations—about trauma, relationships, medication, and more—may end up stored on third-party servers, possibly outside your country, and potentially accessible to employers, insurers, or data brokers.

This article walks through what’s happening, why it matters, and what you can do about it.

What Happened

AI transcription services have been around for years, primarily in business meetings. But as the tools become cheaper and more accurate, they’ve spread into healthcare—including mental health. Some therapists use general-purpose apps like Otter.ai or Notion AI; others use purpose-built platforms designed for healthcare that still route recordings through cloud servers.

The key point is that when your therapist hits “record,” the audio of everything you say is processed by an AI model. That audio may be transcribed, analysed, and stored. Even if the recording itself is deleted, the text transcript remains. The original article notes that many therapists do not ask for explicit consent or fully disclose how the data is used—including whether it’s used to train AI models.

Why It Matters

The risks are not hypothetical.

First, data breaches. Healthcare data is among the most valuable on the black market, and mental health records are especially sensitive. A breach could expose details about your diagnosis, childhood, or substance use history. Even if the AI provider claims to encrypt data, breaches still occur.

Second, insurance and employment. In the United States, the Health Insurance Portability and Accountability Act (HIPAA) sets rules for protecting health information. But HIPAA may not fully cover AI transcription services if the therapist uses a tool that doesn’t sign a Business Associate Agreement (BAA). Without that agreement, the AI provider is not legally obligated to safeguard your data the same way a hospital would. State laws vary. California’s CCPA gives you rights to know what data is collected and to request deletion, but not every state has such protections.

Third, “anonymization” is not a reliable safeguard. Even if the AI service strips your name, it may still re-identify you based on your speech patterns, appointment times, or other metadata. Researchers have repeatedly shown that de-identified data can often be matched back to individuals.

Finally, there’s the question of consent. You cannot give informed consent if you don’t know what’s happening. Many patients are not told at all. Some are handed a generic privacy notice that buries the AI recording in fine print.

What You Can Do

You don’t have to accept AI recording without a second thought. Here are concrete steps you can take before your next appointment.

  1. Ask your therapist directly: “Are you using any AI tool to record, transcribe, or summarise our sessions?” If yes, ask for the name of the software, how it processes your data, where the data is stored, and whether a Business Associate Agreement is in place.

  2. Request a copy of the privacy policy: Specifically, look for language about data retention, third-party sharing, and whether your data is used for model training. If anything is unclear, ask for clarification in writing.

  3. Know your right to opt out: Under HIPAA, you generally have the right to request that certain uses or disclosures of your health information be restricted. Many therapists will agree not to record sessions if you object, but you need to make the request explicitly.

  4. Consider using a health-specific AI tool: Some platforms are built specifically for healthcare and comply with HIPAA more thoroughly. Ask your therapist if they use such a tool, and if not, suggest switching.

  5. Check your state’s privacy laws: If you live in California, Colorado, Virginia, or other states with strong privacy laws, you may have additional rights to access, delete, or limit the sale of your data. Use those rights.

  6. Request data deletion after sessions end: Even if you consented, you can later ask for transcripts or recordings to be deleted. The therapist may be required to retain records for a certain period for clinical reasons, but you can still push back against unnecessary storage.

  7. Consider alternatives: If you are not comfortable with AI recording at all, ask your therapist to take notes by hand or type them without recording. Some still use traditional note-taking methods.

Sources

  • “Your Therapist May Be Using AI to Record Your Sessions. Here’s What Happens to That Data.” All About Cookies, May 20, 2026.
  • HIPAA Privacy Rule, U.S. Department of Health and Human Services.
  • California Consumer Privacy Act (CCPA) and other state privacy laws.

The decision to use AI in therapy should be transparent and optional. You have the right to know what happens to the most private parts of your life—and to say no.