Your Notes Don't Have to Leave the Room

Sep 24

A Therapist's Guide to Safe Apps and Voice Typing

Confident Therapist Hub · Privacy and data · 9 min read, in plain English

The confidentiality you keep in the therapy room doesn't have to stop at your phone or laptop. Most devices can now keep client notes, and even your voice typing, entirely to themselves. This guide shows what that means for you, whichever professional body you belong to.

You're being shown half the picture

Most guidance on choosing apps for client notes starts from one assumption: your notes will live on a company's server, and you'll pay a monthly subscription for it. In fact today I read a comprehensive and useful guide that did exactly this. Every check it offered was about the company: its contract, its country, its AI, its exit terms.

That is half the picture. The other half is tools that never send your notes anywhere at all.

What most guidance assumes
A cloud-based app
Your notes The app company's servers A data centre, which may be outside the UK Their backups and sub-processors Their AI features, if the app has them

Several parties, often a monthly fee.

The option often left out
An on-device app
Your notes Your own phone, tablet or computer

One place, and it's yours. Plus any backup you choose to make.

Every extra place your notes go is another company to check, trust and name to your clients.

I'm not against cloud-based tools. They have a place, and many therapists use them well. But private, on-device tools are a real option, and guidance that leaves them out is incomplete.

Credit where it's due
To the therapists already doing this well

Many of you already keep client details and therapy admin in spreadsheets and documents on your own devices, cheaply, carefully and in line with UK GDPR. You've probably been doing it for years, and likely without anyone telling you how smart this is. Well, it is smart!

With encryption and a backup routine, your way can carry less risk than a subscription service, not more. It needs no data centre either, which is a help to the environment.

Whatever tools you use, online or offline, this guide sets out in plain English what you need to be aware of and what to do about it.

Does my client's information leave my device?

Almost everything follows from this one question.

If yes

You need to know who gets it, where, and what they do with it.

If no

You need to protect the device and keep a safe copy.

Law, code or good sense?

Three sources shape what you do with client information. Knowing which one you are meeting makes each choice easier to explain.

What the law requires
  • Keep client information secure, wherever it is kept, including on your own device, and be able to get it back if something goes wrong.
  • Have a written contract with any company that handles it for you.
  • Use a proper legal basis if it goes outside the UK.

This comes from UK GDPR and the Data Protection Act 2018, and applies to every therapist.

What your professional body expects
  • Keep client information confidential, and tell clients how you keep and use it. Most professional membership guidance suggests or requires this.

BACP's 2026 framework goes further and spells out three more. Other bodies may expect similar, so check your own:

  • Weigh up the risks of any AI or digital tool before using it.
  • Get clients' informed consent before putting their information into AI or digital tools.
  • Be able to explain why you made your choice.
What good practice suggests
  • Keep only the information you need.
  • Review your choice regularly, and whenever a tool changes.
  • Check your choices in supervision.

What your professional body says

Every main body expects you to protect confidentiality and follow data protection law. Some have gone further on digital tools and AI.

BACP

The Ethical Framework 2026 becomes mandatory at midday on Tuesday 3 November 2026. It is the most specific code so far on digital tools. Section 2.1(e), under the framework's core responsibilities for keeping clients safe, asks you to weigh up the risks of any AI tool, digital tool or online platform before using it, understand how it handles and stores data, be open with clients about it, and have their informed consent before putting their personal data into it.

UKCP

The UKCP Code of Ethics and Professional Practice applies whether you meet clients in person or online. UKCP also publishes separate guidelines on security and confidentiality, which cover technology and data protection, and on working online.

NCPS

The NCPS Code of Ethics sets out members' duties on confidentiality. NCPS is also a founding member of the AI Expert Reference Group, which has published a Shared AI Charter for counselling and psychotherapy.

COSCA

COSCA has published AI Guidelines for Counsellors and Psychotherapists. They say AI should support your work, not replace your judgement, that anything it produces should be checked, and that you should take care with details such as session dates, times and places that could identify a client.

Others

If you are registered with the HCPC, or belong to BABCP or another body, your standards on confidentiality and record keeping apply to any tool you use. Check your body's current guidance on digital tools and AI, as several are updating theirs.

Offline tools are still digital tools. Whatever your body, a tool that never goes online is still a digital tool, and BACP's 2026 wording covers it directly. Keeping data on your device does not remove your duties. It just makes them so much easier to meet.

