AI ethical use policy

Effective date: 14 July 2026 | Version: 1.0

The main points

  • AI helps us with paperwork and admin. It never makes decisions about your care.
  • Your sessions are not audio recorded. Where an AI note tool is used, speech becomes text in real time and the audio is immediately discarded.
  • A qualified clinician reviews everything AI drafts before it goes anywhere near your record.
  • Your data is never used to train AI models.
  • Nothing AI-related happens in your sessions without your explicit consent, and saying no changes nothing about your care.
  • You do not need to ask. If AI would touch your clinical care, your clinician will raise it with you first.

Contents

1. Purpose and scope 2. What we mean by AI 3. Guiding principles 4. How we use AI day to day 5. Our independent clinician model 6. Our endorsed tool: Heidi 7. Other AI tools, and why you never need to ask 8. Minimum standards for any AI tool 9. What AI is never used for 10. Your rights 11. Consent in detail 12. Governance and review 13. If something goes wrong 14. Complaints 15. Questions and updates

1Purpose and scope

This policy explains how Thriving Minds Collective Ltd, trading as The Online Psychologists ("TOP", "we"), and the independent Clinical Psychologists associated with our practice, in their work with our clients, use artificial intelligence, the standards every tool must meet, and the protections you have. It sits alongside our privacy policy, which covers how we look after your information more broadly.

2What we mean by AI

By "AI" we mean software built on large language models or speech recognition that supports clinical or practice work. In this practice that currently means two things:

  • Practice administration: software tools that help us run the practice behind the scenes. These never make, or influence, any decision about your care.
  • Transcription and note drafting: turning what was said in a session into text and a structured first draft of clinical notes, for the clinician to edit and approve.

Ordinary practice software with no AI in it (our diary, invoicing and secure record systems) is outside the scope of this policy. Our online enquiry and matching forms are structured questionnaires, not AI: your answers go directly to our clinical team.

3Guiding principles

1. Human-led careAI assists with paperwork; your therapy, and every clinical judgement in it, stays with your psychologist.
2. TransparencyYou are told whenever AI is involved in your clinical care, what it does, and which tool it is.
3. Explicit consentAI is only used in your sessions with your informed, voluntary consent. Refusing never affects your access to therapy.
4. Clinician oversightEvery AI output is reviewed, edited and approved by a qualified clinician before it enters your record.
5. Data minimisationAI tools only see what they need for the task at hand.
6. No model trainingYour personal and clinical information is never used to train AI systems.
7. No autonomous decisionsAI cannot triage risk, diagnose, recommend treatment or influence your care.
8. AccountabilityYour treating Clinical Psychologist is responsible and accountable for the AI tools they choose to use, and for ensuring those tools meet the standards set out in this policy.

4How we use AI day to day

Session notes (with your consent). Some of our psychologists use an AI note tool to help write up sessions, so they can give you their full attention instead of scribbling. Sessions are not recorded: speech is converted to text in real time and the audio is immediately discarded. Your clinician reviews and approves every note before it enters your record. More in sections 6 and 7.

Practice administration. AI tools help us build and maintain the secure systems that keep the practice organised behind the scenes. When you contact us by email or through our enquiry form, a person reads your message and a person replies. The decision about your care, including which psychologist we suggest for you, is always made by Dr Rachel Whatmough or another clinician, never by software.

5Our independent clinician model

The psychologists at TOP are independent practitioners rather than employees, and each is the data controller for the clinical records they create (our privacy policy explains this in full). That means each clinician chooses and is responsible for their own tools, including any AI note tool.

What TOP does centrally:

  • sets the minimum standards in section 8, which every tool must meet before it can be used with our clients;
  • endorses one tool, Heidi (section 6), that we know meets them;
  • acts as your central point of contact for any question, preference or complaint, so you never have to navigate this alone.

6Our endorsed tool: Heidi

The tool we officially endorse for session documentation is Heidi, an AI medical scribe that is widely used in healthcare, including by clinicians across the NHS. It acts as a data processor for the clinician using it.

No audio keptSessions are not recorded. Speech becomes text in real time and the audio is immediately discarded; only the text remains.
Clinician approvalYour clinician reviews, edits and approves every draft before it is stored in your clinical record.
No model trainingHeidi is contractually prohibited from using client information to train or improve its AI models.
UK data protectionHeidi operates under UK GDPR with a signed data processing agreement and UK data hosting, and each clinician completes a data protection impact assessment before using it.

If your clinician proposes using Heidi, they will explain it and ask for your consent first. You can say no, or change your mind later, without it affecting your therapy in any way.

