General information, not legal advice. Check your professional body's guidance and speak to your Information Officer (SA) or Data Protection Officer (UK).

AI note assistants can save clinicians time on writing. But recording a session is a serious step. Here's a checklist for doing it carefully.

Before the first recorded session

Explain it in plain words. What is recorded, why, who processes it, where it's stored, how long it's kept and who signs the note.
Get written consent and store it on the client's file before anything is recorded.
Make no a real option. Clients who decline get the same care. The clinician writes the note instead.
Everyone in the room consents. For couples, family and group sessions, every participant needs to agree. For minors, follow the rules on parental consent and the child's own assent.
Make it revocable. Clients can change their mind at any time.

In the session

Show clearly when recording is on.
Let the clinician skip any session. Some conversations shouldn't be recorded, and that's a clinical decision.
Same rules online. A Zoom, Teams or Meet session needs the same consent as one in the room.

After the session

A person signs. The AI drafts; the clinician checks, edits and signs. Don't let a draft become the record unread.
Watch for risk language. Make sure anything about self-harm or safety is read and acted on by the clinician.
Know what happens to the audio and transcript, and say so in your privacy notice.

Questions to ask your vendor

Where is audio processed and stored, and in which country?
Is client data used to train AI models?
Can I see what the AI drafted versus what I signed?
Can I turn recording off per client and per session?
Is consent recorded in the system, and does recording follow it?

South Africa: POPIA

Health information is special personal information under POPIA. Consent is one basis for processing it, and recording a session to produce a note is a purpose you should explain clearly. If audio or text is processed outside South Africa, section 72 applies. Check your HPCSA ethical rules on confidentiality and take advice on how they apply to recording.

United Kingdom: UK GDPR

Health data is special category data. You need a lawful basis and an Article 9 condition, and for AI processing of session audio you'll usually need a Data Protection Impact Assessment (DPIA). Check your professional body's guidance (for example BACP, UKCP or HCPC) on recording.

Sample wording to adapt

With your permission, I'd like to record our session so a software assistant can help me draft my notes. I'll read, correct and sign the notes myself. The recording is stored securely in [hosting location] and handled as described in our privacy notice. You can say no, and it won't affect your care. You can also change your mind at any time.

How Within handles it

In Within, recording is optional. Clinicians can record in the room, record an online Zoom, Teams or Meet session from the browser tab, or import a recording or voice memo. The client's consent to recording is kept on their file, and recording follows that choice. Within Assist drafts from the transcript and the client's history; the clinician reviews, edits and signs. Assist doesn't diagnose and never signs the record.

When it opens, a role-play recording and demo clients keep a real client out of the first test. Reach + Within is in private development. Join the waitlist.

Reviewed by a member of our clinical team.

Recording sessions for AI-drafted notes: a consent checklist (POPIA and UK GDPR)