No other company handles your notes, so there is no processor under UK GDPR and no data processing agreement (DPA) to sign. You remain the controller, and the question of where your notes are stored answers itself: on your device, nowhere else.

The duty to keep them secure stays, but it sits with you rather than a company. That is less daunting than it sounds. Most current phones and laptops encrypt their storage by default, and a backup routine takes a few minutes to set up once.

With clear guidance it is perfectly do-able.

The journey of a note

Every note makes the same trip. Open each stage to see what can happen and what to do.

1. You type or speak it

Typing stays on the device. Speaking can too, if dictation is set to on-device. Buttons that tidy, rewrite or summarise your text may send it to a server.

See voice typing, below.

2. The app saves it

Either on your device, or on a company's server. If it goes to a company, ask three things before you add any client:

  • Which country is it stored in?
  • Will you sign a contract (a data processing agreement) with me?
  • Do you use my notes for anything else, including training AI?

If the app keeps it on your device, look for a clear statement that the developer never receives your data.

3. Copies get made

Phones often back up app data to iCloud or Google without asking. Sync features copy notes to other devices or accounts.

Find out what your device copies and where. Then choose how you keep a safe copy, rather than leaving it to default settings.

If you back up to the cloud, check whether the backup is end-to-end encrypted, so the provider cannot read it. On iPhone, Advanced Data Protection does this for iCloud backups. Or keep an encrypted copy on an external drive instead.

Keep one copy somewhere else. If your device and all your backups are in the same building, one fire, flood or burglary could take the lot. UK GDPR expects you to be able to get client information back in good time after an incident like this. A simple rule of thumb is 3-2-1: three copies, on two different types of storage, with one kept off-site. That could be an encrypted USB drive kept at a different address, or an end-to-end encrypted cloud backup.

Every so often, check you can actually restore from your backup, not just that it is running. The same thinking applies to paper notes, which fire and flood can destroy just as easily.

4. You keep it for years, or lose it
  • Lock the device with a passcode or fingerprint, and use the app's own PIN if it has one. Most phones and laptops encrypt their storage once a passcode is set. On a Windows laptop, check that Device encryption or BitLocker is switched on.
  • Know how to find and wipe the device if it is lost.
  • Export regularly. Deleting an app or clearing browser data can delete your notes too.
  • With an online service, check you can get everything out if you leave.

Voice typing that stays on your device

Dictating is not recording

Recording a session

Sending session audio for transcription puts your client's own voice with another company. That is high risk and needs careful thought and clear consent.

Dictating your notes

Afterwards is different. You speak, the device types. With on-device dictation, nothing is sent anywhere.

Click on the device(s) you use below to see how to set it (them) up.

Android

Use Gboard voice typing with the on-device option. In Gboard settings, open Voice typing, turn on faster on-device voice typing, and turn off any cloud or polish options. Then tap the microphone on your keyboard while a text box is selected.

Menu names vary by phone. Look for options called Faster voice typing or Offline speech recognition, make sure your language is downloaded for offline use, and turn off anything that mentions improving, personalising or donating audio. Without the offline language, dictation may quietly go online.

iPhone and iPad

Apple's built-in dictation runs on your device on recent iPhones and iPads for supported languages, including English. Turn it on in Settings, General, Keyboard, Enable Dictation. Then tap the microphone key on the keyboard.

Also turn off Improve Siri & Dictation, in Settings, Privacy & Security, Analytics & Improvements. This does not switch dictation off. It only stops Apple keeping samples of your audio to improve its services.

Mac

Turn on Dictation in System Settings, Keyboard. On Apple silicon Macs, dictation for supported languages is processed on your device.

Also turn off Improve Siri & Dictation, in System Settings, Privacy & Security, Analytics & Improvements. Dictation keeps working; Apple just stops keeping samples of your audio.

Windows

Use Voice Access, built into Windows 11 (version 22H2 or later). It listens and types on your device and works offline. The first time you turn it on, Windows asks to download a speech model for your language. Say yes, as this is what lets it work on the device.

Avoid the Win+H voice typing tool and Word's Dictate button for client notes. Both send your audio to Microsoft's online speech service. Microsoft says it does not store the audio or the transcript, and only keeps voice clips if you have agreed to share them, but the audio still leaves your device.

