GDPR calls mental health data "special category" for a reason, and your consent form probably still doesn't say so

Konfidens, in guidance that doesn't carry a publication date, spells out what an online therapy consent form is actually meant to cover under GDPR, and it's more than a tick-box link to a privacy policy - this includes practices like yours if sessions have moved to video.

Page updated: 13 Aug 2026

Whole-practice growth for wellness practices. Rooted in Wiltshire, UK, working worldwide.

Therapy practices working online carry consent and data obligations that a face-to-face intake form was never written for, and getting it wrong isn't just untidy, it's a compliance problem.

Original Research	A vendor's explainer on what GDPR-compliant consent looks like for online therapy, including the reminder that mental health notes count as special category data
Source	https://www.konfidens.com/blog/gdpr-informed-consent-online-therapy
Overview	Konfidens, a compliance-tools provider aimed at therapists, walks through the wording and safeguards a consent process needs to mention, such as platform security and data breach risk.
Year	Not stated
Publisher	Brand, Konfidens
Relevance to Wellbeing	Directly relevant to any therapy practice running sessions by video, since it addresses exactly the consent gap that appears when in-person paperwork gets reused online without updating.
Our Verdict	Too early to tell the underlying law is real, but this particular explainer comes from the company selling the compliance fix, with no study, regulator citation, or methodology behind it.
Our Summary	The legal point stands up: GDPR does treat health and mental health data as special category, requiring extra care. The claim itself has no named source, case reference, or regulator citation attached to it, just the vendor's own phrasing. It's a fair nudge to check whether your own consent wording has kept up with moving sessions online. There is no sample, no survey, nothing to weigh it against, so treat it as sensible advice rather than sourced evidence.
Our Geo View	Applies to practices operating under UK GDPR or EU GDPR; therapists elsewhere should check their own data protection framework rather than assume this transfers directly.

Abstract of wellbeing niches and revenue flow

Recognise how this might impact your practice

Why this might matter to you

Coaching: this matters because coaches who drift into wellbeing territory online are still collecting private information on people's lives, whether or not anyone calls it a clinical record.
Therapy: this matters because an intake form written for a face-to-face room almost never mentions the video platform you're now actually using.
Training: this matters because health questionnaires collected for online classes still count, and "special category" doesn't stop applying just because someone's doing squats rather than talking about their childhood.
Alternative Healing: this matters because a note about someone's anxiety, jotted down after a reiki booking made online, is special category data whether or not you consider yourself medical.
Clinical: this matters because clinical services keep the clearest paper trail, and regulators tend to look hardest at whoever looks most official.
Retreat/Centre: this matters because pre-retreat health questionnaires are precisely the kind of data GDPR singles out for extra handling.

Where this came from

Konfidens' blog post talks through what a properly compliant online therapy consent form and data policy ought to cover under GDPR.

Konfidens blog, publish date not given.

Credibility flags: no methodology, since this is compliance commentary rather than research; sample size not applicable; publisher is a compliance-services brand with a commercial stake in the topic.

How we scored this

A relevance score out of 100, built from three things: how well it fits the six practice types, how recent it is, and how solid the methodology behind it is.

43%

Practice fit, 100How new, 10How solid, 0

Marked down hard on how solid the method is, since there isn't one, but scored well for fitting therapy practices squarely and for staying current, GDPR obligations not having gone anywhere.

It's worth considering changes to your marketing practices

What this means for your marketing

Put the actual name of your video platform in your consent form, not just a line about taking data protection seriously.
Say the phrase "special category data" to your admin team before a client asks what happens to their session notes.
Brief whoever handles enquiries that health details typed into a booking form need the same care as a locked filing cabinet.
Rewrite your privacy policy to mention platform security specifically, rather than linking to a template nobody's opened since 2019.
Ask your video software provider, in writing, what happens to recordings and where they're stored.

Who this is most useful for

Practice type	Relevance	Recommended action
Coaching	Medium	Review consent wording if any sessions touch on personal or health-adjacent topics.
Therapy	High	Rewrite consent forms to name the platform and its risks explicitly.
Training	Low	Check intake forms if health information is collected for online classes.
Alternative Healing	Medium	Treat any written notes on clients' mental or physical state as special category data.
Clinical	High	Audit consent and data storage processes against current GDPR wording.
Retreat/Centre	Medium	Update pre-arrival health questionnaires with clear data handling language.

Best before

Best before: revisit this if UK or EU GDPR guidance changes, or every 12 months regardless, since vendor guidance pages like Konfidens tend to get quietly rewritten.

The Thoughtful Ones Always Make It To The Bottom.

Well done, thinker. We love thinkers and they love our careful ways - our listening wind, story garden and visual river are all waiting for you in a twenty-five-minute coffee conversation that helps you rekindle faith in growing your practice. Milk and sugar?

Find your Sunlight ▶