7Other AI tools, and why you never need to ask

Because our clinicians are independent, some may prefer a different note tool. Any alternative must meet every minimum standard in section 8, and the clinician using it is responsible for checking that it does.

You do not need to ask, or check, or worry that something is happening without you knowing. If your clinician uses any AI tool in your clinical care, they will raise it with you before it is used: which tool, what it does, where your information is stored, and what protections apply. You will have the chance to ask questions and decide, and you can withdraw your consent at any point afterwards. If you would rather talk it through with someone other than your clinician, contact us at [email protected] and we will handle it.

8Minimum standards for any AI tool

Every AI tool used with TOP clients, whoever the clinician and whatever the product, must meet all of the following. A tool that cannot is not used in client care.

  • No audio recording. Sessions are never stored as audio. Transcription happens in real time and audio is immediately discarded; only text is kept.
  • UK GDPR and Data Protection Act 2018 compliance, demonstrably.
  • A signed data processing agreement between clinician and vendor before any client data is processed.
  • No model training on client data, guaranteed in the contract.
  • Human review of every output. Nothing AI-generated is stored unreviewed.
  • No autonomous clinical decisions. No triage, diagnosis, risk assessment or treatment recommendation without clinician oversight.
  • A completed data protection impact assessment by the clinician before use with clients.
  • Explicit, documented client consent before use, with the right to refuse or withdraw at any time without any effect on care.
  • Appropriate security: encryption in transit and at rest, access controls, and breach notification procedures.
  • Lawful international transfers where any processing happens outside the UK, using UK GDPR approved mechanisms, with UK hosting preferred.

9What AI is never used for

  • Diagnosis, treatment decisions or risk assessment
  • Deciding whether we can offer you a service, or triaging referrals
  • Replacing contact with a real clinician (we do not use chatbots)
  • Profiling clients or predicting clinical outcomes
  • Replacing clinical supervision or professional judgement
  • Training or improving AI models with your data
  • Content presented as a clinician's personal opinion without their review
Looking ahead: we do not use client-facing AI such as chatbots, symptom screeners or automated replies to enquiries. If that ever changed, we would update this policy first and tell you clearly before anything affected you.

10Your rights

The right to know
Before any AI is used in your care, your clinician tells you which tool and what it does.
The right to ask
At any time, ask your clinician or us which tools are involved, how they work and what safeguards apply.
The right to say no
AI in your sessions needs your explicit consent, and declining changes nothing about your access to therapy.
The right to change your mind
Withdraw consent whenever you like, by telling your clinician or emailing us. Section 11 explains what happens to existing notes.
The right to correction
If anything in your record looks wrong, AI-involved or not, tell us and we will correct it. This is your legal right under UK GDPR.
The right to complain
See section 14. You can also go to the ICO directly at any time.

11Consent in detail

Couples and joint sessions. AI tools need everyone's consent. If any one person says no, the tool is not used in that session, and anyone can withdraw at any point in therapy.

Accuracy. Your clinician, not the software, is responsible for your record being accurate. AI output is only ever a draft until a clinician has reviewed and corrected it.

If you withdraw consent. Withdrawal stops all future AI use straight away. Notes that already exist stay in your record, because the law and our professional bodies require us to keep accurate clinical records, but you can ask for corrections to any entry at any time, and withdrawal does not undo the lawfulness of what you previously agreed to (UK GDPR Article 7(3)).

12Governance and review

Dr Rachel Whatmough, Clinical Director, is responsible for this policy and acts as our data protection and AI governance lead. We review the policy at least once a year and whenever our AI use changes, and we follow guidance from the Information Commissioner's Office (ICO), the Health and Care Professions Council (HCPC) and the British Psychological Society (BPS).

13If something goes wrong

If a data incident involves client information, whether in our systems, a clinician's practice or an AI vendor, we investigate immediately and keep a record. We report to the ICO within 72 hours where the legal threshold is met, and if a breach is likely to put you at high risk we contact you directly and promptly: what happened, what information was involved, what we are doing, and what you can do. Vendors are contractually required to tell us about breaches without delay. If you ever suspect a problem with your data, contact us and we will investigate.

14Complaints

  • Talk to your clinician, who will explain what was used and put right what they can.
  • Or come to us: email [email protected]. We will acknowledge your complaint promptly, investigate, and respond without undue delay.
  • Or go to the ICO at any time, whether or not you have spoken to us first: ico.org.uk, 0303 123 1113.

15Questions and updates

Ask us anything about AI in this practice at [email protected]. When we update this policy, the version number and effective date at the top will always tell you what is current, and we will communicate significant changes clearly.

Effective date: 14 July 2026  |  Version: 1.0