The airplane test
  1. Turn on airplane mode.
  2. Dictate a test sentence into a notes box.
  3. If the words appear, your device can dictate offline.
  4. Turn airplane mode off and check your settings are still on-device.
  5. Repeat the test after any major software update, as menus and settings can change.
Four things that can still send your words away
  • Tidy, rewrite or summarise buttons. Some run on the device, some send text to a server.
  • Keyboard apps you have added. They may send what you type or say to their own servers. Use the built-in keyboard for client notes.
  • The app you dictate into. Private dictation into an online notes service still puts the notes online.
  • Dictation built into another program. Word's Dictate looks like part of Word, but it needs an internet connection because the speech recognition happens on Microsoft's servers. Turn the wifi off and it stops; on-device dictation carries on.
In Think Space
Dictation that stays on your device

Think Space is my app for process and reflection notes, kept on your device. Your device's own dictation types into any box in it, and Think Space never records or sends your voice anywhere. The dictation guide in the app shows the on-device option for your device, with a button to open the right settings on Android, Mac and Windows.

See Think Space for Therapists

What to tell clients

Put the tools you use in your privacy notice and working agreement, in plain words, and talk them through at the start. Clients should be able to ask questions and say no.

An example line, to use only if it is true for your set-up:

"I keep my notes in an app that stores them on my own device. I sometimes write them using the device's built-in voice typing, which also works on the device. Nothing is sent to other companies."

Where does it go? A quick recap

Stays on your device

Typing into an offline app. Gboard with on-device voice typing. Apple dictation with Improve Siri & Dictation off. Windows Voice Access.

Leaves your device

Typing into an online notes service. Word's Dictate button, which sends your speech to Microsoft to be turned into text. Windows Win+H voice typing, which does the same. Uploading a session recording for transcription.

Depends on your settings

Tidy, rewrite and summarise buttons. Automatic phone backups. Keyboard apps you have added.

If you are not sure which box something is in, try the airplane test, or ask the maker. Confidentiality starts in the room. With the right set-up, your notes can stay there too.

Your quick record

Professional bodies expect you to be able to explain your choices, and BACP 2026 says so directly. Tick each one when it is true for you:

Your ticks are not saved. Screenshot or print this box to keep with your practice records.

Related

References and sources
  1. BACP, Ethical Framework for the Counselling Professions 2026, sections 2.1(e), 3.1 and 3.2, mandatory from midday on 3 November 2026: https://www.bacp.co.uk/media/26718/bacp-ethical-framework-for-the-counselling-professions-2026.pdf
  2. UKCP, Code of Ethics and Professional Practice (2019): https://www.psychotherapy.org.uk/media/bkjdm33f/ukcp-code-of-ethics-and-professional-practice-2019.pdf
  3. UKCP, Security and Confidentiality Guidelines: https://www.psychotherapy.org.uk/media/1ptnp1jt/ukcp-security-and-confidentiality-guidelines-2018-june2024.pdf
  4. UKCP, Guidelines for Working Online/Remotely: https://www.psychotherapy.org.uk/media/jrohoner/ukcp-guidelines-for-working-online-or-remotely-v1.pdf
  5. NCPS, Code of Ethics: https://www.ncps.com/about-us/code-of-ethics
  6. NCPS, AI Expert Reference Group and Shared AI Charter: https://ncps.com/ai-expert-reference-group
  7. COSCA, Artificial Intelligence (AI) Guidelines for Counsellors and Psychotherapists: https://www.cosca.org.uk/download_file/view/1741/261
  8. UK GDPR, Articles 9, 28 and 32, and Chapter V on international transfers: https://www.legislation.gov.uk/eur/2016/679/contents
  9. Information Commissioner's Office, A guide to controllers and processors: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors-a-guide/
  10. Information Commissioner's Office, A brief guide to international transfers (updated January 2026): https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/international-transfers-a-guide

Professional body requirements are revised periodically. Check your own body's current wording before acting.

This article is general professional guidance, not legal advice. Device settings change with software updates, so check your own device before relying on it.

Descriptions of professional body guidance reflect the published documents reviewed in September 2026. Requirements may change.

© 2026 Joel Bild, trading as J Bild Health & Education and as Confident Therapist Hub. All rights reserved.

Created with